Telemetry collectors, AI coding agents, and eBPF security agents — versioned config, feature-flag rollouts, drift detection and an audit trail for every one of them.
# Point the supervisor at your channel
export OPAMP_SERVER=wss://acme.ampbase.io/channels/observability-prod/v1/opamp
# Start the universal supervisor
ampbase run
Ampbase manages the long-running agents on your computers. What they do differs completely. What it takes to change their config safely does not.
Every one of these agents can take something down when its config is wrong. Ampbase puts the same machinery in front of all three: a diff, a canary weight, a drift check, a rollback, and an audit trail.
Versioned immutable config. Feature-flag targeting with canary weights. Drift detection on every host. One-click rollback. An event-sourced audit trail of what was deployed where, and when.
Deploying a policy that can kill a process takes a type-to-confirm and a staged rollout. Admins can override for incident response; every override is audited by name.
Everything you need to run a mixed agent fleet with confidence
Route different configs to different agent subsets using feature flags and targeting rules.
Push config changes to thousands of agents in seconds. See health status for every agent.
Track agent health, config drift, and deployment status with built-in analytics.
Analyzers watch your fleet — flagging cost, waste and policy hygiene, and proposing config changes you can apply with one click.
Ampbase sees configuration and counts. Never your data, your code, or your security events.
user_id has grown to 47k distinct values across 12 collectors since the v2.4 deploy — 63% of series volume on this pipeline.
# current pipeline processors: batch: timeout: 5s + transform/cardinality: + metric_statements: + - set(attributes["user_id"], + SHA256(attributes["user_id"])) # exporters unchanged rev 01JQK7… · canary 10% · 12 collectors
The supervisor reduces over 100% of frames to HLL sketches, masked log templates and RED rollups. Raw values, log bodies and span attributes never leave the host.
Every recommendation ships an evidence packet — the window it covers, the hosts it saw, and the gaps it could not close. Rule-based analyzers, stated as such.
Accepting a finding writes an ordinary config version: diffed, flag-targeted, canaried and reversible like every other change on this page.
Field-level scrubbing runs in the supervisor on the workstation. Prompt text, command output and diffs are dropped before anything is forwarded — a JSONL audit log stays on the device.
Redaction and forwarding policy is ordinary OpAMP config: ULID-versioned, event-sourced, with diff view, rollback on failed apply, drift detection and flag-driven canary rollout.
curl -fsSL get.ampbase.io | sh then ampbase enroll — wires each runtime to the loopback gateway. MDM drift shows in the dashboard and reapplies in one click.
This policy can SIGKILL matching processes on 12 hosts. Type ENFORCE to stage it at 10%.
Shown when you confirm an enforcing version: what its observe-only variant saw, so arming it is a decision with evidence behind it. Counts and cardinality estimates only — Ampbase never receives the events behind them.
Evidence informs the decision; it does not gate it. And a measured zero is not the same sentence as no evidence at all — the panel says which one it means.
A policy that cannot be classified is treated as enforcing, never degraded to observe. Unknown constructs fail toward the gate rather than past it.
A successful apply means the kernel accepted the policy — verified over Tetragon’s own gRPC enumeration after the apply, whichever path it took — never a file that was written.
The same supervisor manages your security agent and the log shipper that moves its events off the host. Raw events go to your SIEM, not to us.
Join the early access waitlist — collectors, coding agents and security policy, managed from one place. One binary per host, config in minutes.