agentctl
A Kubernetes control plane that provisions, scales, and secures fleets of conformant AI agents.
- ~1.3m
- millicores per idle agent
- ~5,100/s
- work ops, p99 <100ms
- ~2.2s
- scale 0→5 agents
- 25
- RFCs
agentctl manages agents the way Kubernetes manages workloads: declaratively.
Three CRDs — Agent, AgentFleet, ModelPool — describe what should run;
the operator makes it true, from a kubectl agents plugin on a laptop to
elastic claim fleets that scale from zero on backlog.
Its defining constraint is the Agent Control Contract: an open,
vendor-neutral spec (agent:// resources, agent_ metrics, AGENT_*
environment, a capabilities manifest) that any conformant runtime can
implement. agentd is the reference implementation, but agentctl depends only
on the published contract — never on agentd's code. Manage a fleet without
being locked to a runtime.
Security follows the direct-dial model: agents reach LLM providers and MCP servers directly with portable cryptographic identity, so no proxy sits in the data path and no credential lands on a pod. A lethal-trifecta gate (private data × untrusted content × external comms) is evaluated per-agent, and the numbers are published: measured control-plane overhead, double-grant counts under concurrency, reconcile latency from 1 to 100 agents.