> ## Documentation Index
> Fetch the complete documentation index at: https://docs.0labs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Agent0

> The autonomous remediation layer on top of any CSPM.

Agent0 is the **autonomous remediation layer that sits on top of any CSPM**. You connect
two things — read-only GCP and a GitHub App on your IaC repo — and the agent **triages** your cloud
findings (suppressing noise, ranking by org context) and opens **real fix PRs in your own
repository**.

It does not replace your scanner, your graph, or your detection engine. It picks up findings and
does the one thing those tools leave to humans: write the correct fix, in your code, as a pull
request you review.

## The two connections

<CardGroup cols={2}>
  <Card title="Connect GCP (read-only)" icon="google" href="/connect-gcp">
    Apply a least-privilege Terraform module. 0Labs impersonates a read-only scanner SA — keyless,
    no credentials stored.
  </Card>

  <Card title="Connect GitHub" icon="github" href="/connect-github">
    Install the Agent0 GitHub App on your IaC repo. The only mutation we ever make is a
    pull request.
  </Card>
</CardGroup>

## The trust headline

This is the whole security model, stated plainly:

<CardGroup cols={2}>
  <Card title="Read-only scanning" icon="eye">
    Zero write verbs in the granted role. You can diff the exact permission set before you apply it.
  </Card>

  <Card title="PR-only mutation" icon="code-pull-request">
    The only change we ever make is a GitHub pull request. **Merge ≠ apply** — your CI plans, your
    pipeline applies.
  </Card>

  <Card title="Keyless" icon="key">
    No credentials stored. Short-lived impersonation you revoke by removing one IAM binding.
  </Card>

  <Card title="Metadata-only egress" icon="shield">
    We read config via read-only APIs. **No disk snapshots, no object or database contents.**
  </Card>
</CardGroup>

## Where to go next

<CardGroup cols={3}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    The 5-minute happy path, end to end.
  </Card>

  <Card title="Permissions" icon="list-check" href="/permissions">
    The full, exact read-only permission set.
  </Card>

  <Card title="Security & trust" icon="lock" href="/security">
    Keyless model, egress boundaries, subprocessors.
  </Card>
</CardGroup>