Steer your fleet through the clashing rocks.
Tiphys is an AI operations crew for the orchestrators you run. It reads your clusters and the cloud they run on, diagnoses problems with live data, and charts a fix. Nothing changes until you give the word.
In Greek myth, Tiphys was the helmsman of the Argo. He read the stars and the wind and steered Jason's crew through the Clashing Rocks. Tiphys does the same for your workloads, whatever orchestrator they run on.
Watch the crew at work.
Short loops from the product, running on sample data.
Lynceus diagnoses a flapping service and waits for approval before changing anything.
Two to steer, one to build.
Ask in plain language. Tiphys hands the work to the right crewmate and passes it between them when a problem crosses boundaries.
Lynceus
The lookout, who could see through sea and stone.
Diagnoses pods, services, and nodes from live cluster state, logs, events, and metrics, so you see trouble before you hit it.
- why is checkout restarting?
- which workloads have no resource limits?
- rotate secrets for payments-svc
Aeolus
Keeper of the winds, who stilled them for the Argo.
Connects your workloads to the cloud behind them: roles and workload identity, databases, buckets, secrets, networking, and what each one costs. Aeolus works when your clusters run in a cloud account.
- which IAM role does checkout assume?
- why can't payments-api reach its database?
- what does prod-east cost each month?
Argus
The shipwright who built the Argo.
Builds services and environments in your clusters from your own templates and conventions. When a fix belongs in git, it opens a pull request on GitHub, and Argo CD or your deploy pipeline ships it.
- spin up a staging env for notifications-api
- which services drift from our template?
- scaffold a new Go service
Nothing changes without your approval.
Tiphys reads freely and writes carefully. Every change is proposed, reviewed, signed, and recorded.
Read-only by default
Tiphys runs under service accounts and IAM roles you scope. Writes are off until you enable them.
Approval gates with diffs
Every write arrives as a plan with its impact, a diff, and a dry-run result. You apply, reject, or edit it.
Signed and reversible
Applied changes carry a signature and a rollback token, so any change can be traced and undone.
The ship's log
Every query and action is written to an append-only, hash-chained log you can export to your SIEM.
| Time | Actor | Action | Result | Approver |
|---|---|---|---|---|
| 14:33:52 | lynceus | kubectl.patch | ok | jamie@acme |
| 14:33:44 | lynceus | plan.generated | approved | jamie@acme |
| 14:32:58 | lynceus | prometheus.query | ok | — |
| 14:32:22 | lynceus | kubectl.logs | ok | — |
| 14:18:44 | aeolus | identity.verify | ok | — |
| 14:11:32 | argus | idp.pr.draft | queued | — |
| 14:04:01 | lynceus | secret.rotate | blocked | needs approval |
Built for the orchestrators you run.
Tiphys works inside your clusters and the cloud they run on, and learns the patterns it finds there. Beyond that, Argus opens pull requests on GitHub when a fix belongs in git.
- Workloads and Helm releases
- Nodes, events, and logs
- Ingress and network policies
- Prometheus and metrics-server
- Roles and workload identity
- Managed databases and caches
- Buckets, registries, secrets
- Networks and cloud metrics
- Service templates
- PRs you review and merge
- Shipped by Argo CD or CI/CD
Aeolus needs clusters that run in a cloud account; on-prem clusters run without it. Argus needs Argo CD or a deploy pipeline to ship what merges.
Plans and pricing
Tiphys plans are on the Intelligant AI pricing page. One Intelligant account covers every product you use.
What teams ask first.
Does Tiphys change anything without asking?
No. Tiphys is read-only by default. When you enable writes, every change is presented as a plan with a diff and impact summary, and nothing is applied until someone with permission approves it.
What access does Tiphys need?
A service account in your cluster with read-only RBAC, created and scoped by you. Aeolus, the cloud agent, also needs a read-only cloud role bound to that service account. Start read-only and widen access per namespace when you're ready.
Does Tiphys need a cloud?
No. Lynceus runs on any cluster, in a cloud or on-prem. Aeolus reads the cloud account behind your clusters, so it only works when they run in one. Argus needs a way for its changes to reach your clusters, such as Argo CD or a deploy pipeline.
Who are Lynceus, Aeolus, and Argus?
They're the three agents inside Tiphys, named for their jobs. Lynceus watches your clusters, Aeolus maps your workloads to the cloud behind them, and Argus builds new services and environments.
How does Tiphys learn our conventions?
It scans your clusters: manifests, Helm releases, probes and resource limits, admission policies, IAM bindings, and the changes you've approved. It records the patterns it finds with a confidence score, and you can review, edit, or remove anything it has learned.
Where does our data go?
Tiphys runs inside your cluster. Cluster and cloud data is processed to answer your questions and is not used to train models, and with a cloud-native or self-hosted model provider it stays inside your trust boundary.
See Tiphys steer your own fleet.
In a 30-minute demo we connect Tiphys to a test cluster and walk through a real diagnosis. If you're not ready yet, join the waitlist and we'll let you know when your spot opens.