diff --git a/README.md b/README.md
index 74366bf..fd95945 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,10 @@
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Rust](https://img.shields.io/badge/Rust-1.70%2B-orange.svg)](https://www.rust-lang.org/)
 
+<p align="center">
+  <img src="docs/botbox.png" alt="BotBox" width="600">
+</p>
+
 **Sandbox any container's network — especially AI agents.**
 
 BotBox is a Kubernetes sidecar proxy that sits between your container and the internet. It intercepts all outbound traffic via iptables, enforces a deny-by-default allowlist, and injects API keys at the network boundary — so the container itself never holds credentials and can only reach hosts you explicitly permit.
diff --git a/docs/botbox.png b/docs/botbox.png
new file mode 100644
index 0000000..4b97760
Binary files /dev/null and b/docs/botbox.png differ