Agent
Ship your code, on autopilot. An open source agent that lives on your machines 24/7 and keeps your apps running. 🦀
Last verified:
What is Agent?
Stakpak is an open-source DevOps agent written in Rust that lives on your machines 24/7, keeping your applications running and only alerting when human intervention is needed. It provides all the benefits of a Platform-as-a-Service without vendor lock-in, running entirely on your infrastructure with mutual TLS encryption. The agent automates production operations tasks like health check failures, idle resource detection, TLS certificate renewal, and secret expiration before they cause issues.
Key features include an interactive TUI for full terminal control, autonomous background operation that monitors schedules and channels, automatic infrastructure-as-code generation, dynamic secret redaction for 210+ secret types, and Warden network sandbox guardrails that block unsafe operations. It integrates with Slack, Telegram, and Discord for notifications, supports local session audit logs, and allows teams to encode runbooks and SOPs as markdown-based rulebooks. The agent analyzes your existing infrastructure, learns from your environment, and adapts to internal practices for contextually relevant automation.
Stakpak is designed for operations engineers, SREs, DevOps-focused developers, freelancers, indie developers, senior engineers, consultants, and platform teams who need safe production automation. It works with Terraform, Kubernetes, Docker, AWS, GCP, Azure, and CI/CD workflows. The tool is particularly valuable for teams tired of overnight incidents, wanting to recover cloud costs automatically, or needing to enforce security policies without giving LLMs direct production access.
Agent pricing
Pricing model: Freemium
Stakpak offers 5 tiers with monthly billing. Open Source plan is 100% free forever with Apache 2.0 license, bring-your-own-keys, local model running, curated agent skills, Warden sandbox, 210+ secret redaction, Slack/Telegram/Discord integration, and local SQLite audit logs. Hacker plan is $15/mo for 3 apps on autopilot with $10 credits/mo and 10% top-up fee, includes LLM Gateway for Claude/GPT/Gemini, private skills, watch triggers, and centralized memory. Builder plan is $45/mo for 10 apps with $35 credits/mo and 7% top-up fee. Team plan is $450/mo for 50 apps with $350 shared credits, unlimited users, shared team memory, admin dashboard, SSO, and priority support. Enterprise plan is custom-priced with unlimited apps, self-hosting support, custom Warden policies, and dedicated onboarding.
Agent pros
- 100% open source under Apache 2.0 license
- Written in Rust for portability, reliability, and performance
- Runs entirely on your machines with mTLS encryption
- No data leaves your environment - full privacy control
- Auto-redacts 210+ secret types before LLM sees them
- Warden guardrails block destructive operations securely
- Interactive TUI with full terminal control
- Autonomous 24/7 background operation
- Generates high-quality infrastructure-as-code automatically
- Automatic TLS certificate renewal with zero downtime
- Detects and reports idle resources to recover cloud costs
- Slack, Telegram, and Discord integration per-agent
- Local session audit logs with full context tracing
- Rollback instantly with backups before any modification
- Bring Your Own Keys for all AI providers
- Run models locally for complete privacy
- Rulebooks let teams encode SOPs as markdown playbooks
- Persistent memory learns from interactions across sessions
- Works with Terraform, Kubernetes, Docker, AWS, GCP, Azure
- Single long-running process combines scheduling and messaging
Agent cons
- Requires API key configuration for full remote capabilities
- Onboarding guardrails and rulebooks has operational overhead
- Teams should validate workflows in staging before production
- Windows support less mature than macOS/Linux
- Brave browser users may encounter redirect issues during API key setup
- Free tier limited to bring-your-own-keys only
- Team plan at $450/mo may be expensive for small teams
- credit top-up fees add extra cost on paid plans
Frequently asked questions about Agent
What is Stakpak?
Stakpak is an open-source DevOps agent written in Rust that helps you secure, deploy, and maintain production-ready infrastructure. It lives on your machines 24/7, keeps your apps running on autopilot, and only pings when it needs a human. It provides all the upside of a PaaS with none of the lock-in, running entirely on your infrastructure with mTLS encryption.
Is Stakpak free to use?
Yes, Stakpak has a free Open Source plan that is 100% free forever with no credit card required. It includes 100% open source code (Apache 2.0), bring-your-own-keys for all providers, ability to run models locally, curated agent skills, Warden network sandbox, auto-redaction of 210+ secret types, Slack/Telegram/Discord integration, and local session audit logs.
How do I install Stakpak?
The easiest installation is via one-line script: curl -sSL https://stakpak.dev/install.sh | sh. Alternatively, use Homebrew (brew tap stakpak/stakpak && brew install stakpak), download binaries from GitHub releases, or run via Docker (docker pull ghcr.io/stakpak/agent:latest). After installation, run stakpak init to discover your stack and generate APPS.md, then stakpak up to start autopilot.
How does Stakpak handle secrets and API keys?
Stakpak auto-redacts 210+ secret types before the LLM sees them, using dynamic secret substitution. Real values are restored only at execution time, so your API keys and database passwords never reach any model provider. Secrets are swapped with placeholders, and the agent uses them securely through a transparent proxy with Cedar policies.
What AI models does Stakpak support?
Stakpak supports Claude, GPT, Gemini, Mistral, and more through its unified LLM Gateway with one wallet for simple billing. You can also bring your own API keys for any provider or run models locally for complete privacy. The gateway provides zero token markup regardless of whether you use their gateway or your own keys.
What is Warden guardrails?
Warden is a deterministic guardrail system and network sandbox that enforces policies to validate and block unsafe or unauthorized operations. Even if you configure permissions incorrectly, the agent cannot break anything. It prevents destructive actions 100% of the time, making Stakpak safe for production use.
Can I use Stakpak with my own AI API keys?
Yes, Stakpak supports Bring Your Own Keys (BYOK) for all AI providers including Anthropic, OpenAI, and Gemini. You can configure your own API keys in ~/.stakpak/config.toml with profiles for different providers, or use a local OpenAI-compatible endpoint for self-hosted models. Full platform features work either way.
How does Stakpak handle production incidents?
Stakpak automatically detects and resolves incidents like health check failures, finds root causes (e.g., 312 idle database connections), takes corrective actions (restarts app), and reports results via Slack summary. It handles TLS certificate expiration with auto-renewal, finds idle RDS instances and orphaned EBS volumes for cost recovery, all while you sleep.
What cloud providers and tools does Stakpak integrate with?
Stakpak integrates with Terraform, Kubernetes, Docker, AWS, GCP, Azure, and CI/CD workflows. It indexes Terraform files, Kubernetes manifests, Dockerfiles, and GitHub Actions for semantic search. It can run in your terminal, CI/CD pipelines, and in your cloud, supporting stateful apps on multiple cloud providers.
How do I rollback changes made by Stakpak?
Every action, file edit, and command is logged with full context. Changes are backed up before modification, both locally and over SSH. You can replay any session, trace any change, and roll back instantly. Agent Sessions provide a full audit trail so you understand exactly what was done and why.