Zero Trust agent control plane in under an hour.
Agents run where you work: laptop, CI, k8s. Identity, missions, shared memory, and audit run in the control plane.
EXECUTION PLANE ╎ CONTROL PLANE · api.zeroroot.ai
┌──────────────────┐ ╎ ┌──────────────────────┐
│ ● agent binary │ ╎ │ ● gibson LIVE │
│ runs on: │ ╎ │ ● graph store READY │
│ laptop · ci · │ ═════╪═══►│ ● redis READY │
│ vps · k8s │ gRPC ╎ │ ● traces READY │
└────────┬─────────┘ ╎ │ ◢ setec ARMED │
│ ╎ └──────────────────────┘
▼ ╎
● byok keys ─▶ anthropic · openai · gemini · ollama
──────────────────────────────────────────────────────
● AGENTS ACTIVE │ ● SANDBOX READY │ ● GRAPH SYNCED$ git clone https://github.com/zeroroot-ai/adk$ cd adk/gibson && go install ./cmd/gibson$ gibson init --gibson-url https://api.zeroroot.ai$ gibson login✔ device-flow sign-in · short-lived session stored$ gibson component init recon-agent --kind agent$ gibson agent enroll --name recon-agent --kind agent✔ one-time bootstrap token minted$ gibson component register --token …✔ capability-grant verified · runtime credential issued$ gibson mission submit recon.cue→ mission queued · 2 nodes running↳ untrusted payload detonated in setec microVM✔ graph: 47 hosts · 12 findings indexed// mission control
Mission control for every agent you run
// the flagship
Autonomous security that maps how risk connects
Point it at your environment. It finds the paths that matter and replays every move. One engine, both sides of the line.
A living model of your environment
One picture, built as it works: every asset, access path, and exposure it finds. Not a one-time scan.
Thinks in paths, not checklists
It reasons about how weaknesses chain, so you get the few paths that are real risk. Attack: walk it. Defend: cut it.
Replayable, move by move
Rewind and scrub every decision it made. A reproducible record for whoever reviews the run.
$ cat why-agents-stall.md
Platform engineers, SREs, and security teams aren't blocking agents because they don't believe in them. They're protecting their organizations from real risk.
Untrusted code in production
AI-generated code running in your pipelines is a breach waiting to happen without real isolation.
Every untrusted payload detonates in a setec microVM. Hardware isolation, not containers.
Compliance can't audit a black box
Regulated environments can't run what they can't replay. “The agent did something” doesn't pass an audit.
Every prompt, tool call, and graph write is captured and replayable, step by step.
Integration drags on for months
Bolting AI onto existing infrastructure means custom glue that still doesn't fit your patterns.
Standard Kubernetes. Agents run where you already work: laptop, CI, VPS, k8s.
Engineers see a threat, not a tool
Adoption stalls when the team that has to champion automation feels automated away.
Your engineers build the agents, own the workflows, and hold the keys. Amplified, not replaced.
$ cat what-you-get.md
ADK
Agent, Tool, and Plugin contracts. A single Harness wires LLMs, memory, tools, and the knowledge graph. Go today, with Rust and Python in the works.
gibson CLI
Scaffolds projects, installs agents and tools, launches missions, inspects graph state. The client you script against api.zeroroot.ai.
DAG missions
A mission is a CUE-typed DAG of agent + tool nodes wired by edges and parameterized by target. CUE catches misconfigurations at submit time (wrong agent name, missing field, bad enum) before the orchestrator ever runs the Observe → Think → Act → Recall → Reflect loop. Pausable, resumable, checkpointed.
Knowledge graph
Every discovery (hosts, ports, findings, techniques, attack chains) lands in the platform's knowledge graph under a YAML-driven taxonomy with CEL-validated schemas. What one agent learns, the next one starts from.
RBAC
Agents, users, teams, and components each have scoped permissions. Your PR-review bot can't touch production, your red-team agent can't touch ServiceNow. Every action audited.
Observability
Gibson Traces captures every prompt, response, tool call, and graph write. Replay any mission step-by-step to see why the agent chose Action X, what each step cost, and where the reasoning went sideways. Tagged per mission, agent, team.
$ cat what-you-run-on.md
Every agent is built by your team (platform engineers, devsecops, red teamers, IR) for the workflows they already own. That's the force multiplier. Agents run where you work (laptop, CI, VPS, k8s) and dial out to api.zeroroot.ai for orchestration, shared memory, and the knowledge graph. Your team decides what crosses the wire and what stays on the host. BYOK for LLM keys. Untrusted payloads detonate inside Setec microVMs. Hardware isolation, not containers.
// Recon mission template.
// Discover the target's exposed surface (open ports,
// running services, reachable subdomains).
mission: {
name: "recon"
description: "Reconnaissance across a target's exposed surface."
version: "1.0.0"
target_ref: ""
nodes: {
scan: {
id: "scan"
type: "NODE_TYPE_AGENT"
agent_config: {
agent_name: "nmap-agent"
}
}
enrich: {
id: "enrich"
type: "NODE_TYPE_AGENT"
agent_config: {
agent_name: "shodan-agent"
}
}
}
edges: [
{from: "scan", to: "enrich"},
]
entry_points: ["scan"]
exit_points: ["enrich"]
}$ cat production.md
Run on the hosted control plane at api.zeroroot.ai, or deploy the entire platform into your own Kubernetes cluster with a single Helm install, including the enclave your organization has already accredited. Your authorization boundary stays yours; the platform deploys inside it. Either way, the controls regulated environments demand are the defaults, not add-ons:
short-lived credentials: agents enroll once and act on short-lived session tokens, with no long-lived keys on disk
tenant isolation: your graph, secrets, and traces are scoped to your tenant, never pooled
full audit trail: every action attributable, every mission replayable
open-source core: the ADK, setec sandbox, tool runner, and SDK are public, so you can inspect it, audit it, trust it
Every account starts with a 2-week free trial (card required). For production tiers (teams, SLAs, audit retention), see pricing.