╔══════════════════════════════════════════════════════════════╗
║ ║
║ ███████╗███████╗██████╗ ██████╗ ██████╗ ██████╗ ██████╗████████╗ ║
║ ╚══███╔╝██╔════╝██╔══██╗██╔═══██╗██╔══██╗██╔═══██╗██╔═══██╗╚══██╔══╝ ║
║ ███╔╝ █████╗ ██████╔╝██║ ██║██████╔╝██║ ██║██║ ██║ ██║ ║
║ ███╔╝ ██╔══╝ ██╔══██╗██║ ██║██╔══██╗██║ ██║██║ ██║ ██║ ║
║ ███████╗███████╗██║ ██║╚██████╔╝██║ ██║╚██████╔╝╚██████╔╝ ██║ ║
║ ╚══════╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚═╝ ║
║ ║
╚══════════════════════════════════════════════════════════════╝
You write the agent. Gibson gives it an identity and a grant for every tool it can touch. It gives it a microVM for untrusted work and a replayable record of what it did.
An agent takes an afternoon to write. A fleet of agents that a security review accepts is the hard part. The hard part is the same whether the agent patches CVEs, reconciles config, or triages alerts:
- Which human is answerable for this agent?
- What can it touch, and who can revoke that?
- What happens when someone prompt-injects it, or when it is simply wrong?
- Can you show, afterwards, exactly what it did?
Gibson answers those questions once, in the runtime. Every agent you build inherits the answers.
The deep technical document is docs.zeroroot.ai/docs/security. It has one page per control domain, and each claim names the file, flag, or ADR that proves it. This page is the overview.
- CVE response. An agent reacts to a new advisory, works out which services in the graph are affected, and opens the patch PR.
- Coding agents under control. Run
opencodeinside a microVM, under grants, with everything it did on the record. - Ops automation. Reconcile drift, chase SLO burn, sweep IOCs across audit logs.
- Offensive and defensive security. Recon, triage, and evidence collection. This is one domain among several, not the boundary.
go install github.com/zeroroot-ai/adk/gibson/cmd/gibson@latest
gibson init --gibson-url https://<your-gibson-host>
gibson component init slo-checker --kind tool
cd slo-checker && claudeThe Gibson host is the runtime you or your operator installed from
charts. The hosted endpoint opens at
launch.
The scaffold contains the contract your AI coding agent needs: AGENTS.md, the
proto layout, the graph wiring, and step-by-step recipes. You describe what you
want, and the coding agent writes a correct implementation. Its shell allowlist
is narrow on purpose. The coding agent can build, validate, and register. It
cannot run kubectl apply or helm install, and it cannot write outside the
component directory.
gibson component register --token <bootstrap-token>
gibson component run| Kind | What it is | Built with |
|---|---|---|
| agent | A model-driven gRPC service. It reasons, plans, and delegates to tools | sdk.NewAgent + serve.Agent |
| tool | A stateless proto-in, proto-out executor | serve.Tool |
| plugin | A stateful integration with declared methods and a lifecycle | plugin.Serve |
Every tool response reserves field 100 for a DiscoveryResult. Fill it, and
what the tool found lands in the knowledge graph. There is no query language to
learn and no ingestion pipeline to build.
You do not start from nothing. gibson-executor is one microVM image with
parsers for common security and ops command-line tools. zerocool puts a
coding agent under Gibson's controls. Compose those, or write your own.
Each row links to the page that proves it.
| What Gibson does | |
|---|---|
| Identity | Two planes. In the cluster: SPIFFE mTLS plus JWTs, trust domain zeroroot.ai. Off the cluster: an Ed25519 host key at 0600, then per-call tokens that expire in 55 seconds. The platform holds two static credentials in total, and it publishes that list. |
| Authorization | An OpenFGA model. Agents, tools and plugins are their own principal types, each with owner: [user]. Read, configure and execute are separate grants. A disable at tenant, team or user scope subtracts from the grant, so no vote can override it. |
| Isolation | One fail-closed gate decides: deny, Firecracker microVM, or in process. When a microVM is available, the gate always uses it. Untrusted code has no in-process fallback on hosted infrastructure. If the microVM is gone, the gate refuses the call. |
| Tenancy | One graph database per tenant, in its own namespace. Nodes carry no tenant identifier, because there is nothing to disambiguate. There is no cross-tenant query to get wrong. |
| Runtime | Missions run on a persistent event-sourced loop. Constraints on the mission cap duration, cost, tokens, turns, findings, tools and domains. A person declares control before the run starts. |
| Audit | The platform records every model call with an immutable transcript and token counts, inside your tenant. No third-party trace vendor sits on that path. Every mission replays from its timeline. |
| Supply chain | One versioned OCI umbrella chart pins every first-party image by digest at package time. To roll back, pin the previous version. On-prem and air-gapped installs take the same chart: helm, Argo or Flux, with an air-gap image list to mirror, and no service-mesh assumption. |
Gibson Runtime, Gibson Console and the execution environment (Setec microVMs) run together in one Kubernetes cluster. zeroroot hosts that cluster for you, or you install it in your own Kubernetes. Your own Kubernetes can be in any cloud or on your own metal, up to fully air-gapped.
Your agents do not have to be in that cluster. They run wherever the work is: a laptop, a CI runner, a box on your network, or your own cluster. They check in to the runtime over the network. When you host the runtime, in-cluster agents can also use mTLS.
An agent declares the model slot it needs, and the runtime resolves the slot at run time. There is no provider SDK in your binary and no model lock-in. Your keys stay where your team put them.
What one agent discovers, the next one starts from. A single taxonomy in the SDK defines the graph. One generator compiles that taxonomy into the proto, the Go types, the graph schema, the validators and the query helpers. The whole stack moves in step.
The taxonomy is yours. You do not fork it. You layer a TaxonomyExtension
with your own node types and relationships on top. Every type records where it
came from, so a platform upgrade cannot overwrite your model, and nobody can
mistake your additions for defaults. Model Vendor, Incident, Control, or
Shipment if that is what your organization thinks in.
| Repo | What it is | License |
|---|---|---|
adk |
The gibson CLI and the component scaffold. Scaffold, build, validate, check in, submit missions |
Apache-2.0 |
setec |
Standalone microVM operator. Kata/Firecracker sandboxes — the untrusted-code execution boundary. Useful on its own, with or without Gibson | Apache-2.0 |
charts |
The install chart. One versioned OCI umbrella: CRDs, operators, workloads. The chart and every image it pulls are public | Apache-2.0 |
gibson |
The platform. Daemon, ext-authz, both operators, the SPIFFE/JWKS sidecar, the graph and the brain | Elastic v2 |
dashboard |
The console. Next.js, Server-Action auth, ConnectRPC over Envoy and SPIFFE mTLS | Elastic v2 |
gibson-executor |
The in-guest execution agent. Runs security tooling and the MCP bridge inside a Setec microVM | Elastic v2 |
The ADK is the public entry point. What you write with it is yours, with no obligation back to us. Gibson Runtime and Gibson Console are Elastic License 2.0. Details: licensing.
| Layer | Technology |
|---|---|
| Languages | Go 1.26, TypeScript 5.9, Python |
| Web | Next.js, React, Tailwind, Shadcn UI |
| RPC | gRPC + Protocol Buffers, Buf |
| Identity | SPIFFE/SPIRE in the cluster. Ed25519 capability grants off the cluster. Zitadel OIDC |
| Authorization | OpenFGA (Zanzibar model) |
| Mission definition | CUE |
| Execution environment | Firecracker + Kata, via Setec |
| Knowledge graph | Neo4j |
| Secrets | OpenBao |
| Observability | OpenTelemetry from the platform. The chart ships no monitoring stack — it is a guest on your cluster and hooks into what you already run |
| Deployment | Kubernetes, Helm, one versioned OCI umbrella chart |