The Infrastructure API for Agents

The agent decides what to do. Nanokit guarantees that what the agent decides gets done: deterministically, securely, and reproducibly.

Get Started

Built for Agents

nanokit.yml the whole contract

# declarative, reviewable, diffable
services:
  web:
    image: registry.acme.dev/web:1.4.2
    domain: app.acme.dev
    env:
      DATABASE_URL: db://postgres/main
databases:
  postgres: { engine: postgres:16, volume: pgdata }
secrets:
  STRIPE_API_KEY: vault://prod/stripe/key

shell same input, same result

$ nkapp deploy -e production
✓ drift-hash verified · plan locked
+ service/web        image 1.4.1 → 1.4.2
· database/postgres  unchanged
✓ secrets resolved from vault (3)
✓ health gate passed · web 3/3
✓ state published · bridge :3006
— 2 resources touched · rollback: nkapp deploy --rollback

Deterministic Reconcile

Drift-hash gated reconciliation turns declared state into an exact plan. Create, update, delete, or nothing. Same input, same result.

Declarative Contract

One nanokit.yml describes services, databases, networks, cron jobs and cloud infra. No imperative scripts, no snowflake environments.

Machine-Readable State

Services, databases, secrets and domains report structured state over the CLI and a local WebSocket bridge, built for agents to read.

Multi-Provider

The same contract reconciles against Docker locally and AWS, Azure, GCP or DigitalOcean in the cloud.

Self-Healing

Certificates renew themselves and drift gets repaired back to intent. Environments compose with deploy targets, deploys are change-proportional.

Secrets & Environments

vault:// URIs resolve secrets at apply time — values never sit in the config file, the git history, or the build output.

Shipped today vs on the roadmap

Everything green ships today. Roadmap items are labeled as such — no vaporware.

Shipped todayDeclarative contractDeterministic reconcileChange-proportional deploysRollbackEnvironments × deploy targetsSecrets vaultSelf-healing certsMachine-readable stateDocker · AWS · Azure · GCP · DOMCP server / tool-APIcreate_environment primitiveStructured get_environmentDeclarative agent policy

On the roadmapDestructive agent toolsTeam-role tool filteringPolicy-as-code engineHosted MCP endpoint

Where Nanokit sits

Human intent flows down; verified state flows back up. Nanokit is the layer that makes the agent's decisions real.

Humanwrites & reviews intent

Agentdecides what to do

Nanokitguarantees it gets done

ProvidersDocker · AWS · Azure · GCP · DO

The agent's surface shrinks to two verbs: declare and observe. Locking, ordering, secret resolution, rollback and drift repair stay Nanokit's job.

Up and running in three commands

From zero to a reconciled environment.

01Install the CLI

$ npm i -g @nkapp/cli

02Scaffold the contract

$ nkapp init

03Reconcile

$ nkapp up -e local
$ nkapp deploy -e production

Full walkthrough in Getting Started, or inspect before executing with nkapp deploy.

“The agent decides what to do. Nanokit guarantees that what the agent decides gets done.”

Deterministically · Securely · Reproducibly

Built for Agents →Get Started