Turn natural-language requests into validated Opentofu/Terraform pull requests. Kumoss generates infrastructure, corrects drift, enforces your policies and keeps humans in control of high-impact or not compliant changes.
Quickstart · Documentation · See it in action · Roadmap · Issues
Watch.the.90-second.overview.mp4
Table of contents
Kumoss turns natural-language requests into reviewed, compliant Infrastructure as Code (IaC). Platform engineers and developers describe what they need; Kumoss's agents generate Terraform-compatible HCL in the right repository, following your architecture, security, and networking standards. Every change is validated, planned, reported, and audited for compliance before Kumoss opens a pull request and applies it on request.
The result is developer autonomy for infrastructure operations: developers create, change, and maintain their own infrastructure, day-2 included (updates, drift remediation, importing existing resources), without waiting on the platform team or needing IaC expertise. It stays safe and compliant: your guardrails apply to every request, and anything high impact or non-compliant waits for an administrator.
| Without Kumoss | With Kumoss | |
|---|---|---|
| Asking for infra | Tickets, back-and-forth, HCL expertise required | One sentence and a project |
| Day-2 operations | Queued behind the platform team | Self-service updates, drift fixes, and imports, within guardrails |
| Drift | Discovered late, fixed by hand | Detected and folded back into the code in the same pull request |
| Standards | Enforced in review, if someone remembers | Applied during generation and audited before every pull request |
| Risky changes | Caught after the fact | Session locked until an administrator approves |
| Visibility | Raw plan output |
A readable report with impact and cost estimate |
- Try it locally in minutes. Run the full stack on one machine with Docker Compose by following the Quickstart.
- Run it in production. Plan a deployment for your team with Deploy to production.
- Compliant infrastructure from plain language. A developer-friendly assistant that needs only your request and the project.
- A validated plan, every time. Kumoss reads your IaC code and what is actually deployed, treats the deployment as the source of truth, and corrects existing and impacted drift, day-2 changes included. The result is a passing Terraform/OpenTofu plan that follows your architecture, security, and governance rules.
- Human review where it matters. High-impact or non-compliant requests lock the session until an administrator reviews them.
- A report people can read. Every session ends with a summary of the proposal, its impact, and a cost estimate.
- Several modes of operation. Generate, remediate drift, or import console-created resources, for part of a project or all of it.
- Works with what you already have. Use your existing IaC repositories, Terraform state, and Git provider (GitHub, Azure DevOps, or GitLab).
- **Authorization is an extension point requiring an implementation. **
- ** LLM Model and identity provider are configured externally. **
- Multicloud. AWS, Azure, Google Cloud, Oracle Cloud Infrastructure, Kubernetes, and VMware vSphere.
- Your rules, your definition of critical. You decide what is allowed, what is high risk, and which compliance checks apply. Critical can mean special projects, every production environment, changes above a cost threshold, or any rule you write.
- Full traceability. An admin panel shows users, sessions, and roles, all stored in a database.
- Observability built in. Every agent and every system prompt read at runtime is traced with OpenTelemetry and Arize Phoenix.
| Component | Bundled | Bring your own |
|---|---|---|
| Model | — | Any LiteLLM-supported model, including self-hosted ones, with web search included; |
| Identity | — | Any OIDC provider |
| Authorization | — | Your rules for who may request infrastructure, and where (authorization contract) |
| IaC executor | OpenTofu/Terraform | Your own runtime, version, and execution environment (IaC contract) |
| Notifications | Slack webhook | Any channel: Slack, Microsoft Teams, email, Discord, WhatsApp, … (notifications contract) |
Authorization, IaC, and notifications are sidecar services behind OpenAPI contracts; replace a bundled one or implement your own. Everything is exposed through a FastAPI API, with MCP and A2A support on the roadmap so other agents can use Kumoss directly.
- You ask. Describe the infrastructure you need in plain language and pick the project.
- Kumoss checks who you are. It authenticates you and confirms you may work on that project.
- Kumoss gathers context. Your deployed cloud infrastructure, IaC repository, request, and your organization's architecture, security, and governance standards.
- Kumoss builds a plan that passes. It generates the code and runs a Terraform/OpenTofu plan, fixing and retrying until it passes.
- Kumoss fixes drift along the way. What runs in the cloud is the source of truth, not the repository, so drift is fixed by updating the code to match.
- You get a clear report. Impact, main changes, and estimated cost.
- A compliance agent reviews the proposal. It checks the change against your policies and flags it as high impact if it meets your criteria. Kumoss then opens a pull request.
- Risky changes wait for review. Non-compliant or high-impact proposals block apply and notify your administrators to accept or reject them.
- You apply. Once cleared, you approve and apply, and get a new report with the result.
The video below is a real use case, an unscripted cloud session condensed for viewing. For a step-by-step walkthrough, see Kumoss in action.
Watch.Kumoss.manage.real.infrastructure.mp4
- Platform engineering teams turn their standards into guardrails that every request follows, so they stop hand-writing infrastructure for each ticket.
- DevOps and SRE teams keep the cloud and its code in sync, with drift fixed and existing resources imported through reviewed pull requests.
- Cloud architects and security teams get every change audited against their policies, and anything high impact or non-compliant waits for their approval.
- Developers create and maintain the infrastructure they need in plain language, without IaC expertise or waiting in a queue.
The architecture documentation covers the components, the core's layering, data and state, and the end-to-end flow from a request to an applied plan.
The full documentation is published at inditextech.github.io/kumoss.
| Initiative | Status | Community opportunity |
|---|---|---|
| Scheduled drift detection and import | In progress | Run it against your estate and report drift edge cases |
| Helm chart and installation wizard | In progress | Install it on your cluster and share what breaks |
| Cloud to code, code to cloud, and infrastructure diagrams | Planned | Share how you bootstrap and structure IaC repositories |
| Bulk and multiproject requests | Planned | Describe the changes you roll out across many projects |
| Evaluation harness, model benchmarking, and policy as code | Planned | Contribute test scenarios, model results, and OPA policies |
| Cost estimates, cost guardrails, and FinOps integrations | Planned | Propose integrations with the FinOps tools you use |
| MCP and A2A support | Planned | Help design the tools and skills other agents should call |
The roadmap states intent, not commitment. See the full roadmap for details, and open an issue to pick up an opportunity.
FastAPI · React · LiteLLM · OpenTofu · Terraform · Arize Phoenix · OpenTelemetry · PostgreSQL · Redis · RustFS · SearXNG · nginx
Please do not report security vulnerabilities through public issues. Use the Inditex disclosure program as described in SECURITY.md.
We welcome contributions! Please read CONTRIBUTING.md and follow the Code of Conduct. Open an issue before starting substantial work, and use Conventional Commits for your commit messages.
This project is licensed under the Apache-2.0 License.
© 2026 INDUSTRIA DE DISEÑO TEXTIL S.A. (INDITEX S.A.)