Audit security & cost risks in kernel, IaC, and K8s

AegisOps-AI is a "Living Pipeline" that wires AI reasoning (via the Google GenAI SDK, using Gemini 3) directly into the SDLC as an automated gatekeeper across three domains. It runs a "Deep Reasoning" audit on raw Git diffs of Linux Kernel patches to catch memory-safety bugs like use-after-free and stale-state issues (patch_analyzer.py, output analysis_results.json); it analyzes terraform plan output to catch cost anomalies and "Silent Disaster" cloud-bill spikes such as an accidental upgrade from a t3.micro to a high-performance GPU instance (cost_auditor.py, output infrastructure_audit_report.json); and it translates natural-language security intent into hardened Kubernetes securityContext manifests enforcing least privilege - read-only root filesystem, non-root enforcement, and similar controls (k8s_policy_generator.py, output hardened_deployment.yaml). Running python3 main.py executes the full suite of agents in sequence and generates all three reports.

Use it for kernel patch review (auditing raw C-based Git diffs for memory safety), pre-apply IaC audits (analyzing terraform plan output before a bill spike), cluster hardening (generating least-privilege securityContexts), and CI/CD quality gating (blocking non-compliant merges via GitHub Actions).

Do NOT use it for standard web-application vulnerabilities like XSS or SQL injection - use a dedicated SAST scanner instead. Its patch analyzer is optimized for C-logic and isn't suited to high-level languages like Python or JS. It is an auditor, not a deployment tool: it never executes terraform apply or kubectl apply itself. And it isn't for post-mortem analysis of why a previous AI session failed - that's a separate /analyze-project skill.

Inputs: a raw Git diff of a kernel patch (with at least 5 lines of surrounding context recommended for accurate reasoning), a terraform plan output, or a natural-language security requirement (e.g. "non-root only") for the K8s hardener. Setup requires a .env file holding a GEMINI_API_KEY.

git clone https://github.com/Champbreed/AegisOps-AI.git
python3 main.py

Outputs are the three modules' JSON/YAML artifacts: analysis_results.json from the kernel patch reviewer, infrastructure_audit_report.json from the FinOps and cloud auditor, and hardened_deployment.yaml from the K8s policy hardener.

Built on the Google GenAI SDK (Gemini 3) for its reasoning path, run in a Python virtual environment with google-genai and python-dotenv installed, and designed to gate merges through GitHub Actions in CI/CD.

Platform, security, and FinOps teams who want an automated first-pass audit on kernel patches, Terraform plans, or Kubernetes manifests before human sign-off - explicitly kept as a high-fidelity signal generator rather than a system that applies changes itself, with human-in-the-loop expected for kernel-level merges.