Integrations
Connects to the tools your changes already flow through.
ChangeGuard reads change and cluster state from where it already lives, and writes back only where you ask it to. Here’s exactly what each integration reads, what it writes, and what it needs.
| Integration | Reads | Writes | Permissions | Effort | Support |
|---|---|---|---|---|---|
| Kubernetes (collector) | Workloads, events, config, posture — cluster-wide, read-only | Nothing by default; workload patches only at opt-in remediation | Read-only ClusterRole; optional namespaced write Role you apply | 1 Helm command | GA |
| GitHub App | Repo metadata & contents (for recommended-fix PRs and the optional code graph) | Opens pull requests with proposed fixes | Exactly contents:write, pull_requests:write, metadata:read | Install the app on selected repos | GA |
| ArgoCD | Application & sync state for GitOps change visibility | Nothing | Read access to Argo resources in-cluster | Auto-discovered | GA |
| Flux CD | GitOps reconciliation state | Nothing | Read access to Flux resources in-cluster | Auto-discovered | GA |
| CI/CD (GitHub Actions, GitLab CI, shell) | Change/manifest you submit for a pre-flight check | Nothing in your cluster; returns a verdict | A cicd-scoped API key | Add a step/template | GA |
| Slack / Microsoft Teams / Webhook | Nothing | Outbound notifications you configure | An incoming webhook URL | Paste a webhook | GA |
| Amazon Bedrock (Claude) | — | — | Runs in the ChangeGuard control plane (not your cluster) | None | GA |
| Self-hosted inference (NVIDIA NIM) | — | — | For teams that require in-VPC model inference | — | Roadmap |
GitOps-native
ChangeGuard understands ArgoCD and Flux, so change visibility works fleet-wide without you wiring anything up per cluster.
Advisory in CI
Add a pre-flight step and get a SHIP/HOLD/BLOCK verdict on the PR. It reports a verdict; it never blocks the job unless you choose to gate on it.
Fixes as pull requests
With the GitHub App, recommended fixes arrive as PRs you review and merge — the same review flow your team already trusts.
Bring your stack
Most teams are connected end-to-end in well under an hour. Setup steps for each integration are in the docs.