Hyground vs Komodor (2026)

Read only adapters reach Kubernetes, AWS, Azure and Google Cloud, Argo CD and Flux, Loki, OpenSearch, Elasticsearch, Graylog and Splunk logs, Prometheus, InfluxDB and Nagios metrics, Jaeger traces, PostgreSQL, MySQL, Oracle, MongoDB, Redis and ClickHouse, RabbitMQ and Kafka, and documentation in Confluence, Git and Artifactory, plus the customer's own HTTP APIs and in cluster MCP servers.

Scoped writes reach Jira, ServiceNow, PagerDuty, ilert, GitHub, GitLab, Slack, Teams and email, so findings come back as tickets, comments, pull requests and answered threads. Adapters run in the customer's cluster and refuse to start if their principal can write.

Sourcehyground.ai/product/integrations and hyground.ai/product/architectureread 2026-10-25

Agents act on Kubernetes and cloud infrastructure through the platform's tools, MCP gateways and integrations, with ready to run workflows for incident troubleshooting, CI/CD remediation and cost optimization across clusters.

Catalog agents cover AWS, Azure and Google Cloud with read only access, Datadog and Grafana across traces, logs, metrics and profiles, Kubernetes resources and clusters including GPU monitoring, and pull request review. Credentials are supplied once, encrypted in a secure store and handed to each run rather than built into images. Teams expose their own tools to agents through the MCP Gateway.

SourceKomodor, komodor.com and docs.komodor.com agent catalogread 2026-10-05

A multi agent system plans each investigation, sends specialised agents to work logs, metrics and knowledge in parallel, and aggregates what they find into one answer, with a card per sub agent in the Tools panel. Investigations fan out across every cluster or cluster group the customer runs. Teams turn procedures into skills that run the same steps every time, on demand, from a schedule or loaded by the agent when a skill's When to use line matches, and the customer defines those steps.

Sourcehyground.ai/product/architecture and docs.hyground.ai/user-guide/glossary and run-a-skillread 2026-10-25

The Agentic Operations Platform turns skills, scripts or runbooks into production agents and runs agent fleets built on LangChain, Google ADK, the Claude Agent SDK or AgentCore beside Komodor's own, under shared governance, with ready to run workflows. A catalog Orchestrator agent routes work to other agents in the fleet, and agents can also call one another, run as steps in a workflow, or start from chat, channels, modules or a manual run.

The Incident Management module's Production Alert Investigation workflow collapses repeated and related alerts into one incident, sends observability, Kubernetes and cloud investigators to gather evidence in parallel, writes a root cause conclusion with the evidence attached, and proposes a fix that waits for approval before anything is applied.

Once a decision and an approval are behind it, a Remediation Executor agent carries the fix out, acting on the live resource or opening the pull request that fixes the source, and it cannot answer an approval itself. Existing agents can be imported without a rewrite, and the platform page adds Codex to the supported frameworks. Underneath sit a control plane that Komodor operates, an SDK for building agents, and workers that run in Komodor's infrastructure or inside the customer's network.

SourceKomodor, komodor.com/platform and docs.komodor.com overview, agent catalog, Remediation Executor and Incident managementread 2026-10-25

Herald, Hyground's notification gateway, takes any JSON posted to one endpoint, from Alertmanager, Grafana, Datadog, PagerDuty, GitHub, Jira, ServiceNow, cron or curl, checks it for prompt injection and opens an Auto RCA when it describes an incident. People also start sessions from Slack, Microsoft Teams or email, schedules run saved tasks from every five minutes to monthly, and a watch repeats a check inside one session at an interval for up to 24 hours.

Sourcehyground.ai/product/triggers, docs.hyground.ai/user-guide/sessions-hyground-starts and schedule-a-sessionread 2026-10-25

Alert Intelligence and Incident Management modules work alerts and incidents as they arrive, and change intelligence and proactive reliability optimization run continuously across clusters. Runs start from alerts, schedules, chat, channels, pull requests, workflow steps, other agents and manual runs. Schedules use standard cron expressions with a timezone and optional input, and fire only while both the schedule and its agent are enabled. Inbound endpoints let outside systems start a run with an HTTP request.

SourceKomodor, komodor.com/platform/pricing-and-plans, /platform and docs.komodor.com Triggers and schedulesread 2026-10-05

A knowledge base holds the customer's runbooks, documentation and past investigations, embedded for retrieval inside the customer's cluster. Administrators import what goes in, wiki pages, documentation files from Git repositories, files from Artifactory and uploaded documents, and the content is as current as the last import. The agent searches it on its own while it writes a reply, alongside live cluster state, and each search shows in the Tools panel with the words searched and the matching passages, each naming the document it came from.

Sourcehyground.ai/product/architecture and docs.hyground.ai/user-guide/how-the-agent-uses-knowledgeread 2026-10-25

Agents run on 'a living knowledge graph' of the customer's Kubernetes and cloud estate, shared across the fleet. The graph relates services, owners and dependencies, and beside it sits a knowledge base of runbooks, postmortems, service docs, policies, decisions, guides and incident write ups that teams add as Markdown, text or PDF files, up to 20 files per upload and 10 MB each.

Each document is indexed for both semantic and keyword search and split at its headings, so an agent's search tool returns five matching passages by default and up to ten, each with the document, section and chunk it came from so a citation can be checked. Documents carry service, environment, type, owner and sensitivity tags, stay inside one account, and catalog agents search them by default.

SourceKomodor, komodor.com and docs.komodor.com Knowledge baseread 2026-10-25

Inside a session the agent works from its full history, condensed into a summary when a session runs long. Across sessions, recall brings content from the user's own past sessions and every shared session into a new one when the user points the agent at earlier work, and never reads another user's private session. The knowledge base also holds past investigations embedded for retrieval, and the agent's writes include its own knowledge base. No memory the agent keeps for itself with a stated lifetime and a place to review or edit it is described.

Sourcedocs.hyground.ai/user-guide/what-the-agent-remembers, hyground.ai/product/architecture and hyground.ai/use-cases/nis2-doraread 2026-10-25

Agents work from shared memory: 'Every agent draws on the same shared memory and a living knowledge graph, so nothing starts from zero'. Memory belongs to each agent, and agents that share a space can read each other's learnings. After a run the agent reviews its own work and saves what is worth keeping as a technique, pointer, constraint, fact, feedback or preference, labeled by topic.

New memories wait as drafts for a reviewer agent, active memories stay retrievable until they are archived or folded into a better one by a coherence sweep, and archived memories stay readable for 90 days before they are permanently deleted. People filter, edit and archive memories in Manage memories, and an Activity view tracks how often they help.

SourceKomodor, komodor.com and docs.komodor.com Memoryread 2026-10-05

The agent is read only by default, and adapters enforce that below the model. Administrators allow selected write actions and decide which need confirmation; for those the agent shows an Action Confirmation Required card with the operation and the full command, which only the session owner can approve or deny, and the offer expires after 15 minutes by default. A mail or chat message is shown before it goes out unless the user asked for the send outright. Sessions from schedules and Auto RCAs have no owner, so no one can approve a write in them. Hyground does not claim remediation today.

Sourcedocs.hyground.ai/user-guide/whose-access-the-agent-uses and hyground.ai/use-cases/nis2-doraread 2026-10-25

Higher risk actions are held for a person ('Maintain full control over higher-risk actions'), with agent RBAC, input, output and tool guardrails, budget caps and rate limits on every plan. Holds come from workflow steps written to pause for a person and from guardrails set to Hold for approval on a specific tool call, and each grant is single use and covers that exact call with its arguments. Pending decisions collect in the Attention inbox, with approve and deny beside each one, and the platform overview counts them on an Approvals card. Only a person can answer, in the console.

An agent cannot approve its own held action, and a rejection ends that path of the run. Every decision and the guardrail verdict behind it land in the run's evidence. Nothing pushes a pending approval to the approver yet, though a Slack thread now says when a run is waiting on a person. Behind a feature flag, an approver allowed to change policy can approve and stop asking, which edits the agent's action policy for that tool and is recorded in the audit trail.

SourceKomodor, komodor.com/platform/pricing-and-plans, docs.komodor.com Approvals and Attention, and the September 20 changelogread 2026-10-25

Hyground is ISO/IEC 27001:2022 certified and publishes a CycloneDX software bill of materials with every release. Sessions, queries and actions tie to a named user through OIDC single sign on (Entra ID, Zitadel or any OIDC provider), automation runs under scoped technical users with the same audit trail, and administrators assign roles that decide which connected systems and features each user may use. Tool responses pass a secret filter before the model sees them, and images are Chainguard distroless, non root and read only.

Sourcehyground.ai/product/security, hyground.ai/use-cases/nis2-dora and docs.hyground.ai/user-guide/personalize-hygroundread 2026-10-25

RBAC, agent RBAC and SSO come on every plan, with comprehensive audit logs and data retention controls. SOC 2 Type II and GDPR are listed on both plans.

Seven built in roles run from Owner and Admin through Developer, Operator, Member and Viewer to an Agent role for agent principals, and custom policies and roles can be scoped account wide, by name pattern, by label or with an expiry. Access is denied unless a grant matches, and an access explorer shows the effective permissions of any identity before a change goes live.

Agents carry their own identity, credentials never appear in run evidence, and knowledge base documents never cross account boundaries.

SourceKomodor, komodor.com/platform/pricing-and-plans and docs.komodor.com Roles and permissionsread 2026-10-05

A Tools panel on each reply lists every tool call and knowledge search, Show command reveals exactly what the agent ran and Show response what each system returned, and the reasoning view shows the agent's thinking as it works. Every investigation, query and finding produces a structured, exportable record that compliance teams can audit, every step is recorded and replayable, sessions export with their files, and a post mortem draft is written from the investigation.

Sourcedocs.hyground.ai/user-guide/how-the-agent-answers, hyground.ai/product/security and hyground.ai/product/architectureread 2026-10-25

Komodor keeps a 'Full audit trail. Every verdict (allowed, redacted, blocked, or held) lands on the record, for every agent and every run'. Token usage is visible per agent.

Each run records a transcript, a trace timeline of reasoning, model calls and tool calls with their durations, logs, structured and readable output, artifacts, the skills loaded and the guardrail decisions. Token use is split into four classes with cost attached, and evidence stays readable for failed runs.

The History ledger filters runs by type, status and agent, the same records come back over the API, and the docs cover OpenTelemetry export.

SourceKomodor, komodor.com and docs.komodor.com Runs and evidenceread 2026-10-05

Hyground installs from one Helm chart into the customer's own Kubernetes cluster (AKS, EKS, GKE, OpenShift, K3s or on premises) and stays there, the agents, knowledge base, audit trail and model connection included, with everything stored in the customer's own PostgreSQL. There is no SaaS control plane, phone home or vendor access path, the license validates offline, images mirror into air gapped registries, and each connected environment runs a small outpost gateway. The only outbound traffic is the prompt to the model the customer chose, and with a self hosted model nothing leaves.

Sourcehyground.ai/product/security, hyground.ai/product/architecture and hyground.ai/use-cases/nis2-doraread 2026-10-25

Komodor offers to 'Run wherever your infrastructure lives: self-hosted on cloud or on-prem, or Komodor cloud', which puts the platform in the customer's own environment or in Komodor's cloud. Agents can run in Komodor's infrastructure when they only need public APIs, or as self hosted agents in the customer's clusters or VMs that keep one outbound HTTPS connection to the hosted control plane and need no inbound firewall rules or VPN.

The whole control plane can also be self hosted from a single Helm chart bundle, in beta and arranged with the account team, and then the only outbound traffic goes to the model and the systems the customer connects. The platform page lists self managed Kubernetes, EKS, GKE, AKS, serverless and on premises targets, and hosted and self hosted agents can sit in one fleet.

SourceKomodor, komodor.com, /platform and docs.komodor.com Deployment methodsread 2026-10-05

System skills ship with Hyground, always active and read only, and a Skill blueprints page offers ready made use cases, filtered by tags and marked when the skill needs write access. Choosing one has the agent explore the environment, check the blueprint's assumptions against it, gather the setup details it needs from the user, write the skill with them and offer a test run. Named jobs include incident investigation, cost analysis, CVE blast radius, RBAC drift, cluster right sizing and NIS2 and DORA reporting. Teams also write and share their own skills, versioned and grouped by category.

Sourcedocs.hyground.ai/user-guide/create-a-skill, run-a-skill and hyground.airead 2026-10-25

Komodor ships ready to run solution modules, each for its own job: Incident Management and Troubleshooting, Alert Intelligence, Proactive Reliability Optimization, Kubernetes and Cloud Cost Optimization, Change Intelligence and Risk Control, CI/CD Health and Remediation, and Production Readiness and Standards. Observability Cost Optimization is added on Enterprise.

The agent catalog is curated per account and its agents deploy as they are once credentials are supplied, covering cloud providers, APM tools, Kubernetes, code review, an orchestrator, remediation with a separate remediation executor, and an AWS cost analyzer. The platform page counts more than 50 agents across the modules.

SourceKomodor, komodor.com/platform/pricing-and-plans, /platform and docs.komodor.com agent catalogread 2026-10-05

Agents reach their model through LiteLLM, with a primary and a fallback, so the customer picks Azure OpenAI, OpenAI, Anthropic, Google Gemini on Vertex AI or AI Studio, AWS Bedrock, Azure AI Foundry, OpenAI compatible endpoints such as vLLM, Scaleway, Together or Fireworks, or a self hosted model through Ollama, and swaps providers without touching the rest of the system. Model costs are paid to the provider under the customer's own contract.

Sourcehyground.ai/product/architecture, hyground.ai/product/integrations and hyground.ai/use-cases/nis2-doraread 2026-10-25

The platform runs 'on your cloud, on-prem, or Komodor Cloud, with any model', with model routing that sends simple steps to cheaper models for token efficiency. Models come three ways.

Komodor can supply managed models with budgets it sets, a customer can register its own accounts with any of 18 providers, among them OpenAI, Anthropic, Azure, Bedrock, Vertex AI, Gemini, Mistral, Groq, DeepSeek, OpenRouter, Together AI, xAI, Cohere, Ollama, Baseten and Nebius Token Factory, plus hosted vLLM endpoints, and self hosted agents can send requests straight through the customer's own LLM gateway. Self hosted agents pick their models when they are built or deployed, and every model sits in one table whichever way it arrived.

SourceKomodor, komodor.com, /platform and docs.komodor.com Providersread 2026-10-05

Herald's single webhook endpoint (/api/herald/webhook) lets any outside system that can POST JSON start an investigation, and the architecture page lists Claude Code, Cursor and any MCP client among the signals that reach Hyground. There is no API reference, SDK or Hyground MCP server documented with an endpoint and authentication, and the customer MCP servers and HTTP APIs it connects to are integrations the agent calls.

Sourcehyground.ai/product/triggers and hyground.ai/product/architectureread 2026-10-25

Agents are built with MCP gateways and integrations that connect them to tools. Komodor's own REST API sits at /api/v1 on the account host and takes bearer API keys issued to service accounts or to people, and an interactive reference generated from the live service sits at /api/docs on the same host behind the account login.

The platform's MCP server at /internal/mcp checks every tool call against the same permissions as the HTTP API, with toolsets that search the platform, create and change agents, schedules and integrations, run agents, manage incidents, workflows and the gateway, and handle golden test scenarios. Claude Code, Codex CLI and Cursor are named as clients, and the pricing table lists API, MCP and infrastructure as code access on both plans.

SourceKomodor, docs.komodor.com APIs and MCP server, and komodor.com/platform/pricing-and-plansread 2026-10-05

Users rate replies up or down, with reasons such as inaccurate, missing context or made up, and guidance shows how to check each claim against a tool result. A skill written from a blueprint comes with an offered test run, and teams can schedule a skill that checks the agent's own tools on a cadence. There is no evaluation harness that scores agent runs against tests, and the sandbox is for trying the product.

Sourcedocs.hyground.ai/user-guide/get-help, check-the-agents-work, create-a-skill and hyground.ai/blog/ai-sre-agent-beyond-incidents-regression-test; docs.hyground.ai/user-guide/check-the-agents-workread 2026-10-25

An Optimize pillar promises continuous improvement of agent quality, speed and cost. Evaluation rules send a share of an agent's runs, from 10 to 100 percent, to a panel of judge agents that score each run from 0 to 1 against named rubrics such as quality, precision and recall, with the reasoning attached to every verdict.

Model Evaluation grades shadow candidates on production traffic without touching the live agent's averages, and golden test scenarios and suites can be managed from the platform's MCP server. People can add their own star ratings, which stay separate from the judges' scores. The pricing table lists an out of the box eval framework, a golden scenario builder and per tool token evaluation on both plans, with custom evals on Enterprise.

SourceKomodor, docs.komodor.com Evaluations and MCP server, komodor.com/platform and /platform/pricing-and-plansread 2026-10-05

A WebFetch tool fetches allowlisted URLs at run time and converts HTML to Markdown. That is a headless fetch, and the agent never sees a browser, a desktop or the user's screen.

Sourcehyground.ai/product/integrations and docs.hyground.ai/user-guide/what-the-agent-can-seeread 2026-10-25

Agents operate Kubernetes and cloud through tools, MCP gateways and integrations. No browser, desktop or computer control is documented. Fixes are carried out by a dedicated Remediation Executor agent working through the customer's own tools.

SourceKomodor, komodor.com and docs.komodor.com agent catalogread 2026-10-05