BUILDING The first AI infrastructure-as-code platform with a built-in control plane →

AI infrastructure as code. One control plane to run it.

Declare models, memory, tools, agents, pipelines and entire agent fleets in one spec. Plan, apply and govern them from the CLI or the console with policy gates on every change.with evals that block regressions.with budgets on every token.with secrets that never touch config.with drift caught on every host.

Get early access → Explore the console
CLI for engineers Console for teams Git as the source of truth
Policy 6/6 · evals passed
faithfulness 0.91 ≥ 0.85
$
+$4.20/day · within budget
primary-llm · $1,840 / $2,500
3 secrets from Vault
0 values in plan, logs or state
🔒 console.cloudemon.io/acme/production
// integrations

Plugs into the stack
you already run.

Models, clouds, vector stores, agent runtimes and the tools around them — each behind one adapter interface, all managed from one spec.

cloudemon
One adapter interface for every provider Plugin API for custom providers Running something else? Tell us →
// how it works

Terraform semantics.
Built for the AI stack.

Cloudemon reads one spec, diffs it against everything that's actually running - model endpoints, vector stores, agent runtimes, laptops - gates on policy, evals and budgets, then changes only what it must.

// the console · interactive

Everything you declared.
Live, in one place.

The same engine as the CLI, with a UI for the whole team. Click around - explore the stack graph, approve a plan, inject drift, rerun evals, or hit ⌘ K.

YO
Every console edit opens a pull request Same plan engine as the CLI Role-based approvals per environment
// architecture

Three ways in.
One reconcile path.

The CLI, the console and your CI all drive the same deterministic engine. Click any stage to see what it does.

cloudemon engine
plan = zero writes any gate fails = zero writes atomic per resource apply twice → empty plan append-only audit
// resource kinds

Build it. Govern it.
Same spec, same workflow.

One apiVersion / kind / metadata / spec envelope covers the AI resources you build and the agents and environments you govern. Adapters translate each into the provider's native shape.

// policy-as-code · try it

Guardrails that run
before a single write.

Built-in OPA policies plus any .rego you add - enforced on every plan, from the CLI, CI or the console. Flip the spec and watch the check react.

Agent sandboxspec.sandbox.mode
Modelspec.model_id
Slack bot tokenchannels[0]
Monthly budgetcost_limits.max_monthly_usd
$ cloudemon policy check --env production

          

          

        

      

    

  


  


  
  

    


      

        

          
// gitops from the UI

          
Click in the console.
Ship through Git.

          
Not everyone lives in YAML. The console lets anyone propose a change - and turns it
            into a reviewed, tested, revertible pull request.

          

            

              

                  
                  
                  
                

              

                
No click-ops drift

                
UI edits become commits. The repo never falls behind what's running.

              

            

            

              

                  
                  
                

              

                
Same gates, every path

                
Policy, evals and budget checks run identically for CLI, CI and console
                  changes.

              

            

            

              

                  
                  
                

              

                
One-click rollback

                
Every apply is a revision. Revert from the console or
                  cloudemon rollback.

              

            

          

        


        

          
console · models / primary-llmediting

          

            

              
1 · change in the console

              
model_id
                
claude-sonnet-4-5claude-sonnet-4-6▾

              

            

            
commit to branch console/primary-llm-sonnet-46

            

              
models/primary-llm.yaml

              
  provider: anthropic

              
- model_id: claude-sonnet-4-5

              
+ model_id: claude-sonnet-4-6

              
  cost_limits: { max_monthly_usd: 2500 }

            

            
pull request opened

            

              
              

                #129 Upgrade primary-llm to Sonnet 4.6
                
opened from console by you · plan: 3 to change

                

                  plan
                  policy 6/6
                  evals 0.91
                  cost +$4.20/d
                

              

            

          

        

      


      

        

          
// secrets

          
Secrets never touch
the plan.

          
Specs hold pointers, not values. API keys and bot tokens stop living in plain-text
            config files on gateways and laptops.

          

            

              

                  
                  
                

              

                
References, not values

                
SecretReference points at Vault, AWS Secrets Manager, env or
                  file backends.

              

            

            

              

                  
                  
                

              

                
Resolved just-in-time, then zeroed

                
Values are fetched at apply, injected by the adapter, and wiped from memory
                  afterwards.

              

            

            

              

                  
                  
                

              

                
Redacted everywhere

                
Plan output, logs, errors, state and the console never show a secret value.
                

              

            

          

        


        

          
secrets/slack-support.yamlbackend: vault
          

          
apiVersion: cloudemon.io/v1alpha1
kind: SecretReference
metadata: { name: slack-support, namespace: production }
spec:
  backend: vault
  vault:
    path: secret/data/acme/slack-support
    keys: { bot-token: slack_bot_token }

          

            

              
plan outputSLACK_BOT_TOKEN = ‹ref
                  slack-support›

              
apply →

              
gateway config"botToken": "xoxb-••••••"

            

            
    
              
  • plan output · clean
    • 
              
  • log lines · clean
    • 
              
  • console views · clean
    • 
              
  • state store · clean
    • 
            

          

        

      


    

  


  
  

    

      

        
// why cloudemon

        
Your AI stack is infrastructure.
Treat it that
            way.

        
General-purpose IaC doesn't understand models, evals, token budgets or agents.
          Cloudemon does - and keeps governing them after deploy.

      


      

        

          
Today

          
    
            
  • Terraform for cloud, scripts and consoles for everything AI
    • 
            
  • Agent configs hand-edited on every gateway and laptop
    • 
            
  • API keys and bot tokens in plain-text config files
    • 
            
  • Evals run by hand - if at all - before a deploy
    • 
            
  • Token spend discovered when the invoice lands
    • 
            
  • Dev, staging and prod silently drift apart
    • 
            
  • No record of who changed which prompt, model or tool
    • 
          

        

        

          

          

            
With Cloudemon
          

          
    
            
  • One spec for models, memory, agents, pipelines and fleets
    • 
            
  • Plan before apply - in the CLI, a PR or the console
    • 
            
  • SecretReferences resolved at apply, never stored
    • 
            
  • Eval gates block quality regressions automatically
    • 
            
  • Budgets and alerts on every model and agent
    • 
            
  • Drift detected and reconciled continuously
    • 
            
  • Revisions, one-click rollback and an append-only audit log
    • 
          

        

      

    

  


  


  
  

    

      

        

          
// the vision

          
Define. Govern.
Operate.

        

        
Cloudemon is built as one platform for the full lifecycle of AI infrastructure - not
          another point tool you have to glue together.

      


      

        

          

            

                
              

            01
          

          
Define as code

          
Every AI resource in one declarative spec - versioned, reviewed and reproducible across clouds and
            environments.

          
    
            
  • Models with fallbacks, pins and cost caps
    • 
            
  • Memory, tools, MCP servers and agents
    • 
            
  • Pipelines, eval suites and serving endpoints
    • 
          

          
ModelMemoryStoreAgentPipelineEndpoint

        


        

          

            

                
                
              

            02
          

          
Govern by default

          
A control plane that enforces how AI is used - for the agents you deploy and the ones your engineers run
            every day.

          
    
            
  • Policy-as-code, approvals and model allowlists
    • 
            
  • Secrets by reference, never by value
    • 
            
  • Fleet config for gateways and developer tools
    • 
          

          
OpenClawClaude CodePolicySecretReference

        


        

          

            

                
                
              

            03
          

          
Operate continuously

          
Day-2 doesn't stop at deploy. The control plane watches every resource and host, and the console puts it
            in front of the whole team.

          
    
            
  • Drift detection and auto-remediation
    • 
            
  • Spend, quality and health in one view
    • 
            
  • Revisions, rollback and a full audit trail
    • 
          

          
consoleevalsbudgetsaudit

        

      


      

        
OpenClawClaude Code

        
Where we're starting: agent fleets - OpenClaw gateways and Claude Code across engineering - where
          config drift and secret sprawl hurt the most today. The same engine then extends to models, memory, pipelines
          and serving.

        Shape what's next →
      

    

  


  
  

    

      

        

        

          

            
// reach out

            
Building AI
in production?

            
We're partnering with a small group of teams to shape Cloudemon - whether you run
              agent fleets, model infrastructure, or both. Tell us about your stack; we reply within a day.


            
    
              
  • 
                
    
                    
                  
    
                
    Early accessRun cloudemon plan and the console against your own
                    stack first.
    
              
    • 
              
  • 
                
    
                    
                  
    
                
    Direct line to the buildersA shared channel with the engineers building it.
                
    
              
    • 
              
  • 
                
    
                    
                  
    
                
    Shape the roadmapYour providers, runtimes and policies get prioritised.
    
              
    • 
            


            

              
                
                  
                  
                
                
Email

              
              
                
                
Discordjoin the community

              
              
                
                  
                
                
X / Twitterfollow the build

              
              
                
                
GitHubwatch the repo

              
            

          


          

            
$ cloudemon contact --newreplies in <24h


            

              

                
                
              

              

                
                
              

            


            

              

                
                
              

              

                
                
              

            


            

              What are you interested in?
              

                
                
                
                
                
                
              

            


            

              
              
            


            

              No spam. We only use this to reply.
              
            


            

              

                  
                

              
Message drafted ✓

              
Your email client should have opened with everything filled in - hit send and we'll be in touch.