Audit security & cost risks in kernel, IaC, and K8s

AegisOps-AI is an autonomous DevSecOps and FinOps governance orchestrator that runs Gemini 3 as a "reasoning path" across three modules. The Kernel Patch Reviewer (patch_analyzer.py) performs a deep semantic audit of raw Linux Kernel Git diffs to detect memory-corruption vulnerabilities like use-after-free and stale state, writing analysis_results.json. The FinOps and Cloud Auditor (cost_auditor.py) analyzes terraform plan output for cost anomalies - for example an accidental upgrade from a t3.micro instance to a high-performance GPU instance - writing infrastructure_audit_report.json. The K8s Policy Hardener (k8s_policy_generator.py) translates natural-language security intent (such as "non-root only") into a production-ready, hardened securityContext manifest - read-only root filesystem, non-root enforcement - writing hardened_deployment.yaml. Setup:

git clone https://github.com/Champbreed/AegisOps-AI.git
cd AegisOps-AI
python3 -m venv venv
source venv/bin/activate
pip install google-genai python-dotenv

with a GEMINI_API_KEY stored in a local .env file, and python3 main.py runs the full suite of agents in sequence to generate all reports.

Use it for reviewing raw C-based kernel patch diffs for memory safety, auditing a terraform plan before applying it to catch a bill spike, generating least-privilege Kubernetes security contexts, or gating CI/CD merges on compliance. It is not for standard web vulnerabilities like XSS or SQL injection - use a dedicated SAST scanner for those - and the patch analyzer is optimized for C-logic, not high-level languages like Python or JavaScript. It is an auditor, not a deployment tool: it never executes terraform apply or kubectl apply itself. It is also not for post-mortem analysis of why a previous AI session failed - a separate /analyze-project skill covers that.

Input is a raw Git diff (kernel patches), a terraform plan diff, or a natural-language security requirement. Output is one of the three JSON/YAML artifacts above, depending on the module invoked. At least 5 lines of context around a Git diff is recommended for more accurate reasoning, and the FinOps auditor is meant to run before every infrastructure change, not after.

The Google GenAI SDK (Gemini 3), authenticated via a GEMINI_API_KEY that should live in CI/CD secrets in production rather than a local .env file. Hardened manifests should be tested in staging first to rule out functional regressions before wider rollout.

Platform and security engineers who need automated, high-fidelity first-pass review of kernel memory safety, Terraform cost drift, and Kubernetes security posture, while keeping a human in the loop for the final sign-off on kernel-level merges.