the black box recorder for regulated kubernetes
reel records live container state from pods in your cluster: SBOMs, crypto, processes, memory, and malware. When the DORA or NIS2 reporting clock starts, the evidence already exists.
reel turns raw container state into security evidence.
Outputs
continuous compliance
reel finds and scans images in your pipeline and live containers across your clusters. Your compliance evidence stays current and ready for inspection.
One-shot scans from your terminal or CI pipeline.
Deploy once. Scans run on schedule, results go to S3.
model context protocol
reel gives Claude Code, Cursor, and Continue the live state of what's actually running: SBOMs, crypto, processes, files, and memory. Your coding agent reads it the moment you ask.
"what's exploitable in the nginx container?"
→ sbom · vuln + vendor VEX
287 CVEs · 263 not_affected · 24 to triage
"any weak crypto or malware in there?"
→ cbom · malware
2 RSA-1024 keys · 0 signatures matched
"what else is running on this node?"
→ list_workloads
redis · postgres · nginx · 3 sidecars