agent

stakpak up now runs preflight checks before startup, and stakpak autopilot doctor can be used as a deployment-readiness check before first boot:

stakpak autopilot doctor
stakpak up

See also: cli/README.md

Unified configuration (profiles + autopilot wiring)

• ~/.stakpak/config.toml: profile behavior (model, allowed_tools, auto_approve, system_prompt, max_turns, provider credentials)
• ~/.stakpak/autopilot.toml: runtime wiring (schedules, channels, service/server settings)

Use profile = "name" on schedules/channels and keep behavior inside profile definitions.

# schedule profile
stakpak autopilot schedule add health --cron '*/5 * * * *' --prompt 'Check health' --profile monitoring

# channel profile
stakpak autopilot channel add slack --bot-token "$SLACK_BOT_TOKEN" --app-token "$SLACK_APP_TOKEN" --profile ops

Full setup guide: cli/README.md

🔒 Security Hardened

• Mutual TLS (mTLS) - End-to-end encrypted MCP
• Dynamic Secret Substitution - AI can read/write/compare secrets without seeing actual values
• Secure Password Generation - Generate cryptographically secure passwords with configurable complexity
• Privacy Mode - Redacts sensitive data like IP addresses and AWS account IDs

🛠️ Built for DevOps Work

• Asynchronous Task Management - Run background commands like port forwarding and servers with proper tracking and cancellation
• Real-time Progress Streaming - Long-running processes (Docker builds, deployments) stream progress updates in real-time
• Infrastructure Code Indexing - Automatic local indexing and semantic search for Terraform, Kubernetes, Dockerfile, and GitHub Actions
• Documentation Research Agent - Built-in web search for technical documentation, cloud providers, and development frameworks
• Subagents - Specialized research agents for code exploration and sandboxed analysis with different tool access levels (enabled with --enable-subagents flag)
• Bulk Message Approval - Approve multiple tool calls at once for efficient workflow execution
• Reversible File Operations - All file modifications are automatically backed up with recovery capabilities

🧠 Adaptive Intelligence

• Rule Books - Customize agent behavior with internal standard operating procedures, playbooks, and organizational policies
• Persistent Knowledge - Agent learns from interactions, remembers incidents, resources, and environment details to adapt to your workflow

Installation

All installation options (Linux, MacOs, Windows)

Check the docs

Homebrew (Linux & MacOS)

brew tap stakpak/stakpak
brew install stakpak

To update it you can use

brew update
brew upgrade stakpak

Binary Release

Download the latest binary for your platform from our GitHub Releases.

Docker

This image includes the most popular CLI tools the agent might need for everyday DevOps tasks like docker, kubectl, aws cli, gcloud, azure cli, and more.

docker pull ghcr.io/stakpak/agent:latest

Usage

You can use your own Anthropic or OpenAI API keys, custom OpenAI compatible endpoint, or a Stakpak API key.

Option A: Running with a Stakpak API Key (no card required)

Just run stakpak and follow the instructions which will create a new API key for you.

stakpak

Brave users may encounter issues with automatic redirects to localhost ports during the API key creation flow. If this happens to you:

Copy your new key from the browser paste it in your terminal

Non-interactive setup (CI/scripts)

stakpak auth login --api-key $STAKPAK_API_KEY

Or set the environment variable

export STAKPAK_API_KEY=<mykey>

View current account (Optional)

stakpak account

Option B: Running Without a Stakpak API Key

Non-interactive setup (CI/scripts)

# Anthropic
stakpak auth login --provider anthropic --api-key $ANTHROPIC_API_KEY

# OpenAI
stakpak auth login --provider openai --api-key $OPENAI_API_KEY

# Gemini
stakpak auth login --provider gemini --api-key $GEMINI_API_KEY

Manual configuration

Create ~/.stakpak/config.toml with one of these configurations:

Option 1: Bring Your Own Keys (BYOK) - Use your Anthropic/OpenAI API keys:

[profiles.byok]
provider = "local"

# Unified model preference field
model = "anthropic/claude-sonnet-4-5"

# Built-in providers - credentials can also be set via environment variables
# (ANTHROPIC_API_KEY, OPENAI_API_KEY, GEMINI_API_KEY)
[profiles.byok.providers.anthropic]
type = "anthropic"
api_key = "sk-ant-..."

[profiles.byok.providers.openai]
type = "openai"
api_key = "sk-..."

[profiles.byok.providers.gemini]
type = "gemini"
api_key = "..."

[settings]

Option 2: Bring Your Own LLM - Use a local OpenAI-compatible endpoint (e.g. Ollama, LM Studio):

[profiles.offline]
provider = "local"

# Custom provider models use the format: provider_key/model_name
model = "offline/qwen/qwen3-coder-30b"

# The provider key "offline" becomes the model prefix
[profiles.offline.providers.offline]
type = "custom"
api_endpoint = "http://localhost:11434/v1"
# api_key is optional for local providers

[settings]

Option 3: Mix Built-in and Custom Providers:

[profiles.hybrid]
provider = "local"

# Unified model field (provider-prefixed)
model = "anthropic/claude-sonnet-4-5"

[profiles.hybrid.providers.anthropic]
type = "anthropic"
# Uses ANTHROPIC_API_KEY env var

[profiles.hybrid.providers.offline]
type = "custom"
api_endpoint = "http://localhost:11434/v1"

[settings]

Then run with your profile:

stakpak --profile byok
# or
stakpak --profile offline
# or
stakpak --profile hybrid

Start Stakpak Agent TUI

# Open the TUI
stakpak
# Resume execution from a checkpoint
stakpak -c <checkpoint-id>

Start Stakpak Agent TUI with Docker

docker run -it --entrypoint stakpak ghcr.io/stakpak/agent:latest
# for containerization tasks (you need to mount the Docker socket)
docker run -it \
   -v "/var/run/docker.sock":"/var/run/docker.sock" \
   -v "{your app path}":"/agent/" \
   --entrypoint stakpak ghcr.io/stakpak/agent:latest

MCP Modes

You can use Stakpak as a secure MCP proxy or expose its security-hardened tools through an MCP server.

MCT Server Tools

• Local Mode (--tool-mode local) - File operations and command execution only (no API key required)
• **R