Agent Runtime

Your clusters, now running coding agents

The medium-difficulty work clogging your backlog doesn’t need to be there. The Plural Agent Runtime turns your existing Kubernetes clusters into a secure, autonomous compute layer for coding agents, so the work gets done while your team focuses on what matters.

Book a demo Read the docs

agent run #318 · claude-default · plrl-agents● running in-cluster

prompt · Fix CVE-2026-21427 in acme/payments-api and make sure tests pass.

plan › Bump golang.org/x/net to v0.38.0 in go.mod

$ go get golang.org/x/net@v0.38.0 && go mod tidy

$ docker build -t payments-api:agent .

$ docker compose up -d postgres redis

$ go test ./...

✓ 142 passed · 0 failed

Pull request ready for reviewReview PR #1287

go.mod

7 require (

8 github.com/lib/pq v1.10.9

9 - golang.org/x/net v0.33.0

9 + golang.org/x/net v0.38.0

10 )

1 file changed · run history attached

Isolated podYour API keysEgress policy on

Secure by design

No new infrastructure. No code leaving your perimeter.

Standing up separate cloud infrastructure for agents brings new complexity, new security reviews, and new costs. The Agent Runtime uses the clusters you already operate.

Configured like everything else: a CRD

Declare the agent you want, opt into the capabilities it needs, and point it at your keys and model. Once applied, it’s available to any user or group you grant access to.

Kubernetes provides the sandbox. You control the security and networking constraints on every run, so agents fit environments with strict compliance requirements.

Configure a runtime

agents/claude-default.yaml

apiVersion: deployments.plural.sh/v1alpha1

kind: AgentRuntime

metadata:

name: claude-default

namespace: plrl-agents

spec:

targetNamespace: plrl-agents

type: CLAUDE # or OPENCODE, GEMINI

default: true

aiProxy: true # translate to the API you've approved

config:

claude:

apiKeySecretRef:

name: ai-config

key: anthropic

Bring the agent and model you’ve approved

Pick the best agent for the job without lock-in. The built-in AI proxy translates between API formats, so an Anthropic-native agent can run even when only OpenAI is approved.

Supported agents

Claude CodeOpenCodeGemini

Anthropic-native agent→ AI proxy →OpenAI-approved endpoint

Built for real tasks

An agent that tests its work before you see it

A coding agent that can only write code is half useful. The runtime handles the full lifecycle of an engineering task, including proving the change works.

$ docker build .✓ image built · 41s

Docker-in-Docker

Agents build container images to prove the change actually compiles and ships.

$ docker compose up -d$ make test✓ 142 passed

Compose test environments

Stand up the service and its dependencies, then run the suite before the PR exists.

$ npx playwright test✓ checkout.spec.ts✓ login.spec.ts

Headless Chromium

Mount a real browser so Playwright or Cypress suites run end to end.

Act or analyze

From backlog item to background job

Trigger a run, step away, and come back to a pull request or a plan, with every command and decision in the run history.

Actdefault

Searches the codebase, plans, implements the change, verifies it, and opens a pull request.

→ PR #1287 · 1 file changed · tests passing

Analyzeread-only

Runs the same agentic search, but returns an implementation plan or analysis instead of a diff.

→ Summary · 6 call sites · suggested rollout plan

Start with CVEs: ten fixes, ten minutes of review

Plural already surfaces vulnerabilities across your fleet. Dispatch an agent to fix any of them in a single action. The fix is well-scoped, Docker-in-Docker validates it, and the PR keeps a human in the loop.

Read the announcement

Vulnerabilities · payments-api3 open

CVE-2026-21427golang.org/x/net · HighFix with agent

CVE-2026-18803openssl 3.0.13 · CriticalFix with agent

CVE-2026-09114lodash 4.17.20 · MediumFix with agent

Questions

Where do agents actually run?

On your own Kubernetes clusters. Each run is an isolated container scheduled into the namespace you choose, with the security and networking policies you already apply.

Which coding agents and models are supported?

Claude Code, OpenCode, and Gemini today, using API keys you provide. The built-in AI proxy translates between API formats, so an Anthropic-native agent can run even when only OpenAI is approved.

Can agents push straight to main?

No. Code changes come back as pull requests with the full run history attached, so a human always reviews what ships.

How do teams trigger agents?

From the Plural console, in a single click from a detected CVE, or through Workbenches, which pick up work from alerts, tickets, and Slack and hand code changes to the runtime.

Put your backlog on autopilot

See coding agents run on your own clusters in a 30-minute demo.

Book a demo