What the agent can touch, and what it cannot
Before installing anything in production, a security team wants one answer: which permissions it asks for and what it can do with them.
Discovery Agent and Node Agent are read-only against the Kubernetes API. The Scaling Rules Agent can adjust HPA and replicas, ships disabled and acts on a condition. There is no automatic remediation. All 16 MCP tools are read-only.
The three agents, and what each one is allowed to do
Discovery Agent: read-only against the Kubernetes API, always on. Node Agent: read-only, plus node privileges, always on. Scaling Rules Agent: can adjust HPA and replica counts, optional and ships disabled.
That is the complete list. There is no fourth agent, and no mode that widens permissions without being enabled by hand.
The uncomfortable part: eBPF needs node privileges
We do not say Moonin is read-only and leave it there, because a security team will ask anyway. Loading eBPF programs into the kernel requires elevated privileges on the node, and the Node Agent asks for them.
What matters is what those programs do: they observe traffic and calls, they do not modify them, they inject nothing into your processes and they do not write to the node filesystem. Classic instrumentation is the opposite: it asks for no node privileges, but it does go inside your application.
What Moonin does not do, by design
There is no automatic remediation: Moonin does not restart pods, does not roll back deployments and does not run commands on your nodes. It diagnoses; the action is yours.
It does not touch your pipelines: installation is a Helm chart in the cluster, and your CI and repositories stay out of scope. It does not operate ArgoCD: it reads the argocd.argoproj.io/instance label to attribute resources, it does not trigger syncs or modify manifests. And it does not enter your code: no SDK, no libraries, no sidecars.
The only possible mutation is the Scaling Rules Agent adjusting HPA and replicas, which ships disabled, is enabled by hand, and acts only when a condition you wrote is met.
All 16 MCP tools are read-only, and access comes from your identity provider
Moonin exposes 16 MCP tools so an AI assistant can query cluster state. All sixteen are queries, and the database session serving them is opened in read mode, so an assistant cannot write even if asked to. That is a session constraint, not a promise in a prompt.
Enterprise SSO with Google, Azure AD and Firebase, with organisations and role-based access control. Platform access is governed from your identity provider, not from a separate user list.
What we do not have yet
We do not hold SOC 2 or ISO 27001 certification. We are a new company and certifying takes time and money that today go into the product. We say it here rather than hoping you will not ask: if your procurement process requires either one, we do not qualify today, and we would rather you knew before spending time on an evaluation.