Agyn secures Kubernetes agent runtimes with sidecar credential isolation

An open-source, Kubernetes-native agent runtime that isolates credentials from LLMs using sidecar containers and mTLS handshakes, positioning itself as a secure alternative to Google's AX.

Agyn is built for platform engineering teams that need to host autonomous AI agents on internal Kubernetes clusters without exposing database credentials or API keys to prompt injection. If your security policy forbids agents from holding static tokens, Agyn's sidecar architecture and OpenZiti-powered mTLS identities solve this problem directly. Skip Agyn if you are an individual developer looking for a simple local CLI. This is an enterprise-grade, distributed runtime that requires an active Kubernetes cluster and service mesh infrastructure to function.

Methodology

This v0 review draws on the founder's published claims at https://github.com/agynio/platform and the team's February 2026 academic paper; independent benchmarks are pending. Update cadence: re-tested when claims diverge from observed behavior. Our analysis covers the platform's security model, its credential isolation mechanisms, and its integration with the Model Context Protocol (MCP). We do not cover independent performance, long-term workflow stability, resource overhead under heavy agent concurrency, or behavior with non-standard Kubernetes distributions. The SWE-bench Verified score of 72.2% cited by the founders is treated as a vendor claim until we run an independent evaluation on our own test harness.

What it does

Pre-built agent harnesses

Agyn ships with built-in support for Claude Code and Codex. Unlike Google's AX, which is model-agnostic but requires custom adapters for non-Gemini models, Agyn provides these runtimes out of the box. This allows teams to deploy existing developer agents directly onto shared infrastructure without writing custom integration glue.

Sidecar credential isolation

To prevent prompt injection attacks from leaking sensitive API keys, Agyn isolates Model Context Protocol (MCP) servers into their own sidecar containers. Each tool container holds its own credentials. The core container running the LLM orchestrator cannot read these secrets, ensuring that even if an agent is compromised via malicious prompt injection, it cannot exfiltrate the underlying API keys.

Zero-trust internal networking

For internal service access, Agyn eliminates static credentials entirely. When an agent is spawned, the runtime issues a dynamic x509 identity. Authentication to internal databases and microservices occurs during the mTLS handshake via OpenZiti. Because the LLM never holds a token, there is no static credential in memory for an attacker to extract.

What's interesting and what's not

The security architecture is a genuine improvement over standard agent runtimes. Most agent frameworks run tools in the same execution context as the LLM, or pass credentials as environment variables that are easily printed out via basic prompt injection. By separating the tool execution into sidecars and using mTLS handshakes via OpenZiti, Agyn addresses a major enterprise blocker for agent deployment. The transition from an autonomous AI engineering project to a generalized runtime platform shows a clear understanding of the infrastructure gap in AI engineering.

However, the operational complexity is high. Running Agyn requires a fully configured Kubernetes cluster, sidecar injection, and OpenZiti integration. For teams without dedicated platform engineers, setting up and maintaining this infrastructure is a massive hurdle compared to running agents locally or using managed SaaS alternatives. Furthermore, while the project claims to be production-ready, the actual performance overhead of running every single tool call through a sidecar container and an mTLS handshake remains unquantified. The founder's SWE-bench score, while impressive, was achieved under specific research conditions and does not guarantee similar efficiency when running arbitrary enterprise workflows.

Pricing

As of May 2026, Agyn is fully open-source and self-hosted under the AGPL-3.0 license. There are no commercial tiers or managed SaaS offerings listed on their repository, though enterprise support and managed control planes are planned for future release.

Verdict

Agyn is a highly specialized tool that solves a real security problem. If your organization is actively blocking the adoption of developer agents due to data exfiltration and prompt injection risks, Agyn provides the necessary isolation layers to make self-hosted agents viable. It is not a tool for hobbyists or small teams looking for quick setups. The operational tax of managing Kubernetes sidecars and OpenZiti handshakes is only worth paying if you have strict compliance requirements and a dedicated platform team to maintain the infrastructure.

What we'd test next

In our v2 review, we plan to deploy Agyn on an EKS cluster and measure the latency overhead introduced by the sidecar tool execution and mTLS handshakes. We will also design a suite of prompt injection attacks specifically targeting the isolated MCP servers to verify if credentials can indeed be kept safe when the orchestrator is fully compromised.

The investor read

Agyn highlights a critical shift in the AI tooling landscape: enterprise adoption of autonomous agents is bottlenecked by security, not model capability. While Google's AX targets generic agent orchestration, Agyn's focus on credential isolation and zero-trust networking addresses the exact compliance blockers that prevent financial and healthcare enterprises from deploying agents. The project's transition from an academic SWE-bench competitor (72.2% Verified) to an infrastructure platform indicates that the value in AI engineering is shifting from raw model performance to secure execution runtimes. For investors, Agyn is a strong signal that the next wave of venture-backed tooling will focus on the secure runtime and agent security posture management categories, making self-hosted, AGPL-licensed platforms like Agyn highly influential as reference architectures.

Pull quote: “Because the LLM never holds a token, there is no static credential in memory for an attacker to extract.”