Live infrastructure inventory
Every asset across every environment in a continuously updated real-time view. Target by logical profile, not hostname. Profiles are versionable and cloneable across environments.
The platform
Five layers. None of them optional.All of them yours.
OpsZ is not a wrapper around existing tools. It is a purpose-built operational platform with a messaging fabric, a live topology graph, a governed workflow engine, an API-first surface, and an immutable evidence layer. Each layer depends on the others.
Together they give your team and your agents something that does not exist anywhere else: a shared, governed system of action.
Humans
Define policy
OpsZ
Govern execution
Agents
Do the work
Architecture
How it is built. Why it is different.
Five layers, and why none of them can be removed without breaking the others.
Lightweight agents on every asset communicate outbound over TLS-encrypted streams via NATS JetStream pub/sub. Mutual TLS authentication between every agent and broker. No inbound ports. No SSH chains. One broadcast, entire fleet responds simultaneously. No firewall rules required on managed endpoints. This is not your standard pub/sub.
Real-time metadata translation and dynamic relationship mapping. Not a CMDB. A live graph of what exists, where it lives, and how it relates to everything else. Updated continuously as infrastructure changes. The foundation for every blast-radius computation.
Multi-step orchestration with re-entrance built in. If 20 systems run a 20-step workflow and three fail mid-run, OpsZ resumes each at the exact failed step. No global reruns. Bash, HTTP calls, container runs, and MCP actions are all first-class. Templates live in git.
Everything in the platform is an API. Your existing tools integrate without being replaced. OpsZ becomes the governed orchestration layer above your existing stack. The MCP server creates the inference gateway between plain-language intent and governed machine execution.
Every authentication decision, job execution, approval event, and workflow step emitted as structured JSON to a durable audit stream. SIEM-forwardable. Not bypassable. The post-mortem that took hours of archaeology now starts with a report that assembled itself.
“AI is a layer on top of us. Not the other way around. We built the governed execution platform first. The inference layer sits on top of it: controlled, auditable, and interchangeable.”
Core capabilities
What the platform does. What it enables.
Every capability is governed by the same policy and audit framework. There is no ungoverned path, for humans or agents.
Workflow templates
Version-controlled, peer-reviewed playbooks in git. The library compounds over time. Ad-hoc responses become durable operational assets. Workflows survive partial failure through re-entrance.
Blast-radius preview
Computed from live topology at submission time, not estimated from stale inventory. Application-level Kubernetes impact included. You never touch production without knowing exactly what you are touching.
Approval gates
Non-bypassable for designated workflows, including by AI agents. Separation of duties enforced. The submitter cannot approve. Everything logged to the immutable audit stream.
RBAC and secrets
Your existing IdP handles authentication. OpsZ handles fine-grained authorization. Credentials are word-level redacted from all output. They never appear in workflow logs.
Audit trail and analytics
30-day rolling MTTR analytics, error pattern detection, step-level profiling, two-job diff reports. Automatic, durable, SIEM-forwardable. Every human and agent action. Immutably.
“Hello 32,532 nodes, identify every host running log4j version X.X or lower.” Results returned as a targetable dataset. Minutes, not weeks. No $500K data lake required.
Deployment and security
Inside your environment.
Your data never leaves without your permission.
Split-plane architecture. The customer-hosted control stack runs entirely inside your network. Agents communicate outbound only. OpsZ SaaS never initiates inbound connections to your environment. Air-gap deployment available as a self-contained tarball.
Typical deployment: 25 to 45 minutes on a ready cluster
- ✓Outbound-only, TLS-encrypted agent connectionsNo inbound ports, no firewall rule changes on managed endpoints
- ✓Air-gap supportSelf-contained tarball deployment for restricted environments
- ✓Credential isolationSecrets never appear in logs, ever, for any actor
- ✓SIEM-forwardable audit streamStructured JSON, durable, not bypassable
Identity Integration
Existing IdP handles auth. OpsZ handles fine-grained authorization per role, group, and template.
Credential Redaction
Word-level redaction on all output. No secret surfaces in any log or audit record.
Immutable Audit
Every event emitted to a durable stream. Not editable. Not bypassable. SIEM-ready.
Split-plane Isolation
Control plane inside your network. SaaS layer never initiates inbound connections.
Signed Promotions
Every workflow promotion is a signed git commit. Immutable, versioned, reviewable.
Non-bypassable Gates
High-risk approvals cannot be skipped, including by AI agents or API callers.
30 minutes.
Practical conversation.
We will look at your current operating model, where fragmentation shows up, and where OpsZ creates immediate leverage in your environment. No deck-flipping. Just an honest conversation about whether this is the right fit.
