Everything ships included

Catalog, search, docs, governance and Kubernetes visibility ship together. Wire up your integrations once, with no plugins to maintain after.

operations 01 / 13

fig.1 — thirteen surfaces, every one populated by discovery. Select a thumbnail, or open any shot full size.

What's in the box

Three jobs, one service. Nothing here is a plugin you have to keep alive.

01See your stack clearly

Service catalog

Auto-discovered from repos, clusters and catalog-info.yaml

Meilisearch-powered search

Hybrid BM25 and vector search across services, docs and APIs in under 200 ms

Kubernetes discovery

Lightweight in-cluster push agents with no inbound cluster access required

Cloud discovery

UpCloud resources auto-cataloged: servers, databases, K8s, storage. More vendors soon.

02Turn insight into action

MCP server

Your AI assistant queries every connected cluster through one endpoint, on your permissions

Forge

Self-service scaffolding, provisioning and automation with approval gates

Event-driven notifications

Trigger alerts from scorecards, ownership changes, discovery events and governance actions

Terraform provider

Declare your entire portal configuration as code

03Keep standards visible

Governance

Track compliance with engineering standards and surface remediation steps for the gaps

Security updates

Hardened images and dependency patches shipped with every new release

Dependency graph

Blast radius analysis at 1–5 levels depth before you make changes

Org chart

Live team hierarchy synced from your catalog. No spreadsheets to maintain.

License expiry tracking

Declare expiry dates in your manifest.yaml and get alerts before they lapse

One MCP server in front of every cluster

Your assistant asks Shoehorn once instead of asking eight servers and joining the answers itself.

Three primitives, not thirty tools

describe_schema, query and fetch. Your assistant reads the schema once, then writes correct queries instead of guessing at parameters and burning turns on retries.

One call covers every cluster

Shoehorn merges workloads across clusters before your assistant sees them. A service running in four clusters comes back as one answer, not four you have to reassemble.

Your agent gets your permissions

Every call runs through the same Cerbos policies as the web UI and the REST API. Anything you can't read doesn't appear in the tool list at all.

Sign in with your company login

Your IDE authenticates against the identity provider you already run. No long-lived token in a config file, and revoking someone in your IdP revokes their access.

One call, one diagnosis

Ask why a workload is unhealthy and the answer comes back assembled: container issues, recent events, rollout activity, right-sizing, network policy, GitOps and Helm state.

Read-only

Assistants read. Writes go through the CLI, Terraform or the REST API.

query · one root, every cluster

{
  "from": "resource",
  "where": {
    "status": "Degraded",
    "environment": "production",
    "no_network_policy": true
  }
}

Every degraded production workload with no network policy, across every connected cluster. There's no cluster fan-out because the catalog already merged them.

More on how it works in one MCP server instead of one per cluster.

Works your way

Pick one or combine them. They work the same data.

k8s agents

Real-time cluster sync via lightweight agents

gitops manifests

Declarative YAML files auto-discovered

ui creation

Manual entity creation in the portal

shoehorn cli

Script and automate from the terminal

mcp server

Your assistant queries the same catalog, with your permissions

rest api

Every action is HTTP