Describe the agent. Ship it under your controls.
Build from tools you already trust — amass, nuclei, Trivy, kubectl — or write your own with the SDK. Every agent is a source-controlled artifact owned by a named human, with a grant for each tool it can touch and a record of everything it did.
EXECUTION PLANE ╎ CONTROL PLANE · api.zeroroot.ai
┌──────────────────┐ ╎ ┌──────────────────────┐
│ ● agent binary │ ╎ │ ● gibson LIVE │
│ runs on: │ ╎ │ ● graph store READY │
│ laptop · ci · │ ═════╪═══►│ ● redis READY │
│ vps · k8s │ gRPC ╎ │ ● traces READY │
└────────┬─────────┘ ╎ │ ◢ setec ARMED │
│ ╎ └──────────────────────┘
▼ ╎
● byok keys ─▶ anthropic · openai · gemini · ollama
──────────────────────────────────────────────────────
● AGENTS ACTIVE │ ● SANDBOX READY │ ● GRAPH SYNCED$ git clone https://github.com/zeroroot-ai/adk$ cd adk/gibson && go install ./cmd/gibson$ gibson init --gibson-url https://api.zeroroot.ai$ gibson login✔ device-flow sign-in · short-lived session stored$ gibson component init cve-triage --kind agent$ gibson agent enroll --name cve-triage --kind agent✔ one-time bootstrap token minted$ gibson component register --token …✔ capability-grant verified · runtime credential issued$ gibson mission submit cve-response.cue→ mission queued · 2 nodes running↳ untrusted component dispatched to setec microVM✔ graph: 9 services affected · patch PR opened$ // what you build with
Three shapes, composed by a mission
An agent is not one thing. You compose it, and everything it discovers lands in a knowledge graph the next agent starts from.
agent
Model-driven service. Reasons, plans, delegates to tools.
sdk.NewAgenttool
Stateless executor. Proto in, proto out.
serve.Toolplugin
Stateful integration with declared methods and a lifecycle.
plugin.Serve// reuse
Start from parts that exist: gibson-executor is one microVM image carrying parsers for common security and ops command-line tools, and the opencode plugins put a coding agent under Gibson's controls.
// or build
Or write your own against the Go SDK. TypeScript and Python SDKs are public too.
// mission control
Mission control for every agent you run
$ cat why-agents-stall.md
Platform engineers, SREs, and security teams aren't blocking agents because they don't believe in them. They're protecting their organizations from real risk.
Untrusted code in production
AI-generated code running in your pipelines is a breach waiting to happen without real isolation.
A component that declares it handles untrusted input runs in a Firecracker microVM, or the call is refused. There is no in-process fallback.
Compliance can't audit a black box
Regulated environments can't run what they can't replay. “The agent did something” doesn't pass an audit.
Every model call is recorded with its full transcript and token counts, inside your tenant, and every mission replays step by step.
Integration drags on for months
Bolting AI onto existing infrastructure means custom glue that still doesn't fit your patterns.
Standard Kubernetes. Agents run where you already work: laptop, CI, VPS, k8s.
Engineers see a threat, not a tool
Adoption stalls when the team that has to champion automation feels automated away.
Your engineers build the agents, own the workflows, and hold the keys. Amplified, not replaced.
$ cat what-you-get.md
ADK
Agent, Tool, and Plugin contracts. A single Harness wires LLMs, memory, tools, and the knowledge graph. Go today, with Rust and Python in the works.
gibson CLI
Scaffolds projects, installs agents and tools, launches missions, inspects graph state. The client you script against api.zeroroot.ai.
DAG missions
A mission is a CUE-typed DAG of agent + tool nodes wired by edges and parameterized by target. CUE catches misconfigurations at submit time (wrong agent name, missing field, bad enum) before the orchestrator ever runs the Observe → Think → Act → Recall → Reflect loop. Pausable, resumable, checkpointed.
Knowledge graph
Every discovery (hosts, ports, findings, techniques, attack chains) lands in the platform's knowledge graph under a YAML-driven taxonomy with CEL-validated schemas. What one agent learns, the next one starts from.
RBAC
Agents, users, teams, and components each have scoped permissions. Your PR-review bot can't touch production, your red-team agent can't touch ServiceNow. Every action audited.
Observability
Gibson Traces captures every prompt, response, tool call, and graph write. Replay any mission step-by-step to see why the agent chose Action X, what each step cost, and where the reasoning went sideways. Tagged per mission, agent, team.
$ cat what-you-run-on.md
Every agent is built by your team (platform engineers, devsecops, red teamers, IR) for the workflows they already own. That's the force multiplier. Agents run where you work (laptop, CI, VPS, k8s) and dial out to api.zeroroot.ai for orchestration, shared memory, and the knowledge graph. Your team decides what crosses the wire and what stays on the host. BYOK for LLM keys. A component that declares it handles untrusted input runs inside Setec microVMs, or the call is refused. Hardware isolation, not containers.
// Respond to a newly published advisory.
// Started by your CI, webhook, or scheduler —
// Gibson does not own the clock.
mission: {
name: "cve-response"
description: "Find services affected by an advisory and open the patch PR."
version: "1.0.0"
constraints: {
max_cost: 25.0 // USD, hard ceiling
max_duration: "45m"
blocked_domains: ["prod.internal"]
}
nodes: {
advisory: {
id: "advisory"
type: "NODE_TYPE_TOOL"
tool_config: {tool_name: "advisory-feed"}
}
affected: {
id: "affected"
type: "NODE_TYPE_AGENT"
agent_config: {agent_name: "graph-matcher"}
}
patch: {
id: "patch"
type: "NODE_TYPE_AGENT"
agent_config: {agent_name: "coding-agent"}
}
}
edges: [
{from: "advisory", to: "affected"},
{from: "affected", to: "patch"},
]
entry_points: ["advisory"]
exit_points: ["patch"]
}$ cat production.md
Run on the hosted control plane at api.zeroroot.ai, or deploy the entire platform into your own Kubernetes cluster with a single Helm install, including the enclave your organization has already accredited. Your authorization boundary stays yours; the platform deploys inside it. Either way, the controls regulated environments demand are the defaults, not add-ons:
short-lived credentials: agents enroll once and act on short-lived session tokens, with no long-lived keys on disk
tenant isolation: your graph, secrets, and traces are scoped to your tenant, never pooled
full audit trail: every action attributable, every mission replayable
open-source core: the ADK, setec sandbox, tool runner, and SDK are public, so you can inspect it, audit it, trust it
Every account starts with a 2-week free trial (card required). For production tiers (teams, SLAs, audit retention), see pricing.