ROADMAP

From runtime beta
to hosted control plane.

Every milestone should make Kavrynt easier to test, explain, and trust.

01 · NOW

Secure runtime public beta

MCPServer resources with tool discovery and clear diagnostics, Gateway routing with OAuth 2.1 agent authentication on by default, Rego tool policy that can use each tool's behavior hints, tamper-evident audit events, credentials and token exchange for MCP servers, one token for a group of routes (the Gateway audience), endpoint scope per namespace, a request size limit on every MCP route, MCP session affinity, and a tested high-availability profile. Operations built in: a web console with sign-in through your identity provider, alerts, and 24-hour dashboards, kavryctl doctor to check an installation, kavryctl export and import to rebuild a cluster, alert notifications to Slack, email, Teams, and webhooks, and Grafana dashboards. Signed multi-architecture images and one Helm chart.

1.0.0-BETA.5
02 · NEXT

More control

Approvals for sensitive tool calls, endpoint scope that follows Services in a team's own namespace, and more installation checks in kavryctl doctor (policy, audit, and NetworkPolicy settings).

PLANNED
03 · THEN

Kavrynt Cloud preview

Hosted control plane: sign in with your identity provider, connect clusters, and see inventory, MCP traffic, and audit across them.

PLANNED
04 · LATER

Governance

Central policy across clusters, durable audit history, and enterprise integrations.

VISION