Loading page
“The agent decides what to do. Nanokit guarantees that what the agent decides gets done — deterministically, securely, and reproducibly.”
An LLM is great at deciding what should exist. It should never be trusted to hand-craft the plumbing that makes it real.
What an agent does NOT do with Nanokit
The agent's entire write surface is a single YAML file. Declare intent; the reconciler turns it into real infrastructure on any provider.
# nanokit.yml — the contract the agent editsproject: acme-shopservices:api:image: ./services/apidomain: api.acme.devenv:DATABASE_URL: db://postgres/mainSTRIPE_KEY: vault://secret/stripe/keyweb:image: ./services/webdomain: acme.devdatabases:postgres/main:engine: postgres:16
$ nkapp deploy -e production▸ reconciling acme-shop → aws/frankfurt✓ services.api created container · healthy✓ services.web untouched drift-hash match✓ databases.postgres in sync schema up to date✓ domains routed api.acme.dev · TLS issued✓ secrets resolved vault:// ×2 injected✔ converged in 38s — change-proportional deploy
Instead of parsing 14 config files and grepping logs, an agent reads one structured model of the environment: services, databases, secrets, domains, status.
1{2 "environment": "production",3 "status": "healthy",4 "revision": "r-142",5 "driftHash": "9f2c8a41e",6 "services": {7 "api": { "state": "running", "domain": "api.acme.dev" },8 "web": { "state": "running", "domain": "acme.dev" }9 },10 "databases": {11 "postgres/main": { "engine": "postgres:16", "branch": "main" }12 },13 "secrets": ["DATABASE_URL", "STRIPE_KEY"],14 "domains": ["acme.dev", "api.acme.dev"]15}
What an agent can ask the control plane to do — shipped capabilities today via CLI and reconcile, agent-facing tool APIs on the roadmap.
nanokit.yml defines services, databases, env, secrets and domains for every environment × deploy target.
Deterministic converge of declared state onto Docker, AWS, Azure, GCP or DigitalOcean — change-proportional, drift-hash gated.
Return an environment to its previous stable state after a failed or unwanted deploy.
Structured, machine-readable model of running services, databases, secrets and domains — queryable today via CLI & bridge.
vault:// references resolved at deploy time; values never enter the agent's context.
Automatic recovery from environment drift — e.g. cert-drift heal — without any agent involvement.
Explicit primitive to spin up a new environment against a deploy target, as a first-class tool call.
Expose the primitives above as typed tools any agent framework can call natively.
Agent-facing guardrails: budgets, allowed targets, approval gates before destructive operations.
Intent flows down. State flows up. Each layer only speaks the language of the layer next to it.
Owns goals and reviews diffs. Approves what matters, ignores the plumbing.
Decides what to do: edits the contract, queries state, requests deploys and rollbacks.
The control plane. Guarantees deterministic, secure, reproducible execution — or a clean rollback.
Docker, AWS, Azure, GCP, DigitalOcean. Nanokit speaks them all so the agent doesn't have to.
intent ↓ · ↑ state
Install Nanokit, declare your stack once, and let the agent drive while Nanokit guarantees the outcome.