ValkenValken turns your cluster into a live map of what's running, what's talking and what's exposed, with an agent on your own model that investigates and shows its answer visually. Runs entirely on your machine.
Every namespace keeps its place on the map. Switch lens with a keystroke and the same map shows what's running, what's talking, or what's at risk.
Every namespace as a card, health at a glance, and the real links between them.
Requests, latency and errors for every route through ingress-nginx or Traefik, read from the access logs you already have.
Vulnerable images, secrets baked into them, exposure paths from the internet and missing NetworkPolicies, ranked by what to fix first.
Namespaces group into districts by team or purpose, platform services tuck out of the way, and every route in from the internet is drawn, with its live traffic a lens away.
Ask in plain English. The agent investigates the way you would: it reads events, logs, rollout history, traffic and security findings, then lights up exactly what it found.
get_trafficcheckout · 5xx 4.2% since 14:02get_events2 of 3 pods OOMKilled, 7 restartsget_rollout_historyrev 42 cut the memory limit 512Mi → 256Miresources.limits.memory: 256Mi → 512MiThe things you normally piece together from five terminal windows, in one place.
Light up the path from the internet through the ingress and the service to the pods that actually serve it, and see which ready pod is being skipped.
Ctrl+F searches every pod, service and deployment. Narrow it with :kind and @namespace, and the map flies to the match.
A table of any resource, CRDs included, with regex and label filters, drill-in with Enter, and cells that flash as they change.
Logs merged across a workload's pods, filtered by level, with Kubernetes events in line. Describe and YAML, with drift, one click away.
Every fix a finding needs: image bumps, a securityContext patch, a NetworkPolicy. The score before and after, and what the change would restart.
Keep staging and prod open side by side, with a fleet overview, search across clusters, and drift between them.
Valken is built so you can check exactly what it does before you trust it with a production kubeconfig. No in-cluster agent, no writes you didn't approve, and nothing about your cluster leaves your machine.
valken-core, open source under Apache-2.0. Read the code →get list watch + pods/log. Apply our ClusterRole and Valken can't do more. Applying a Pro proposal needs write access to that object, which you grant separately. Copy the YAML →Basic is pay-what-you-want, including nothing: the map, the Topology and Traffic lenses, and the agent. Pro is for running clusters at work: the Security lens with its fix plans, and more than one cluster at a time. Organisations with €20,000 or more in annual revenue need Pro for work use.
| Feature | Basic | PRO |
|---|---|---|
| Map | ||
| Topology map: districts, drill-down, layouts | Included | Included |
| Trace a route from the internet to its pods | Included | Included |
| Search with :kind and @namespace | Included | Across every open cluster |
| Keyboard list view of any resource, CRDs included | Included | Included |
| Logs, describe and YAML with drift | Included | Plus YAML diff across clusters |
| Traffic | ||
| rps, p95 and 5xx per route, live and the last hour | Included | Included |
| In-cluster service through Valken Sentinel | Not included | COMING SOON |
| Export traffic data | Not included | COMING SOON |
| Longer history | Not included | COMING SOON |
| Security (Valken Sentinel) | ||
| Scans, findings and explained risk scores | Not included | Included |
| Exposure paths and unscanned markers | Not included | Included |
| Fix plans: securityContext, NetworkPolicy, secrets out of images | Not included | Included |
| Reports and exports: CSV, SBOM, PDF | Not included | COMING SOON |
| New since the last scan | Not included | Included |
| Background scans of every cluster | Not included | Included |
| In-cluster service through Valken Sentinel | Not included | COMING SOON |
| Offline vulnerability data import for air-gapped sites | Not included | Included |
| Clusters | ||
| Contexts | Any number | Any number |
| Open at once | One | Up to 4 |
| Fleet overview | Not included | Included |
| Agent and MCP | ||
| Ask about your cluster with your own model | Included | Included |
| Read-only MCP server | Included | Included |
| Change proposals with blast radius, applied on approval | Not included | Included |
| Audit log of agent actions | Not included | Included |
| Collaboration | ||
| Team-synced layouts, pins and saved views | Not included | COMING SOON |
| Roles and permissions (RBAC) for clusters and agent actions | Not included | COMING SOON |
| Seat management: add, remove and reassign people | Not included | COMING SOON |
| Organisation sign-in (SSO) | Not included | COMING SOON |
| License | ||
| Personal use, education and open source | Included | Included |
| Work use, organisation revenue under €20,000 | Included | Included |
| Work use, organisation revenue €20,000 or more | Not included | Included |
| Offline license | Not included | Included |
| Invoices | Not included | Included |
Revenue is the organisation's annual revenue, with its affiliates, or the equivalent in another currency. Contractors go by their client's revenue. See the Terms of Service, section 3.
No. Valken runs on your computer and talks to your cluster directly. Names, images, logs and kubeconfigs never leave your machine. Usage data is off unless you turn it on.
Because we'd rather you use Valken than not. Basic is the same app whatever you pay, including nothing. If it saves you an hour, a few euro helps keep it going. Paying for Basic doesn't cover work use at organisations above €20,000 in revenue; that needs Pro.
Yes, if your organisation's annual revenue is under €20,000, or the equivalent in another currency. Above that, each person using Valken for work needs Pro. Personal projects, education and open source are always free. The details are in the Terms of Service.
No. Download and use Valken Basic without one. An account is only for Pro: sign in with Google, GitHub or Microsoft to subscribe and to get your invoices.
Yes, and kind too. Valken talks to the Kubernetes API with the kubeconfig you already have, so any cluster you can reach with kubectl works, managed or local.
Takes about a minute. Uses the kubeconfig you already have.
Download ↓Built in Ireland by ELDR Technologies Ltd. An EU company, under EU law.
Your cluster data never reaches us. We keep only what an account needs, and delete it when you ask.
No analytics or third-party trackers on this site. Usage data from the app is opt-in.
Polar is our merchant of record and Stripe handles cards, to PCI DSS Level 1. Your card never reaches us.
No in-cluster agent and no cloud dashboard. Read-only by default, and it works fully offline.
Working towards CRA conformity ahead of the December 2027 deadline: vulnerability handling and security updates for every release.
Details in our Privacy Policy and Terms of Service.