Burrow
GitHub Get started
Open source, self hosted deployment for the cluster you own

Move fast with AI.
Don’t break things.

Point your AI coding agent at your own Kubernetes cluster. Burrow lets it deploy and operate real apps safely, behind guardrails you control.

Get started See the guardrails
Open source No lock in No per request bill
Burrow, a groundhog in a navy hoodie, on watch
all guardrails active
prod protected
Talk to your agent

Say what you want. In plain english.

Your agent speaks Burrow directly. You describe the outcome; Burrow gives it the safe path to get there, and asks before anything risky runs in prod.

›deploy my app to prod
›roll back the last release
›show me any 500 errors and figure out what happened
›why isn't my site reachable at example.com?
When agents go wrong

"You're absolutely right.
I should not have deleted prod."

AI agents are fast, confident, and occasionally catastrophic. When one deletes your production database, it will apologize beautifully. Burrow stops it before the apology is needed.

agent, unsupervised prod deleted
›delete staging data
✓ done. dropped database "prod-main"
›you just deleted prod data?!?!
⏺You're absolutely right. I should not have deleted prod. Let me look for a backup.
✗ no backups found
⏺You should really have backups, let me enable those for you.
agent, on burrow prod protected
›delete staging data
✗ burrow guard: delete.prod.db denied
nothing ran. prod-main untouched.
⏺I didn't mean to call delete on prod.
Thankfully it was denied so nothing has been lost.
Guardrails you control

The agent moves fast. The rails keep it safe.

You set the policy once. The risky actions (deleting an app, rolling back, exposing it publicly, DNS and addon changes) are checked against it before they run: allowed, held for your approval, or denied. Your prod app can't be deleted on a whim, and your last good release always stays warm.

Held for your approval
Set an action to confirm and the agent pauses there. It proposes; you approve before it runs.
Policy per environment
App guardrails are set per environment. Lock prod down while staging stays permissive.
Roll back in one command
Your last good release stays warm. Roll back to it anytime, with zero downtime.
burrow guard
$burrow guard set --env prod app.delete deny
# guardrail policy: prod
✓ prod · app.delete → deny
$burrow guard set --env prod app.rollback confirm
✓ prod · app.rollback → confirm (holds for your approval)
$burrow guard set dns.delete deny
✓ dns.delete → deny (applies cluster wide)
$burrow app rollback api-gateway --env prod
# agent proposes a rollback
⏸ held by guardrail: prod app.rollback needs your approval
✓ approved by you · rolled back to rev 41 · 3/3 healthy
$burrow app delete api-gateway --env prod
# agent attempts a destructive action
✗ denied by guardrail: prod app.delete is set to deny
nothing changed · api-gateway still running
Addons

Give your app a backend in one command.

The pieces every real app needs, running on your own cluster. Available today.

Postgres available
Attach it to an app and Burrow wires DATABASE_URL in for you, with backups. burrow addon attach postgres api.
Logs available
Searchable logs across every service. The agent can read them to debug on its own.
Metrics available
Request rates, latency, and errors, scraped from your app with no extra config.
Cache available
A Redis compatible cache for sessions and hot data, one command to attach.

coming soon Autoscaling and per service resource limits are in the works. We ship them when they're safe by default.

Host it yourself like it's a PaaS.
Keep control, no lock in.

Install Burrow on the Kubernetes you already run. Point your agent at it. You keep control of every deploy.

install
$brew install burrow-cloud/tap/burrow
$burrow install my-cluster
✓ installed on your cluster · you stay in control
$burrow agent claude install
✓ agent connected · now just talk to it
Read the quickstart Star on GitHub