Local installation

One process between your browser and Kubernetes.

Install the binary yourself or hand the reviewed instructions to your coding agent. Fortem opens an embedded web interface on loopback and uses the kubeconfig already on your machine.

or install yourself

Local install · read-only first · no Helm chart

The installer verifies the release checksum and never opens kubeconfig or contacts a cluster. Read the agent instructions.

Runs locally

Single binary with the web UI embedded.

Read-only first

Management requires an explicit --manage flag.

Uses kubeconfig

Exec helpers, VPN access and Kubernetes RBAC still apply.

After install

Choose the smallest safe first run.

Start with synthetic data, or run doctor against an explicit read-only context before opening the live interface.

Synthetic demo

fortem --demo

No cluster, kubeconfig or cloud credentials required.

Read-only preflight

fortem --doctor --context my-cluster

Checks connectivity, visible resources, RBAC and optional metrics without starting the UI.

Current context

fortem

Reads the current kubeconfig context and opens the loopback interface.

Explicit context

fortem --context my-cluster

Selects an existing context by name. The default remains read-only.

Headless / custom port

fortem --no-open --listen 127.0.0.1:9191

The server still binds to loopback unless remote access is explicitly allowed.

Cluster compatibility

One Kubernetes path, five distributions.

Base support uses standard Kubernetes APIs. Fortem relies on the authentication helper and network path named by your kubeconfig.

ClusterLocal prerequisiteDetected metadata

EKS

Existing kubeconfig; AWS CLI or the exec helper named by that context

EKS and Karpenter node pools; Spot/on-demand labels

GKE

Existing kubeconfig; commonly gcloud plus the GKE auth plugin

GKE node pools; Spot/preemptible labels

AKS

Existing kubeconfig; commonly Azure CLI and/or kubelogin

AKS agent pools; Spot/regular labels

kind

Running local cluster and its generated kubeconfig context

Standard Kubernetes data; cloud capacity type stays unknown

k3s

Kubeconfig with an API server address reachable from this machine

Standard Kubernetes data; capacity type stays unknown unless labeled

Authentication remains external.

Fortem can invoke kubeconfig exec authentication, but it does not replace AWS CLI, gcloud, Azure CLI, kubelogin, OIDC login, credential refresh, VPN access or connectivity to a private API server.

Downloads are verifiable.

The installer selects the matching macOS, Linux or Windows archive and verifies it against the release checksum before installing. Code signing and notarization are separate release properties and are never inferred from a checksum.

Open the demo Read the security model Release archives