Keanu is an AI engineering harness platform: it wraps the coding agent you already use in stages, checks and guardrails, and runs it on your Mac with access to your code, your GitHub account and, if you connect it, your Gmail. You should not take our word for what it does. You do not have to: a Keanu install is a folder of plain files on your own disk, and every claim below points at the file that enforces it. Read them, or hand this page to your own AI and let it check.
Point your own AI at it
After installing, open Claude Code, Codex or any agent you trust in ~/.keanu/current and ask it something like:
Read this install. List every network destination it contacts, everything it
can do without a human clicking, every place it holds a credential, and
everything the agent prompts instruct that the code does not enforce.The answers are in the files, so an audit takes minutes, and the table below tells you what it should find. If it finds something this page does not list, email hello@heykeanu.app and we will either fix the product or fix the page.
What is on your Mac
~/.keanu/current links to the installed version. Your data lives apart from it in ~/.keanu/data, so updates never touch it.
scripts/ | The installer, the keanu command and their shared library. Plain shell. |
|---|---|
wrangler/ | The run scripts for a fix (wrangler.sh), the independent verifier (verify.sh) and the pre-approval investigation (investigate.sh), plus prompts/: the exact system prompts the investigator, planner, generator, evaluator and verifier sessions run under. Plain shell and Markdown. |
harnesses/issue-triage/ | harness.md, the instructions for the email and GitHub intake sessions, and the small harness-cli binary those sessions use to record what they did. |
claude-commands/ | The /eyes browser-check skill installed into Claude Code. |
dashboard/ | The web dashboard: a compiled Next.js build. It is JavaScript you can read and search, but it is minified, so the checks below give you a string to grep for rather than a line to read. |
node/ | A bundled Node.js, signed by the Node.js Foundation. Check with codesign -dv node/bin/node. |
There are exactly two native executables in the install: that Node binary and harness-cli. Everything else is text. Nothing is obfuscated, and there is no analytics or error-reporting library anywhere in it.
What leaves your Mac
| Your coding agent | The agents run on the one you pick at install: Claude Code (Anthropic), Codex (OpenAI), or both, each signed in as you. Your code goes where it already goes when you use that agent, and Keanu adds no account of its own in between. With both installed, a run that hits a usage limit on one continues on the other; set a project's fallback to claude-only or strict to keep it on one provider. Check: agents in ~/.keanu/data/routing/install.json lists what you picked. |
|---|---|
| GitHub | Issues are read and comments and pull requests are written through the GitHub CLI, signed in as you. |
| Gmail | Read and drafted through a Chrome window in a profile Keanu owns, only if you sign in to it. No mail API, no stored password. |
| Keanu's servers | Three calls: the sign-in at install, a once-a-day license refresh that sends your license ID and nothing else, and update downloads. Check: grep -rl license-refresh dashboard finds the refresh; the only Keanu endpoint in the install is the one in scripts/keanu-lib.sh. |
| Only if you choose it | Share opens a Cloudflare tunnel to your dashboard when you click the Share button, and closes when you stop it. |
The claims, and where each one is enforced
"Code" means the behaviour is fixed by the program and the agent cannot talk its way around it. "Prompt" means the agent is instructed and we verify the outcome, but a model could in principle disobey. We say which is which.
| Claim | Enforced by | Check |
|---|---|---|
| The install script is short, readable, and verifies the download's checksum before extracting. | Code | /install.sh, about 130 lines. The checksum compare is the shasum line. |
| No fix starts without a click. Intake runs on its own: the scan ingests new work, a triage session reads the issue and the repo and posts a summary on the GitHub issue as you. Changing code starts only when you approve. | Code (the gate), prompt (triage changes nothing) | Every project defaults to Supervised; the only other level is Automatic, set per project in Settings and shown on each issue. grep -rl auto_commit dashboard finds the setting. Triage instructions: harnesses/issue-triage/harness.md. |
| Before you approve, a separate session checks each new issue against your code: does the thing already exist, is the same ask already open. It runs in your project's checkout, cannot edit files and holds no GitHub token, and if the checkout changes while it runs, its findings are discarded. On Claude Code it reads with file tools and has no shell; on Codex, which has no separate file tools, it reads through shell commands in Codex's read-only sandbox, which refuses every write and the network. When your project's dev servers are already running it may also open the page in a browser; it never starts a server, and it is told only to look (no submitting, saving, deleting or signing in). A bug it reproduces becomes the first acceptance criterion of the fix. Its findings show on the issue above Approve, which stays enabled whatever they say; a suggested reply becomes a Gmail draft or a "Keanu:" comment only when you click it. Issues that were already waiting when you upgraded are not investigated until you ask, on the issue's page or for all of them in Settings, and a queued backlog starts three at a time. | Code (read-only tools on Claude Code, read-only sandbox on Codex, no token, never starting a server, the binding), prompt (what it looks for, and looking only in the browser) | wrangler/investigate.sh: the token is unset and tree-fingerprint.sh runs before and after. The session is agent_run_readonly with the inspect profile in wrangler/agents/claude.sh (--tools 'Read,Grep,Glob', plus the browser tools in the investigate profile) and wrangler/agents/codex.sh (--sandbox read-only). Each adapter's agent_readonly_reading_note tells the session which tools it reads with. The prompt is wrangler/prompts/investigate.md; the reproduction reaches the fix through wrangler/apply-investigation.py; each verdict is a file in ~/.keanu/data/investigations/. Only issues marked investigation: 'pending' start on their own, at most three per sweep (launchPendingInvestigations and queueBacklogInvestigations in harnesses/issue-triage/investigation.ts). |
| A fix run cannot push and holds no GitHub token. It works in its own git worktree with the push URL disabled, no credential helper and no token in its environment. Commits and pull requests happen afterwards, from the dashboard. | Code | grep -rl remote.origin.pushurl dashboard finds the environment setup. During a run, git -C <worktree> push fails. |
| A fix session is your coding agent with permission prompts off, inside the worktree. On Claude Code it is limited to a fixed tool list (shell, file edits, the browser tools for checking the result). Codex has no tool-list option, so a Codex session is not. | Code | wrangler/wrangler.sh: the ALLOWED_TOOLS line; each agent's command line is agent_run_full in wrangler/agents/claude.sh (--dangerously-skip-permissions) and wrangler/agents/codex.sh (--dangerously-bypass-approvals-and-sandbox). This is why the two guards above exist: the session is capable, so the environment is fenced. |
| The verifier is a separate session that did not see the fix session, re-runs the checks itself, and its verdict is bound to the exact tree it judged. If the tree changes, the verdict is discarded. Agent scratch folders and the file watcher's short-lived cookie files do not count as changes. On Claude Code it has no file-editing tools; on Codex it runs in Codex's workspace sandbox, which can write inside the worktree (tests need that) but not your home folder, so there the fingerprint is the only thing that catches an edit. | Code (tools, sandbox and binding), prompt (what it checks) | wrangler/verify.sh: no GitHub token, and tree-fingerprint.sh before and after (its EXCL list names what it ignores). The session is agent_run_readonly with the verify profile in wrangler/agents/claude.sh (--tools 'Bash,Read,Grep,Glob') and wrangler/agents/codex.sh (--sandbox workspace-write). The prompt is wrangler/prompts/verifier.md. |
| Every pull request says who verified it. The body carries the verifier's verdict or, if you overrode it, your name, date and reason, and ends with "Generated by Keanu". | Code | grep -rl "Generated by Keanu" dashboard. Then read any PR Keanu opened. |
| Every comment Keanu leaves on an issue starts with "Keanu:", so your tracker shows what was automated. | Code | Any issue Keanu has touched. |
| Keanu never sends email. The reply session is told to save a draft and not click Send, and the dashboard marks a draft as done only after the session has seen it in the Drafts folder. | Prompt (not sending), code (the done mark) | harnesses/issue-triage/harness.md, the "Never send emails" rule. The drafts are in your Gmail Drafts folder where you can read them before anything goes out. |
| Your license is a signed file verified offline. Without one, or after it lapses, the dashboard stays readable and new agent work does not start. Nothing phones home to decide that. | Code | The public key is scripts/license-public.pem; the file is ~/.keanu/data/routing/license.json; keanu license show prints it. grep -rl "Demo mode: 1 project" dashboard finds the gate. |
| Uninstall removes everything. | Code | keanu uninstall --purge in scripts/keanu. It deletes the app, the background service, the data directory and the Gmail profiles. |
Try it in a virtual machine first
If you would rather see it before it touches your Mac, install it in a throwaway macOS VM. On Apple Silicon, Tart is free and takes three commands:
brew install cirruslabs/cli/tart
tart create --from-ipsw=latest --disk-size 64 keanu-vm
tart run keanu-vmInside the VM, open Terminal and run the install command from your welcome page. That is how we test each release: v1.42 was installed on a fresh macOS VM, signed in, given a labelled issue, and watched through fix, verification, pull request and merge before it shipped.
What we do not claim
- The fix session has a shell inside its worktree with permission prompts off. The guards fence what it can reach, not what it can run. Read the worktree's diff before you commit it; that is what the Approve & Commit step is for.
- Not sending email, not changing files during triage, and only looking (never submitting) when the investigation opens your running app are instructions, not fences. We verify the outcome each time, and the Drafts folder and your git history are the record.
- Keanu was built by one developer with AI assistance, the same way it expects you to work. It is exercised daily on our own client projects and on its own repository, and every release is installed on a clean VM before it ships. That is the evidence; the files above are how you check it.