The harness for
platform engineering
Batteries included, guardrails on. faros is the open-source, multi-tenant control plane your team — and your AI agents — operate through one governed surface: infrastructure templates, git repos, edge clusters, hosted agents, every capability exposed as MCP tools with tenancy built in.
$ curl -fsSL https://downloads.faros.sh/install.sh | sh$ kedge login
✓ authenticated · workspace ready — your own isolated tenant
$ kedge mcp url --mcpserver-name default
https://hub/…/mcp · every provider's tools · Claude-ready
claude> deploy postgres for billing on the home-lab cluster
→ mcp: infrastructure__provision template=postgres target=home-lab
✓ provisioned · gateway route wired · OIDC on
claude> now delete namespace kube-system
✗ denied — outside workspace scope · request loggedGuardrails
Give AI agents a platform, not root.
Agents operating infrastructure today get one of two things: nothing, or a god-mode kubeconfig. faros gives them a third option — a governed platform where the guardrails are architecture, not policy documents.
Isolated by construction
Every team is its own workspace — a full logical cluster with its own APIs, RBAC, and quota. An agent physically cannot see what tenancy doesn't grant. Isolation isn't a setting; it's the substrate.
Everything is an API resource
Provisioning, repos, agents, edges — all declarative resources, not imperative side-doors. Every action an agent takes is a recorded object you can audit, diff, and revert. No mystery mutations.
MCP tools are derived, not bolted on
One MCP endpoint per tenant, and every tool inherits that workspace's permissions automatically. No god-mode gateway token, no separate tool catalog to govern — the platform and the tools are the same authority.
Batteries included
Every capability is a provider.
A provider is a pluggable building block: its own pod, its own release cycle, enabled per workspace — UI, API, and MCP tools included. These ship in the box:
Edges
Clusters, servers, and the apps beside them — deploy workloads across the fleet, control Home Assistant and friends via discovered services.
Application Templates
Provision databases, caches, workers, and full apps from a curated template catalog — Gateway-API exposure and OIDC included.
AI Agents
Host persistent AI agents with schedules, triggers, memory, budgets, and Telegram/Slack channels — declared as platform resources, using every other provider's tools.
Code
Git repositories, deploy keys, collaborators, and packages as declarative resources — GitHub first, more hosts pluggable.
Kuery
Fleet-wide object search and impact analysis — "who consumes this Secret?" — one query instead of N kubectl round-trips.
Build your own
This is the harness part. A provider is a standalone pod — your API, controllers, UI, and MCP tools, plugged into the hub's tenancy, proxies, and guardrails. The docs walk you through it.
Connectivity
Agents dial out. You log in.
The hub is the only thing with a public endpoint. Clusters and servers behind NAT, firewalls, or a home router dial out and become part of your platform — no VPNs, no open ports, no kubeconfig juggling.
Agents dial out — NAT and firewalls are not a problem.
Native access to every cluster and server through the hub.
Orgs and workspaces, each an isolated kcp logical cluster.
One endpoint — Claude and any MCP client drive it all.
Time to platform
An evening. Not a quarter.
Today's platform market makes you choose: rent something closed in minutes, or spend months assembling something you own. faros refuses the trade.
Assemble-it-yourself portals
Scaffold the app, wire the database, pick the plugins, staff the team. Months to first value, a dedicated crew to keep it alive — before a single guardrail exists for AI.
Per-seat platform SaaS
Live in minutes — but closed source, priced per seat or per month in the thousands, and your platform's control plane belongs to someone else.
faros
Hosted hub: two commands, free. Self-hosted: two Helm charts on any Kubernetes cluster, running by tonight. Open source top to bottom — the whole stack is yours either way.
Quickstart
Four commands to a live platform.
Install the CLI
Download CLI binary.
$ curl -fsSL https://downloads.faros.sh/install.sh | shLog in
Authenticate to the hosted hub — your isolated workspace is created on the spot.
$ kedge loginRegister an edge
Get a one-time join command. Run it on the cluster or host.
$ kedge edge create my-cluster
$ kedge edge join-command my-clusterHand it to your agents
Kubeconfig for kubectl, SSH for shells — and one MCP URL that gives Claude every provider's tools, scoped to your workspace.
$ kedge kubeconfig edge my-cluster > kc.yaml
$ kedge mcp url --mcpserver-name defaultFree forever. Open source by design.
faros is fully open source — hub, portal, and every provider. Self-host it anywhere: VPS, home server, behind a Cloudflare tunnel. No paywalled features, no usage limits, and no per-seat pricing — platforms shouldn't tax headcount. Unlimited edges. Fork it, audit it, ship it — the whole stack is yours.