# sudosudo

> Secure environments for AI agents. Two pillars. **Compute** — sudosudo hosts VMs (EC2: IMDSv2, encrypted gp3, no inbound SSH) and microVMs (Firecracker via AWS Bedrock AgentCore, one per session, idle-stop after 15 min, 8 h max) from agent-ready templates: `ubuntu-guarded`, `agent-workbench` (Docker, Node 20, Claude Code / Kimi / Codex CLIs), `odoo-ai` (Odoo 18 + PostgreSQL 16 + Caddy TLS + a read-only `odoo-agent` bridge), `7ots-ot`, `code-sandbox`; an org can also capture a configured VM as its own template. Prices (beta): VM t3.micro $17, t3.small $28, t3.medium $49, t3.large $89 per month; microVM $0.25/hour billed per minute. **Guard** — every hosted machine, and any box you bring (register a server as a "target"), pushes metrics; YAML alert rules fire, and an AI agent investigates over SSH through an allowlist (`tgt-ssh`: blocklist → read → remediate), emails a triage report and keeps a per-command audit log. The guard is free during the beta. Bring your own LLM key (Claude, OpenAI, Gemini, DeepSeek, Kimi, Grok).

Humans sign in at https://sudosudo.dev/signin (magic link by email). Agents and other platforms use the External API below with an org-scoped API key.

## External API

- [OpenAPI spec](https://sudosudo.dev/openapi.json): OpenAPI 3.1 for every operation under `https://sudosudo.dev/api/ext` (targets CRUD, alert rules, SSH allowlist, status, reports, schedules, triage).
- Base URL: `https://sudosudo.dev/api/ext` — e.g. `GET /api/ext/targets`, `POST /api/ext/targets`, `GET /api/ext/targets/{target_id}/status`, `PUT /api/ext/targets/{target_id}/rules`, `POST /api/ext/targets/{target_id}/triage`.
- Authentication: header `Authorization: Bearer sot_…`. An org owner creates and revokes keys at https://sudosudo.dev/app/members (shown once, stored hashed, expire, scoped to one org).

## Sending data

- Metrics push: `POST https://<target_id>.sudosudo.dev/push` with `Authorization: Bearer <push_token>` (get it from `GET /api/ext/targets/{target_id}/push-credentials`). JSON body of metric key/values; rules are evaluated on every push.
- Heartbeats (dead-man switch for cron jobs): `GET|POST https://sudosudo.dev/hb/<token>` on success, `https://sudosudo.dev/hb/<token>/fail` on failure. Missing pings raise an alert.

## Limits

- Over a limit the API answers `429 Too Many Requests` with a `Retry-After` header (seconds); wait and retry.
- Agent-triggering calls (triage, rule suggestions, schedule run-now) have a per-org burst limit and a daily quota when the target uses the platform LLM; set your own `llm_api_key` on the target to avoid the daily quota.
- Targets and probes per org are capped (`403` with a quota message). Push ingest is limited per target (60/min).

## Optional

- [Home](https://sudosudo.dev/): product overview and pricing.
- Contact: alerts@sudosudo.dev