Shipwright

A Kubernetes SRE agent that watches your cluster, spots problems, and reasons about them with Claude on AWS Bedrock. It runs as a native desktop app and connects through your existing kubeconfig — no in-cluster agent to deploy, no SaaS account, no data leaving your machine except the model calls you make.

---

The safety model

An agent with kubectl access is a liability unless something stands between the model and the cluster. Every command the model wants to run is classified before execution:

Class	Examples	Behavior
safe	get, describe, logs, top, events	Runs automatically
needs-approval	scale, rollout restart, patch, cordon, drain	Blocks until a human approves
blocked	delete, apply, create, exec, run, port-forward	Rejected outright

Anything unrecognized falls through to denied rather than allowed. The classifier — not the prompt — is what enforces this, so a persuasive model cannot talk its way past it. See shipwright-desktop/packages/app/src/kubectl/executor.ts.

What it does

• Streaming diagnostics — ConverseStreamCommand, tokens rendered as they arrive
• Multi-tool orchestration — run_kubectl, get_pod_logs, get_resource_metrics, search_events
• Model routing — Haiku for simple lookups, Sonnet for real diagnostic work; chosen per turn by complexity rather than fixed up front
• Prompt caching — a cache point after the system prompt, so multi-turn sessions stay cheap
• Extended thinking — reasoningContent surfaced as collapsible blocks instead of hidden
• Ask your cluster — plain-English questions against live cluster state

Architecture

npm workspaces monorepo under shipwright-desktop/:

Package	Purpose
@shipwright/app	Electron main — monitor, diagnosis, kubectl, IPC handlers
@shipwright/renderer	React 19 + Tailwind 4 UI
@shipwright/shared	Shared types across the IPC boundary
@shipwright/agent	Remote agent stub for future WebSocket extraction

Main-process services reach the renderer only through typed IPC handlers behind a preload bridge (window.shipwright) — the renderer never touches Node or the cluster directly.

shipwright/ holds the original Hono + React web dashboard, kept for reference. It predates the streaming, multi-tool, thinking, and routing work.

Running

cd shipwright-desktop
npm install
npm run start --workspace=packages/app

Requires Node 22, a working kubeconfig, and AWS credentials with Bedrock access.

npm run make --workspace=packages/app   # build a DMG
npm run typecheck --workspace=packages/app

Configuration

All optional — sensible defaults throughout.

Variable	Default	Description
KUBECONFIG	~/.kube/config	Path to kubeconfig
KUBE_CONTEXT	shipwright-dev	Context to use
AWS_REGION	us-east-2	Region for Bedrock
AWS_PROFILE	default	Credentials profile
BEDROCK_MODEL_ID	us.anthropic.claude-sonnet-4-6	Full model
BEDROCK_FAST_MODEL_ID	us.anthropic.claude-haiku-4-5-20251001-v1:0	Fast model
MONITOR_INTERVAL_MS	30000	Cluster scan interval

Status

Working software, not a finished product. The desktop app is where active development happens; docs/design/ and docs/manual/ are drafts.

License

MIT — see LICENSE.