Portainer announced Portainer-Command, a governance layer between AI agents and Kubernetes. With Portainer-Command, agents can read cluster state and make recommendations for change, but they have no direct write path. Instead, every change an agent wants to make becomes a Git pull request, which is reviewed and approved by a human, before being applied by Portainer’s GitOps engine.
Engineers are increasingly connecting AI agents to infrastructure with their own personal credentials, which lets the agent make any change those credentials allow with little or no review. When something goes wrong, it is hard to trace what the agent did and harder to undo it, and security leaders have no view of which agents are connected or any way to stop them. Portainer-Command separates AI access from human access. Administrators host one central MCP server in Portainer, and each agent that connects to it, from any MCP-compatible client, is limited to the permissions of the Portainer user it works for. One authenticated connection covers every environment that user can reach.
Agents inspect environments through short-lived, read-only sessions that require a stated reason, expire automatically, and map to a named person. Proposed changes land as pull requests that the agent cannot approve itself. Once a change is merged, Portainer reconciles the environment, and any change can be rolled back through Git history.
Administrators can allow agents in development while blocking production, review every AI action in a single audit log, and use Emergency Halt to cut off agent access to an environment or the whole fleet in one step. For teams just starting with AI in operations, a built-in agent workspace includes a library of prompts for tasks such as security audits and network policies, and organization-wide tracking shows model spend per user.
“Anyone can point an AI agent at kubectl today, but that leaves security teams in the dark about what those agents do with someone’s cluster credentials,” said Neil Cresswell, CEO and co-founder of Portainer. “Portainer-Command puts a control point in that path, so organizations can say yes to AI in operations and deterministically know what an agent did, who it was working for, and how to reverse it.”
“The agent never has a direct write path to the cluster,” said Nathan Peck, Chief Product Officer at Portainer. “It can look and it can propose, but the only way a change reaches a cluster is via a pull request a person reviews and approves. Every AI change stays reviewable, reversible, and in Git, where platform teams already work.”
Portainer-Command requires Git as the source of truth for the environments it manages. Portainer has published a threat model documenting the threats Portainer-Command addresses and the mitigations in place, for security teams to review.
Availability
Portainer-Command is available now in the add-on catalog for Portainer Business Edition. Attendees can see live demos at the Portainer booth at KubeCon + CloudNativeCon North America 2026.
