Integrations
Connects to the tools your changes already flow through.
ChangeGuard AI reads change and cluster state from where it already lives, and writes back only where you ask it to. Here’s exactly what each integration reads, what it writes, and what it needs.
| Integration | Reads | Writes | Permissions | Effort | Support |
|---|---|---|---|---|---|
| Kubernetes / EKS (Fleet — default) | Workloads, events, config, posture — cluster-wide, read-only, collected centrally | Nothing | One AWS discovery role + a per-cluster read-only grant you apply (get/list, no Secrets) | Connect AWS once | GA |
| Kubernetes (Edge collector — optional) | Node-local evidence (runtime, benchmarks) plus the same cluster state | Nothing by default; workload patches only at opt-in remediation | Read-only ClusterRole; optional namespaced write Role you apply | 1 Helm command | GA |
| GitHub App | Repo metadata & contents (for recommended-fix PRs and the optional code graph) | Opens pull requests with proposed fixes | Exactly contents:write, pull_requests:write, metadata:read | Install the app on selected repos | GA |
| ArgoCD | Application & sync state for GitOps change visibility | Nothing | Read access to Argo resources in-cluster | Auto-discovered | GA |
| Flux CD | GitOps reconciliation state | Nothing | Read access to Flux resources in-cluster | Auto-discovered | GA |
| CI/CD (GitHub Actions, GitLab CI, shell) | Change/manifest you submit for a pre-flight check | Nothing in your cluster; returns a verdict | A cicd-scoped API key | Add a step/template | GA |
| Slack / Microsoft Teams / Webhook | Nothing | Outbound notifications you configure | An incoming webhook URL | Paste a webhook | GA |
| Amazon Bedrock (Claude) | — | — | Runs in the ChangeGuard AI control plane (not your cluster) | None | GA |
| Self-hosted inference (NVIDIA NIM) | — | — | For teams that require in-VPC model inference | — | Roadmap |
GitOps-native
ChangeGuard AI understands ArgoCD and Flux, so change visibility works fleet-wide without you wiring anything up per cluster.
Advisory in CI
Add a pre-flight step and get a SHIP/HOLD/BLOCK verdict on the PR. It reports a verdict; a BLOCK fails the job by default, and you can turn that off to run purely advisory.
Fixes as pull requests
With the GitHub App, recommended fixes arrive as PRs you review and merge — the same review flow your team already trusts.
Bring your stack
Most teams are connected end-to-end in well under an hour. Setup steps for each integration are in the docs.