The Nirmata bloghttps://nirmata.com/en-UShttps://nirmata.com/2026/10/27/how-to-find-mcp-servers-in-your-codebase-and-clusters/https://nirmata.com/2026/10/27/how-to-find-mcp-servers-in-your-codebase-and-clusters/Find MCP servers in repos with .mcp.json and claude mcp list, then in clusters by listing pods and images. Covers scopes, approvals and shadow servers.Tue, 27 Oct 2026 07:00:00 GMTAIRitesh Patelhttps://nirmata.com/2026/10/26/how-to-audit-mcp-tool-calls/https://nirmata.com/2026/10/26/how-to-audit-mcp-tool-calls/Audit MCP tool calls in Claude Code with OpenTelemetry tool events and OTEL_LOG_TOOL_DETAILS=1, plus hooks that record each server's source and denied calls.Mon, 26 Oct 2026 15:00:00 GMTAIRitesh Patelhttps://nirmata.com/2026/10/26/claude-code-managed-settings-for-enterprises/https://nirmata.com/2026/10/26/claude-code-managed-settings-for-enterprises/Claude Code managed settings sit above every developer file. Deploy managed-settings.json per OS or through MDM, check it with /status, then lock the rules.Mon, 26 Oct 2026 19:00:00 GMTAIRitesh Patelhttps://nirmata.com/2026/10/25/soc-2-controls-for-kubernetes-you-can-automate/https://nirmata.com/2026/10/25/soc-2-controls-for-kubernetes-you-can-automate/Kubernetes policy can automate SOC 2 checks on privileged pods, Secrets, RBAC, service account tokens and images. It can't cover access reviews or approvals.Sun, 25 Oct 2026 23:00:00 GMTKubernetesKyvernoRitesh Patelhttps://nirmata.com/2026/10/25/how-to-route-claude-code-through-an-ai-gateway/https://nirmata.com/2026/10/25/how-to-route-claude-code-through-an-ai-gateway/Point Claude Code at an AI gateway with ANTHROPIC_BASE_URL and a gateway credential, verify it with curl and /status, then roll it out with managed settings.Sun, 25 Oct 2026 19:00:00 GMTAIRitesh Patelhttps://nirmata.com/2026/10/25/how-to-control-mcp-servers-in-github-copilot/https://nirmata.com/2026/10/25/how-to-control-mcp-servers-in-github-copilot/Control MCP servers in GitHub Copilot with the MCP policy, registry-only mode, managed-settings allowlists and cloud agent settings. See where each one applies.Sun, 25 Oct 2026 15:00:00 GMTAIRitesh Patelhttps://nirmata.com/2026/10/24/which-pci-dss-requirements-can-kubernetes-policy-enforce/https://nirmata.com/2026/10/24/which-pci-dss-requirements-can-kubernetes-policy-enforce/Kubernetes policy enforces the PCI DSS v4.0.1 rules on privileged pods, secrets, RBAC and image sources. It can't enforce logging, anti-malware or scope.Sat, 24 Oct 2026 23:00:00 GMTKubernetesKyvernoRitesh Patelhttps://nirmata.com/2026/10/24/how-to-restrict-which-mcp-servers-claude-code-can-use/https://nirmata.com/2026/10/24/how-to-restrict-which-mcp-servers-claude-code-can-use/Restrict Claude Code MCP servers with managed-mcp.json, allowedMcpServers and deniedMcpServers. Learn the match rules, the deny-first order and the gaps.Sat, 24 Oct 2026 15:00:00 GMTAIRitesh Patelhttps://nirmata.com/2026/10/24/how-to-block-destructive-commands-in-claude-code/https://nirmata.com/2026/10/24/how-to-block-destructive-commands-in-claude-code/Block rm -rf and other destructive Claude Code commands with Bash deny rules, a PreToolUse hook and managed settings. Learn where each layer stops and fails.Sat, 24 Oct 2026 19:00:00 GMTAIRitesh Patelhttps://nirmata.com/2026/10/23/kyverno-1-19-2-security-release-26-advisories-fixed/https://nirmata.com/2026/10/23/kyverno-1-19-2-security-release-26-advisories-fixed/What the 26 advisories in Kyverno 1.19.2 mean for your clusters: tenant escapes to cluster admin, image verification bypasses, checks to run, how to upgrade.Fri, 23 Oct 2026 15:00:00 GMTKyvernoKubernetesJim Bugwadiahttps://nirmata.com/2026/10/22/who-controls-your-ai-agents-jim-bugwadia-on-policy-as-code/https://nirmata.com/2026/10/22/who-controls-your-ai-agents-jim-bugwadia-on-policy-as-code/Jim Bugwadia explains how to govern AI agents with policy as code: decouple rules from apps, enforce every LLM, MCP and agent call, and keep developers moving.Thu, 22 Oct 2026 17:00:00 GMTAIKyvernoRitesh Patelhttps://nirmata.com/2026/10/22/how-to-secure-vmware-vsphere-kubernetes-service-with-kyverno/https://nirmata.com/2026/10/22/how-to-secure-vmware-vsphere-kubernetes-service-with-kyverno/Secure VMware VKS clusters with Kyverno: enforce Pod Security Standards, RBAC and image signing at admission, deploy policies with Argo CD, scan for drift.Thu, 22 Oct 2026 18:00:00 GMTKyvernoKubernetesRitesh Patelhttps://nirmata.com/2026/10/22/how-razorpay-automates-rbi-compliance-on-kubernetes-with-kyverno/https://nirmata.com/2026/10/22/how-razorpay-automates-rbi-compliance-on-kubernetes-with-kyverno/Razorpay meets RBI Payment Aggregator rules on 7,000+ Kubernetes nodes with Kyverno policy as code: checks in CI, at admission and in scans, with live evidence.Thu, 22 Oct 2026 13:00:00 GMTKyvernoKubernetesRitesh Patelhttps://nirmata.com/2026/10/22/how-chase-uk-made-kubernetes-audit-ready-with-kyverno/https://nirmata.com/2026/10/22/how-chase-uk-made-kubernetes-audit-ready-with-kyverno/Chase UK replaced manual Kubernetes audits with Kyverno: 46 policies on 50 clusters, one Grafana compliance dashboard, under 20 ms admission latency.Thu, 22 Oct 2026 16:00:00 GMTKyvernoKubernetesRitesh Patelhttps://nirmata.com/2026/10/11/openshell-on-kubernetes-a-guide-for-platform-engineers/https://nirmata.com/2026/10/11/openshell-on-kubernetes-a-guide-for-platform-engineers/What OpenShell is AI agents do more than call APIs. They run shells, install packages, read files, and open network connections. Often they act on text they pulled from the internet a minute earlier. So every agent is untrusted code that holds real credentials. OpenShell, started by NVIDIA and now a CNCF Sandbox project, isSun, 11 Oct 2026 23:53:42 GMTKubernetesJim Bugwadiahttps://nirmata.com/2026/10/07/governance-beyond-the-admission-webhook/https://nirmata.com/2026/10/07/governance-beyond-the-admission-webhook/Kyverno hardens Kubernetes policy enforcement. Learn the 13 threats, migrate from legacy policies, and govern AI agents calling your APIs.Wed, 07 Oct 2026 12:24:57 GMTOtherAkhil Chandranhttps://nirmata.com/2026/10/06/nirmata-at-kubecon-cloudnativecon-north-america-2026/https://nirmata.com/2026/10/06/nirmata-at-kubecon-cloudnativecon-north-america-2026/Meet Nirmata at KubeCon North America 2026 in Salt Lake City. Explore Kyverno sessions, KyvernoCon, ContribFest, AI governance, and Booth 278.Tue, 06 Oct 2026 10:37:44 GMTOtherMegha Madhuhttps://nirmata.com/2026/09/19/kyverno-hardened/https://nirmata.com/2026/09/19/kyverno-hardened/To harden Kyverno, make its webhooks fail closed, enforce image verification, sign policy bundles and lock down policy RBAC. Start with the new hardening guide.Sat, 19 Sep 2026 19:37:00 GMTKyvernoRitesh Patelhttps://nirmata.com/2026/09/03/beyond-the-merge-enforcing-policy-before-the-terraform-apply/https://nirmata.com/2026/09/03/beyond-the-merge-enforcing-policy-before-the-terraform-apply/Run Terraform security scanning on the plan, not the live account. nctl checks 4 critical misconfigs in CI, with exceptions scoped to one resource.Thu, 03 Sep 2026 17:25:32 GMTOtherSachin Agarwalhttps://nirmata.com/2026/08/26/introducing-ottoflow-ai-workflows-for-kubernetes/https://nirmata.com/2026/08/26/introducing-ottoflow-ai-workflows-for-kubernetes/AI workflows for Kubernetes, without handing an agent your kubeconfig. OttoFlow makes a workflow a custom resource: typed DAG steps, AI only where it counts.Wed, 26 Aug 2026 18:34:15 GMTKubernetesKyvernoProductShreyas Mocherlahttps://nirmata.com/2026/08/24/kyverno-on-nutanix-closing-the-governance-gap-in-nutanix-kubernetes-platform-environments/https://nirmata.com/2026/08/24/kyverno-on-nutanix-closing-the-governance-gap-in-nutanix-kubernetes-platform-environments/Kyverno on Nutanix Kubernetes Platform is now certified. Install Nirmata Enterprise for Kyverno from the NKP Partner Catalog, no separate pipeline.Mon, 24 Aug 2026 18:04:51 GMTOtherSachin Agarwalhttps://nirmata.com/2026/08/18/okta-cross-app-access-xaa-id-jag/https://nirmata.com/2026/08/18/okta-cross-app-access-xaa-id-jag/AIControls now performs the ID-JAG token exchanges on your agents' behalf — so agents need no protocol code — and policy-checks, budgets, and attributes every delegated MCP and LLM call to the human it acts for. ID-JAG answers may this agent act for this user? AIControls answers what did it actually do? TL;DR Cross App Access (XAA) isWed, 19 Aug 2026 00:24:40 GMTAIEngineeringRitesh Patelhttps://nirmata.com/2026/08/16/introducing-nirmata-runtime-for-kyverno-kernel-level-enforcement-for-ai-workloads/https://nirmata.com/2026/08/16/introducing-nirmata-runtime-for-kyverno-kernel-level-enforcement-for-ai-workloads/Nirmata created Kyverno and donated it to the CNCF in 2020. Kyverno is now a graduated CNCF project and is widely used for enforcing and automating configuration security and best practices. However, admission control answers one question: does this spec look right? It cannot answer the question that matters once the pod is running:Mon, 17 Aug 2026 01:27:43 GMTAIKubernetesKyvernoProductJim Bugwadiahttps://nirmata.com/2026/08/14/introducing-the-remediator-agent-turning-kyverno-policy-violations-into-pull-requests-automatically/https://nirmata.com/2026/08/14/introducing-the-remediator-agent-turning-kyverno-policy-violations-into-pull-requests-automatically/Kyverno detects Kubernetes policy violations. Nirmata’s Remediator Agent turns them into reviewed pull requests within your existing GitOps workflow.Fri, 14 Aug 2026 11:29:37 GMTOtherAkhil Chandranhttps://nirmata.com/2026/08/12/how-nirmata-saved-40-in-kuberbnetes-cloud-cost/https://nirmata.com/2026/08/12/how-nirmata-saved-40-in-kuberbnetes-cloud-cost/Nirmata’s Cloud Agents Audited a 40-Cluster Kubernetes Fleet, and recovered 40% of the CostWed, 12 Aug 2026 20:52:35 GMTAIKubernetesKyvernoAnubhav Sharmahttps://nirmata.com/2026/08/04/ai-innovation-security-paradox/https://nirmata.com/2026/08/04/ai-innovation-security-paradox/Nirmata's AI Controls provides real-time governance, policy enforcement and risk management, bridging the gap between engineering and security leaders.Wed, 05 Aug 2026 01:56:41 GMTEngineeringKubernetesKyvernoAnubhav Sharmahttps://nirmata.com/2026/08/02/the-ai-gateway-buyers-guide/https://nirmata.com/2026/08/02/the-ai-gateway-buyers-guide/Over the past year, nearly every engineering org I talk to has reached the same milestone: AI agents are no longer a demo. They're calling real tools, against real systems, with real consequences. And nearly every one of those orgs has reached for the same first fix — an AI gateway. That instinct is right.Sun, 02 Aug 2026 16:58:40 GMTAIEngineeringKubernetesRitesh Patelhttps://nirmata.com/2026/07/28/critical-kyverno-vulnerability-cve-2026-54523/https://nirmata.com/2026/07/28/critical-kyverno-vulnerability-cve-2026-54523/CVE-2026-54523 (CVSS 9.6) lets a Kyverno NamespacedMutatingPolicy create resources in any namespace. Kyverno 1.18.0 and 1.18.1 are affected; upgrade to 1.18.2.Wed, 29 Jul 2026 01:08:41 GMTEngineeringKubernetesKyvernoAnubhav Sharmahttps://nirmata.com/2026/07/26/kyverno-policy-migration-to-cel-based-policies/https://nirmata.com/2026/07/26/kyverno-policy-migration-to-cel-based-policies/Quick question: the last time a Kyverno policy rejected a resource, did the error actually tell you why — or did you spend twenty minutes squinting at a pattern block trying to reverse-engineer your own rule? If you've been running Kyverno for a while, you already know the answer. And you're not alone — Tips and Action to migrate Kyverno policies to CEL-based policies.Mon, 27 Jul 2026 06:15:09 GMTAIKubernetesKyvernoAnubhav Sharmahttps://nirmata.com/2026/07/25/zero-trust-has-a-blind-spot/https://nirmata.com/2026/07/25/zero-trust-has-a-blind-spot/Last week, two frontier AI models escalated privileges inside a sanctioned test environment, moved laterally until they found a node with internet access, and reached another company's infrastructure. Every step was taken by a legitimate, identified workload. Valid credentials. Approved environment. Assigned goal. The models simply went to extreme lengths to achieve it. Classical securitySun, 26 Jul 2026 01:15:35 GMTAIRitesh Patelhttps://nirmata.com/2026/07/12/before-you-deploy-aicontrols/https://nirmata.com/2026/07/12/before-you-deploy-aicontrols/An AI governance strategy is a portfolio, not a purchase. No AI governance tool covers everything today, including this one. Governing models, developers, autonomous agents, and the tool-call protocol those agents use are different technical problems, with different buyers and different urgency — which means a real strategy runs two to three tools, not one.Mon, 13 Jul 2026 06:05:52 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/07/05/govern-the-request/https://nirmata.com/2026/07/05/govern-the-request/What we heard from teams already using AI gateways — and what it still didn't answer. Talking to platform and engineering teams putting AI into production, we kept hearing the same three questions — and the AI gateways they'd looked at answered none of them: Who just made that call — which developer, which team,Mon, 06 Jul 2026 04:35:45 GMTAIEngineeringRitesh Patelhttps://nirmata.com/2026/07/01/introducing-aicontrols-from-nirmata/https://nirmata.com/2026/07/01/introducing-aicontrols-from-nirmata/AIControls is a new product from Nirmata that provides complete visibility and controls on every AI call -- built using the powerful and flexible Kyverno policy engine that secures Kubernetes clusters around the world. Welcome to the loop Look around. The global digital landscape isn’t just expanding; it’s exploding. Autonomous, non-deterministic intelligences are being wiredThu, 02 Jul 2026 04:40:17 GMTAIBusinessKyvernoJim Bugwadiahttps://nirmata.com/2026/06/18/the-gate-thats-missing-from-every-ai-governance-stack/https://nirmata.com/2026/06/18/the-gate-thats-missing-from-every-ai-governance-stack/This is the third in a three-part series on the AI Governance market. Part 1: Understanding AI Governance: A Market Map. Part 2: The Cloud Security Playbook for AI Governance. Across the first two posts in this series, we mapped the AI governance market into three distinct problems and traced the consolidation arc from cloudThu, 18 Jun 2026 17:47:48 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/06/16/playbook-for-ai-governance/https://nirmata.com/2026/06/16/playbook-for-ai-governance/This is the second in a three-part series on the AI Governance market. Part 1: Understanding AI Governance: A Market Map. Part 3: We Built the Enforcement Layer. Here's Why. Every major computing shift produces the same governance crisis. Cloud was no different. Neither is AI. A new computing paradigm arrives faster than security andTue, 16 Jun 2026 07:00:18 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/06/16/nirmata-collaborates-with-broadcom-to-deliver-enterprise-kubernetes-governance-for-vmware-cloud-foundation/https://nirmata.com/2026/06/16/nirmata-collaborates-with-broadcom-to-deliver-enterprise-kubernetes-governance-for-vmware-cloud-foundation/Organizations are rapidly adopting Kubernetes to modernize applications and accelerate software delivery. Yet as Kubernetes deployments grow, maintaining consistent security, compliance, and operational governance across clusters becomes increasingly challenging. Today, we're excited to announce that Nirmata is working with Broadcom to bring enterprise-grade policy governance and compliance automation to VMware Cloud Foundation (VCF) environments throughWed, 17 Jun 2026 00:12:11 GMTBusinessKubernetesKyvernoDolis Sharmahttps://nirmata.com/2026/06/15/kyverno-policy-benchmarks/https://nirmata.com/2026/06/15/kyverno-policy-benchmarks/We benchmarked our own tool against two general-purpose AI agents on Kyverno policy tasks. Here's what we found, including the parts that complicate the story. We build nctl, a CLI-based controller for Nirmata and policy as code powered by Kyverno. That means we have an obvious stake in what follows. Here's what we did aboutMon, 15 Jun 2026 11:05:45 GMTKubernetesKyvernoShreyas Mocherlahttps://nirmata.com/2026/06/14/understanding-ai-governance/https://nirmata.com/2026/06/14/understanding-ai-governance/We've spent the last several months talking to CISOs, VPs of Engineering, and Chief AI Officers at enterprises across financial services, healthcare, and technology. Every one of them is thinking about AI governance. Almost none of them are thinking about the same problem. The VP of Engineering wants to know why AI spend doubledSun, 14 Jun 2026 17:30:51 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/06/04/tokenomics-from-tokenmaxxing-to-valuemaxxing/https://nirmata.com/2026/06/04/tokenomics-from-tokenmaxxing-to-valuemaxxing/Uber burned through its entire 2026 AI budget in four months. An AI consultant's client spent $500 million in a single month because no one set usage limits on Claude licenses. Microsoft — which has P&L on both sides of the AI tooling trade — is cutting its own Claude Code subscriptions. These aren't outliers.Thu, 04 Jun 2026 14:25:07 GMTAIBusinessEngineeringRitesh Patelhttps://nirmata.com/2026/05/31/your-ai-stack-problem/https://nirmata.com/2026/05/31/your-ai-stack-problem/Every CISO and VP of Engineering we talk to is wrestling with the same three pressures right now: Move faster with AI. Your business stakeholders want outcomes yesterday. Developers are shipping with Copilot, Claude Code, and a dozen other AI tools. Agents are running in production. The pressure to show ROI is real and escalating.Mon, 01 Jun 2026 04:29:41 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/05/19/the-ai-governance-market-is-here-most-of-the-problem-remains-unsolved/https://nirmata.com/2026/05/19/the-ai-governance-market-is-here-most-of-the-problem-remains-unsolved/Recently, Palo Alto Networks announced its intent to acquire Portkey — an AI Gateway processing trillions of tokens per month — to become the routing and visibility layer inside Prisma AIRS. We think this is great news. Not just for Portkey. For the entire category. Validation at the Highest Level When a $100B+ security platformWed, 20 May 2026 03:47:33 GMTAIOtherRitesh Patelhttps://nirmata.com/2026/05/04/ai-governance-has-no-owner/https://nirmata.com/2026/05/04/ai-governance-has-no-owner/Ask ten enterprises who owns AI governance and you’ll get ten different answers. We’ve had this conversation across financial services, healthcare, retail, energy, and technology companies over the past several months. The pattern is consistent: everyone agrees that AI governance matters. Nobody agrees on who owns it. And in most enterprises, the honest answer isTue, 05 May 2026 05:50:12 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/04/26/the-ai-governance-journey/https://nirmata.com/2026/04/26/the-ai-governance-journey/Most enterprises we talk to are in the same place right now. AI agents are running in development environments. Developers are using Claude Code, Copilot, and Cursor daily. Business units are asking when everything can go to production. And security teams are asking a different question entirely: How do we do this safely? It’s theMon, 27 Apr 2026 05:12:43 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/04/23/your-developers-are-using-ai-your-governance-layer-isnt/https://nirmata.com/2026/04/23/your-developers-are-using-ai-your-governance-layer-isnt/Your developers are already using AI. Claude Code. GitHub Copilot. Cursor. A dozen other tools running in the background while they work. The productivity gains are real. Developers ship faster. Code review cycles shrink. Repetitive tasks disappear. And nobody in your organization has meaningful visibility into any of it. Last week we wrote about theThu, 23 Apr 2026 07:01:55 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/04/21/the-ai-vulnerability-watershed-what-mythos-means-for-open-source-and-kyverno/https://nirmata.com/2026/04/21/the-ai-vulnerability-watershed-what-mythos-means-for-open-source-and-kyverno/On April 7, 2026, Anthropic announced Claude Mythos Preview and Project Glasswing — and the open source security landscape changed permanently. Here is what it means for Kyverno, and what we are doing about it. Something shifted recently. Anthropic revealed that its new Claude Mythos Preview model had autonomously found tens of thousands of zero-dayTue, 21 Apr 2026 19:52:59 GMTAIBusinessKyvernoNirmata Teamhttps://nirmata.com/2026/04/19/good-ai-agent-governance/https://nirmata.com/2026/04/19/good-ai-agent-governance/Picture this. An AI agent with read access to your customer database. Deployed six months ago by a developer who has since moved to another team. Running quietly in the background, making hundreds of API calls a day. Nobody remembers exactly what it’s allowed to do. Nobody has a record of who approved its permissions.Mon, 20 Apr 2026 06:29:46 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/04/14/the-ai-governance-gap/https://nirmata.com/2026/04/14/the-ai-governance-gap/We’ve been here before. Not with AI specifically. But with the pattern — the way powerful new technology lands in the enterprise, gets adopted bottom-up faster than anyone planned for, and creates a governance crisis that takes years to clean up. We watched it happen with cloud. Then again with Kubernetes. Now we’re watching itWed, 15 Apr 2026 02:01:38 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/04/12/ide-native-ai-governance/https://nirmata.com/2026/04/12/ide-native-ai-governance/For years, the industry mantra has been simple: shift security left. Catch issues earlier in CI/CD. Add more scanners. Add more gates. But here’s the reality most teams run into: by the time developers see a policy violation, they’re already outside their flow. They’re switching contexts—reading logs, parsing CI failures, or digging through dashboards. AndSun, 12 Apr 2026 17:19:10 GMTOtherWarran Changhttps://nirmata.com/2026/04/12/cisos-have-a-prevention-problem/https://nirmata.com/2026/04/12/cisos-have-a-prevention-problem/The security industry has spent a decade building better cameras. Wiz. Orca Security. Prisma Cloud. Exceptional tools. World-class at finding problems after they exist — scanning your environment, surfacing misconfigurations, alerting on threats. The Gartner-defined CNAPP category raised billions of dollars on a simple promise: visibility IS security. It was never wrong. It was justSun, 12 Apr 2026 17:28:34 GMTAIBusinessRitesh Patelhttps://nirmata.com/2026/04/10/policy-as-code-ai-governance-a-milestone-moment-nirmata-at-kubecon-europe-2026/https://nirmata.com/2026/04/10/policy-as-code-ai-governance-a-milestone-moment-nirmata-at-kubecon-europe-2026/KubeCon Europe 2026 in Amsterdam made something unmistakably clear. Policy as code is no longer emerging. It is becoming foundational. Across keynote stages, breakout sessions, and co-located events, the industry is converging on a new reality. Infrastructure is no longer static, and increasingly, it is no longer human-authored. AI is accelerating how systems are built,Fri, 10 Apr 2026 13:57:13 GMTEventsKubernetesKyvernoNewsOtherCortney Nickerson