Read-only checker for Kubernetes AI-agent workloads. Flags a missing gVisor runtime class, service-account token automount, privileged or root containers, host namespaces, missing limits, and missing metadata or RFC1918 egress NetworkPolicy.
python kubernetes security-tools devsecops networkpolicy gvisor kubernetes-security k8s-security agent-sandbox llm-security ai-agent-security cloud-metadata
-
Updated
Oct 20, 2026 - Python