Kumoss is an LLM-powered platform that turns natural-language requests into compliant, Terraform-compatible infrastructure-as-code (IaC). Platform engineers and application developers describe the infrastructure they need, and Kumoss’s agents generate the corresponding code, guided by the organization’s own standards.
It runs as a layered FastAPI orchestration core with four OpenAPI integration contracts — IaC, notifications, repository mapping, and authorization — behind an nginx edge that also serves a React single-page application and proxies the API. Kumoss bundles services for IaC and notifications, while mapping and authorization are optional extension points you implement yourself.
Every state change and every blocking decision — the in-flight guard, validation, the compliance verdict, the session lock, apply — is computed by application code, not by a model, and applying a reviewed plan is always a human action.
| To watch this on a real cloud, from request to applied pull request and a blocked delete, see See Kumoss in action. |
What you deploy
Pan, zoom, search, trace a relationship, switch themes. Open in a new tab
The core platform components — the core orchestration API, the proxy
(nginx), core-db (PostgreSQL), redis, object-storage, and the
phoenix observability stack — run as shipped and are configured through
config.yaml and the .env files. You never reimplement them; in
production you replace only the bundled datastores.
Four sidecars are the integration points between Kumoss and your
organization: iac (executes the IaC engine; mandatory, always on),
notifications (posts session outcomes to Slack; disabled by default),
mapping (resolves a repository reference; disabled by default), and
authz (applies cloud-project authorization policy; disabled by default).
Each is defined by an OpenAPI contract. Kumoss bundles the iac and
notifications services, which any implementation of their contract can
replace; for mapping and authz, provide your own implementation. A
disabled sidecar is never contacted.
The React single-page application is the user-facing portal, served by the
proxy. The whole stack runs from one Docker Compose stack, with nginx as
the only public entry point.
Key capabilities
What Kumoss does for you
-
Compliant infrastructure from plain language — a developer-friendly assistant needs only the request and the project you are working on.
-
A validated plan, every time — Kumoss reads your IaC code and the infrastructure deployed in the cloud, treats what is deployed as the source of truth, and transparently corrects existing and impacted drift, including day-2 changes. The result is a successful Terraform or OpenTofu plan that complies with your organization’s architecture, security, and governance standards, see Generate infrastructure.
-
Human review where it matters — a high-impact or non-compliant request locks the session until your administrator team reviews it, and applying a plan is always an explicit human action.
-
A report people can read — every session ends with a summary of the proposal, its impact, and a cost estimate.
-
Several modes of operation — generate, remediate drift, or import, for part of a project or all of it, see Operating modes.
Built to fit your organization
-
Works with what you already have — your existing IaC repositories, Terraform state, and Git provider (GitHub, Azure DevOps, or GitLab).
-
Multicloud — AWS, Azure, Google Cloud, Oracle Cloud Infrastructure, Kubernetes, and VMware vSphere.
-
Your rules, your definition of critical — you decide what is allowed, what is high risk, and which compliance checks apply, from special projects to every production environment or a cost threshold, see Customize prompts.
-
Full traceability — an admin panel over users, sessions, and roles, all stored in a database.
-
Observability built in — every agent and every system prompt read at runtime is traced with OpenTelemetry and Arize Phoenix.
Bring your own
-
Model — any LiteLLM-supported model, see LLM providers and models.
-
Identity provider — any OIDC provider for sign-in.
-
Authorization logic — your own rules for who may request infrastructure, and where, by implementing the authorization OpenAPI contract.
-
IaC executor — your own Terraform or OpenTofu runtime, version, and environment, by implementing the IaC OpenAPI contract. The bundled
iacsidecar runs OpenTofu by default, with HashiCorp Terraform selectable viaIAC_BINARY.
Kumoss’s runtime components, internal layering, and end-to-end request flow are covered in Architecture. To run the bundled stack locally, see Quickstart. From there, Guides walks through each task the web application supports, and Reference holds the configuration, environment-variable, role, and API details those guides point at.