Skyflo
Self-Hosted AI Agent for Kubernetes & DevOps. Approval-Gated. Deterministic Control Loop.
Last verified:
What is Skyflo?
Skyflo is a self-hosted AI operations agent for Kubernetes and CI/CD systems that runs inside your cluster and converts natural language into typed, auditable infrastructure operations. It uses a deterministic control loop (Plan → Approve → Execute → Verify) to ensure every mutating operation requires explicit human approval before execution, with post-action verification to confirm outcomes match the original intent.
Key features include 64 infrastructure tools across Kubernetes (22 tools), Helm (16 tools), Argo Rollouts (13 tools), and Jenkins (13 tools), all following the Model Context Protocol with schema-validated inputs and sandboxed execution. Skyflo provides unified cluster context by correlating logs, events, resource state, and configuration in one place, enabling faster incident diagnosis without switching between multiple dashboards. The agent streams live reasoning, tool progress, and results in real-time via SSE, and supports multiple LLM providers including OpenAI, Anthropic, Gemini, Groq, and self-hosted models.
Skyflo is designed for DevOps teams, SREs, and cloud native engineers managing production Kubernetes clusters who need safe, auditable infrastructure operations. It is fully open source under Apache 2.0 license with no telemetry or vendor lock-in. The Team plan adds collaboration features like Slack/Teams integration, SCM integration for Git-backed audit trails, AI alerting agent for anomaly correlation, RBAC, audit trails, and SSO.
Skyflo pricing
Pricing model: Freemium
Skyflo offers two self-hosted, approval-gated plans. The Open Source plan is free forever under Apache 2.0 license with no feature gates or usage limits. It includes Kubernetes operations (discovery, logs, exec, apply, diff), Helm (install, upgrade, rollback with dry-run), Argo Rollouts (canary, blue-green, promote), Jenkins (builds, logs, secure auth), the Plan→Approve→Execute→Verify control loop, approval gate on every mutating tool call, self-hosted in-cluster deployment, multi-LLM support (OpenAI, Anthropic, Gemini, Groq, local), typed tool execution via MCP, and community support via Discord and GitHub Issues. The Team plan has custom pricing and includes everything in Open Source plus collaboration features (Slack/Microsoft Teams chat integration, GitHub/GitLab/Bitbucket SCM integration), AI Alerting Agent for anomaly correlation and noise reduction, governance features (RBAC and team management, immutable audit trails, SSO with SAML 2.0 and OIDC), and priority support with SLAs, custom MCP integrations, and dedicated onboarding. Note: chat integration, SCM integration, AI alerting agent, and SSO are marked as design partner roadmap items.
Skyflo pros
- Self-hosted inside your Kubernetes cluster with no external telemetry
- Approval-gated by design - every mutating operation requires explicit human approval
- Open source under Apache 2.0 license with full source transparency
- 64 typed, auditable infrastructure tools across Kubernetes, Helm, Argo Rollouts, and Jenkins
- Bring your own LLM - supports OpenAI, Anthropic, Gemini, Groq, and self-hosted models
- Deterministic control loop with Plan → Approve → Execute → Verify phases
- Unified cluster context correlating logs, events, resource state, and configuration
- Post-action verification flags state drift and suggests remediation
- No vendor lock-in - switch LLM providers without changing workflows
- Live agent reasoning streamed in real-time via SSE
- Graph-based LangGraph-powered workflow engine that is deterministic and replayable
- Schema-validated tool inputs via Model Context Protocol with sandboxed execution
- Free forever open source tier with no feature gates on safety features
- Complete kubectl integration with discovery, logs, exec, apply, diff, scale, rollout
- Helm support with install, upgrade, rollback, dry-run preview capabilities
Skyflo cons
- Self-hosted deployment requires Kubernetes cluster access and setup expertise
- Team collaboration features (Slack, Teams, SCM integration) are on design partner roadmap
- Cloud provider support limited to Kubernetes - AWS, GCP, Azure, GitHub Actions, GitLab CI on roadmap
- Requires bringing and configuring your own LLM API key
- Team plan pricing is custom/bespoke rather than transparent public pricing
- Primarily focused on Kubernetes ecosystems - less suitable for non-k8s infrastructure
- New project with only 82 GitHub stars and 2 contributors as of May 2025
- SSO integration marked as design partner roadmap rather than generally available
Frequently asked questions about Skyflo
What is Skyflo?
Skyflo is a self-hosted AI operations agent for Kubernetes and CI/CD that runs inside your cluster and converts natural language into typed, auditable infrastructure operations. It follows a deterministic control loop (Plan → Approve → Execute → Verify) where the agent plans actions based on your intent, requires explicit human approval for every mutating operation, executes typed tools via MCP, and verifies outcomes match the original intent. It is not a CLI wrapper, not autonomous, and not a GitOps control plane - it is an in-cluster execution runtime with approval-gated mutations by design.
Is Skyflo open source?
Yes, Skyflo is 100% open source under the Apache 2.0 license. The full source code is available on GitHub, including the agent, the control loop, and the safety model. Every tool call, decision path, and safety check is inspectable. The open source tier is free forever with no feature gates on safety features and no usage limits. Safety features like approval gates ship with the open source version, not as premium features.
How does the approval gate work?
The approval gate is enforced at the engine runtime level, not as a configurable UI toggle. Every mutating tool call pauses for explicit human approval before execution. Read operations (like discovery, logs, status checks) flow freely without requiring approval. The agent plans the action, presents it for approval, and only executes after you approve. This enforcement is built into the engine itself and cannot be disabled through configuration, ensuring safety is always present.
Which LLM providers does Skyflo support?
Skyflo supports multiple LLM providers through a bring-your-own-LLM model with no vendor lock-in. Supported providers include OpenAI, Anthropic, Gemini, Groq, Mistral, and self-hosted models via Ollama. You configure your preferred LLM and API key during installation, and all LLM calls go only to the provider you configure. You can switch providers without changing your workflows.
What infrastructure tools does Skyflo support?
Skyflo supports 64 typed, auditable infrastructure tools across four categories: Kubernetes (22 tools) for discovery, logs, exec, apply, diff, scale, and rollout; Helm (16 tools) for search, install, upgrade, rollback, list, and status; Argo Rollouts (13 tools) for pause, resume, promote, abort, and retry with canary and blue-green deployments; and Jenkins (13 tools) for jobs, builds, logs, SCM, and identity. Every tool follows the Model Context Protocol with typed inputs and sandboxed execution. AWS, GCP, Azure, GitHub Actions, and GitLab CI support are on the roadmap.
Does Skyflo send telemetry to Skyflo?
No, Skyflo has no telemetry or phone-home functionality. It is self-hosted inside your Kubernetes cluster, and all LLM calls go only to the provider you configure. Your data stays yours. This is true for both the Open Source and Team plans - there is no Skyflo telemetry in either tier.
What is the difference between Open Source and Team plans?
Both plans are self-hosted and approval-gated with the same core control loop and safety model. The Open Source plan is free forever and includes the AI agent with Kubernetes, Helm, Argo Rollouts, and Jenkins operations. The Team plan adds collaboration and governance features: chat integration (Slack, Microsoft Teams), SCM integration (GitHub, GitLab, Bitbucket) for Git-backed audit trails, AI Alerting Agent for anomaly correlation and noise reduction, RBAC and team management, immutable audit trails, SSO (SAML 2.0, OIDC), priority support with SLAs, custom MCP integrations, and dedicated onboarding. Team pricing is custom/bespoke.
How do I install Skyflo?
Skyflo can be installed in under 5 minutes using the interactive installer: curl -fsSL https://skyflo.ai/install.sh | bash. Alternatively, you can use Helm by adding the repo (helm repo add skyflo https://charts.skyflo.ai), creating a values.yaml file with your LLM configuration (llmModel and API key), and running helm install skyflo skyflo/skyflo -n skyflo --create-namespace -f values.yaml. Installation requires a Kubernetes cluster and your own LLM API key configuration.
How does Skyflo handle incident diagnosis?
Skyflo correlates logs, events, resource state, and configuration in a single pass to surface root causes instantly without context-switching across multiple dashboards. For example, it can diagnose a CrashLoopBackOff by analyzing all relevant signals together. The agent streams its reasoning, tool progress, and results in real-time via SSE, showing exactly how it reached the diagnosis. Post-action verification confirms the fix worked and flags any state drift with suggested remediation.
Can I contribute to Skyflo?
Yes, Skyflo welcomes contributions and is built in the open. The project has a Contributing Guide and Code of Conduct. Many issues are labeled 'good first issue' and represent real, impactful problems. Contributors can shape the future of cloud-native automation through pull requests. The community is active on Discord, Twitter/X, YouTube, and GitHub Discussions. You can also star the repository on GitHub and suggest or contribute new MCP tools if something is missing.