Give AI agents governed access to your Kubernetes platform
The safe way to put AI to work on your Kubernetes fleet.
AI agents are being handed personal credentials and asked to act against production Kubernetes; when something breaks it is hard to trace and hard to undo, and nobody has a clean audit trail of what the agent did. Portainer-Command is the MCP gateway between agent and cluster: read-only sessions with a rationale and TTL, and every change as a human-approved GitOps pull request. Get more done with the platform team you have.
- MCP gateway and agentic control plane sitting between AI agents and Kubernetes
- AI agents never receive kubeconfig, service account tokens, or direct write path
- Read-only sessions carry a stated rationale and expire on TTL
- Every change becomes a Git pull request; a human approves, GitOps applies
- Every session, proposal, and applied change carries an audited identity
The piece the market did not have
Every existing agentic AIOps story assumes the AI agent gets to speak to the Kubernetes API. That is where the CISO conversation ends. The missing element is the piece between the AI and the cluster: a control plane that turns the AI's read into a supervised, expiring session, and turns the AI's write into a proposal for a human to approve.
The direct answer
Portainer-Command is that missing box. AI agents connect to Portainer-Command's MCP server; the server issues read-only sessions with a rationale and TTL, receives change proposals, opens Git pull requests for them, and lets Portainer Business reconcile approved changes. The agent never touches the cluster API.
The core loop, in five steps
Every AI agent interaction with Kubernetes runs the same five-step loop. There is no side door.
Human sets a goal
A developer tells the agent what to do (deploy this, audit that, review the security posture).
Agent requests read
Short-lived, read-only credential with a stated rationale and a TTL. Revoked at task end or expiry, whichever is first.
Agent proposes change
The proposal becomes a Git pull request against your sanctioned repo, carrying the human's identity as the proposer.
Human reviews + approves
Automated tests can gate too. The AI cannot approve its own changes. Merge is the human's action.
Portainer applies
Portainer Business reconciles the merged change into the target cluster. Full rollback available via Git history.
The reason CISOs sign off
The convenience side of Portainer-Command (the workspace, the prompt library, the chat surface) is what makes it usable day-to-day. The administration side is what makes it sellable. Every AI action across the fleet is visible in one place, and every environment has its own controls.
Per-environment controls
Allow AI in dev, block it from prod
Administrators grant or deny agent access per environment, choosing separately whether an agent may read live cluster state, read the GitOps state, or propose changes. Namespace scoping is set the same way.
Full session timeline
Every AI action, every user, one view
A single dashboard shows every AI proposal, every read session, and the rationale that opened it. The audit trail is complete because every action funnels through Portainer-Command.
Emergency halt
One click kicks every agent out
Revokes every live session, blocks new sessions, and cuts off all agent traffic to an environment (or the fleet) instantly. Sessions mid-flight terminate; nothing continues to execute.
Token spend visibility
Cost per workspace, rolled up per user
Portainer-Command tracks model spend across workspaces over a 30-day window, per user and organization. A misbehaving workspace can be halted; a runaway pattern shows up before the invoice does.
Environment history
Roll back to a previous state
Every change is a Git commit, so state history is Git history. Roll back to an earlier point or revert a specific proposal; the cluster state follows.
Structural, not procedural
Guarantees the architecture makes
AI cannot approve its own changes because there is no path to. AI cannot bypass GitOps because there is no other write path. The guarantees hold because the architecture enforces them.
Bring your own agent, or use the built-in workspace
Portainer-Command exposes an MCP server that any MCP-compatible client can connect to (Claude Desktop, ChatGPT Desktop, and others). It also ships a built-in headless OpenCode workspace that administrators can enable, giving users an AI environment inside Portainer without adopting an external AI client. Both paths run the same governed loop underneath.
The workspace approach also solves data sovereignty for organizations that would rather not run their AI operations traffic through an external SaaS AI provider. The workspace runs against a customer-supplied AI endpoint (OpenAI-compatible or Claude-compatible), so the model provider is your choice and the traffic is on your account.
The full walkthrough
A ten-minute demo covering the workspace, the proposal workflow, the security-hardening example, the prompt library, and the administration view CISOs care about.
Portainer-Command, answered directly
What is an MCP gateway?
An MCP gateway (or agentic control plane) sits between AI agents and the systems they act on. Portainer-Command is an MCP gateway specifically for Kubernetes: AI agents connect over MCP, the gateway issues expiring read-only sessions with a rationale, brokers change proposals as Git pull requests, and lets Portainer reconcile approved changes. The agent never touches the cluster API.
Is Portainer-Command an MCP server for Kubernetes?
Yes. Portainer-Command exposes an MCP server that any MCP-compatible client (Claude Desktop, ChatGPT Desktop, Cursor, VS Code, custom agents) can connect to. Unlike a bare MCP server that exposes kubectl-style tools, Portainer-Command is also a governance layer: sessions carry identity and TTL, writes go through Git, and every action is audited.
Does Portainer-Command give AI agents direct access to Kubernetes?
No. AI agents never receive kubeconfig, service account tokens, or any direct write path to a cluster. They can request expiring read-only sessions with a stated rationale, and they can propose changes as pull requests to your Git repository. Portainer Business applies approved changes via GitOps reconciliation.
What happens when a proposal is approved?
The pull request merges to your sanctioned repo, and Portainer Business reconciles the change into the target cluster as a GitOps stack. The change carries the identity of the human who approved it, and everything is auditable via the Git history and the Portainer session log.
Can AI agents approve their own changes?
No. This is a structural rule, not a policy toggle. Every proposal is a pull request that requires a human approval before Portainer Business will reconcile it. Automated tests can also execute on the pull request, so approval and validation both gate the merge.
How does emergency halt work?
Emergency halt is a single click, either at the environment level or fleet-wide. It revokes every live session, kicks all connected AI agents off the environment, and blocks new sessions from being created until an administrator re-enables access. Sessions that were mid-flight terminate; nothing continues to execute.
How long do read-only sessions last?
Sessions are short-lived by design and require a stated rationale to open. They expire on task completion or at TTL, whichever comes first. Administrators see every open session and can revoke individually or in bulk.
Can we allow AI in dev clusters but block it from production?
Yes. Every environment has its own controls for whether agents may read live state, read GitOps state, or propose changes, and namespaces can be restricted within an environment. The most common configuration is unrestricted read in dev, propose-only in staging, blocked entirely in production.
Whose identity does a proposal carry?
Every proposal is opened under the identity of the human user who initiated the task. Pull requests show that user as the proposer in Git, and the Portainer session log records the agent, the user, and the session together.
Does Portainer-Command work with any AI agent?
Yes. It exposes an MCP server that any MCP-compatible client can connect to (Claude Desktop, ChatGPT Desktop, and others). Portainer-Command also ships a built-in headless OpenCode workspace for organizations that want to give users an AI environment without adopting an external AI client.
What is the built-in workspace?
A headless OpenCode container hosted inside a namespace administrators designate. Users can spin one up on demand, chat with it, and it runs the same governed loop against Kubernetes as any external MCP client. Model selection is set by the administrator against a customer-supplied API key, either OpenAI-compatible or Claude-compatible.
Can we cap what AI agents cost?
Yes. Portainer-Command tracks token spend per workspace and rolls it up per user and per organization. Administrators see cost trends across the fleet over the last 30 days and can issue a per-user emergency halt if a workspace is misbehaving. Workspace image and model configuration is controlled by administrators, not by end users.
Where does the audit trail live?
Two places, both yours. Git holds the full history of proposals and merges. Portainer-Command holds the session log: which agent, which user, which rationale, which environment, which duration. Because every action passes through this path, the audit trail is complete rather than reconstructed.
Does customer data leave our environment?
Portainer-Command itself runs inside your Kubernetes platform. When a workspace calls a model, it calls the AI provider endpoint you configured, using your API key, on your account. If your compliance posture requires model traffic to stay inside a boundary, use a customer-hosted OpenAI-compatible or Claude-compatible endpoint. The choice is yours.
See it govern AI agents on a live cluster
We will run a live demo of Portainer-Command against a governed Kubernetes environment, walk through the CISO administration view, and show what standing it up in yours looks like.
- Live demo on a real Kubernetes environment
- No obligation · a specialist will reach out to schedule
- Built on Portainer Business, trusted by 500,000+ users