Telemetry collectors · AI coding agents · eBPF security agents

A config push is a deploy.
Treat it like one.

Ampbase is the OpAMP control plane for the long-running agents in your fleet. Every config is versioned, every deploy can be staged and judged on what the agents report, and every change is on the audit trail.

Start free trial Read the Docs
# Point the supervisor at your channel
export OPAMP_SERVER=wss://acme.ampbase.io/channels/observability-prod/v1/opamp

# Start the universal supervisor
ampbase run
Rollouts

Deploy this version.

You choose the plan. Ampbase runs the rollout, judges every stage on what the agents report, and rolls it back before you have read the alert.

What a bad config does
Guarding againstA bad collector config drops your data, or triples your bill.
Coding agents deploy directly. A deploy reaches every enrolled workstation at once, so this is four steps.
Stage 01

Plan

10, 50, 100, or by a label such as env. A preview shows what each stage reaches.

Preview · 1,100 eligible agents
10~110 expected
50~550 expected
1001,100
or by label · env=staging, then env=prod
Stage 02

Stage

A stable slice of the fleet takes it; the rest stay on the previous version. An agent’s stage is a hash of its ID, so nobody flips back and forth as the rollout widens.

this version · ~110previous version · ~990
Stage 03

Judge

Once a minute, every agent in the stage lands in one of five buckets. The stage holds through a 30-minute soak, and the verdict is a sentence.

Applied Pending Rejected Degraded Unknown
soak18:00 / 30:00
This stage has soaked for 18m of 30m; it can’t go green before the soak elapses, and its tripwires are read throughout.
Stage 04

Tripwire

A rejection, a degraded agent, or drift rolls it back, or pauses for you. Each fires on the first agent it counts unless you set it otherwise; a metric regression tripwire is yours to add.

apply rejectionsdegraded agentsconfiguration driftmetric regression · optional
3 of 110 agents in this stage rejected this version; the Apply rejections tripwire allows at most 0. Rolling the rollout back.
Stage 05

Promote

The last stage goes green and every rule the rollout moved serves the new version.

Stage 3 of 3 green · every rule the rollout moved serves this version
Stage 06

Record

Who started it, every advance and override with its reason, on the audit trail and a webhook.

started
by you
advanced
stage 1 to stage 2
override
advanced past a red stage · with a reason
webhook
started, advanced, gate failed, rolled back, promoted
Step 01

Version

Every coding-agent policy is a version you can compare and return to.

Step 02

Diff

See what changes against the version the workstations run now.

Step 03

Deploy to every enrolled workstation at once

One deploy reaches every workstation that joined with ampbase enroll.

Step 04

Drift visible after

A workstation whose policy no longer matches the deployed version shows as drifted.

No news is not evidence. A silent agent counts against the stage, never for it.
Agent classes

Agents old and new. One control plane.

Ampbase manages every long-running agent in your fleet — from the OG collectors to the AI kind. What they do differs completely. What it takes to change their config safely does not.

Telemetry agents observability-prod
OTel Collector Vector Fluent Bit Telegraf Refinery
Runs onServers, containers, edge
Config isA pipeline
Bad configDrops data, triples the bill
We also give youCost & cardinality intelligence
Pipeline config
versioned per channel
Coding agents coding-agents-default
Claude Code Codex CLI Cursor
Runs onDeveloper workstations, CI
Config isA redaction & forwarding policy
Bad configLeaks prompts, diffs, source
We also give youSpend, adoption & governance
Never seesPrompts, code, diffs, output. Redaction runs on the device
Redaction policy
tiered, device-local
Security agents security-vms
Tetragon (eBPF)
Runs onLinux servers, VMs, bare metal
Config isA kernel enforcement policy
Bad configKills processes fleet-wide
We also give youPolicy hygiene (coming)
Never seesRaw security events. Not a SIEM, not EDR
Enforcement policy
observe-only floor
MASTER BUS
One rollout model
versioned rule-routed staged drift-checked reversible audited
OpAMP

OpAMP for agents that don’t speak it.

OpAMP is the Open Agent Management Protocol, the OpenTelemetry standard for managing agents remotely: the agent reports what it is running and its health, the server offers a config, the agent says whether it applied. A standard means your agents are not locked to our server.

The OTel Collector speaks OpAMP natively. Fluent Bit, Vector, Telegraf, Tetragon and Claude Code do not. The ampbase supervisor is the adapter: one binary per host that speaks OpAMP upward and each agent’s own language downward. The fleet products built on OpAMP today manage collectors only.

Has OpAMP built in
OTel Collector
Gets it from the supervisor
Fluent Bit Vector Telegraf Refinery Tetragon Claude Code Codex CLI Cursor
curl -fsSL get.ampbase.io | sh

Ready to bring your whole fleet under one control plane?

Collectors, coding agents and security policy, managed from one place. 14-day free trial, full access, no credit card. One binary per host, config in minutes.