Product
A control loop for agent work, on infrastructure you can trust
Keelson runs AI-made changes through one supervised loop: a plan you approve, a constrained execution, an independent review, and a merge decision that stays human. Underneath sit real Git hosting, an encrypted Vault, and an open-source core.
The loop
How a change moves through Keelson
Five stages, always in this order. The first and last decisions belong to people.
Command Center
The workspace opens on the operations console: work awaiting your approval, runs in flight, changes ready to merge, and a timeline of what happened. Every number on it is a real query with an honest empty state.
A request becomes a plan you approve
Describe the objective in plain language. The agent writes a persisted plan (approach, steps, expected files, risk notes, target branch) and nothing touches the repository until a person approves it. The approver can narrow the run to specific paths, and that scope is enforced server-side before anything is committed.
Execution inside enforced limits, on the record
Approved plans execute once, inside the permission envelope: writes go only to keelson-ai/* branches, forbidden paths are refused, secret values are unreachable, and change size is bounded. Every step lands on the run's event timeline: plan approved, branch created, files changed, review opened.
An independent review grades the result
A separate review pass with fresh context, given only the objective and the diff, produces a structured verdict: requirements checked, findings, a recommendation. The verdict is persisted on the review request, readable in plain language or full technical detail.
A person decides what ships
Every agent change is a review request a human approves and merges, or closes unmerged. Protected branches can block AI-authored merges outright, deployment is a separate human-initiated step, and the audit trail records who requested, approved, and merged.
The foundation
Infrastructure under the control plane
The loop only means something if the layer under it is solid. These are not the pitch; they are what makes the pitch enforceable.
Real Git underneath
Standard Git hosting: clones, pushes, branches, and history over HTTPS, with review requests and branch protection. Agent work and human work land in the same repositories under the same server-side rules, and core Git is never gated on any plan.
Environment Vault
Encrypted secrets management built into the repository. Envelope encryption backed by a cloud KMS, per-environment values, masked display with permissioned reveals, and a CLI workflow. Agents see secret names only; values are unreachable from agent code.
Two views of the same controlled run
Interface mode is a per-user preference. Simple Mode shows a founder the plan, the verdict, and the decision in plain language, with the real Git term always in view. Developer Mode shows branches, diffs, logs, and token counts. Both call the same server actions on the same data.
Open source, self-hostable
The platform core is AGPL-3.0-only, an OSI-approved license; the CLI and SDK packages are Apache-2.0. Self-hosters get the complete product with Docker Compose, and the cloud is monetized on hosting, capacity, and team controls.
Run your first supervised change this week.
Free includes the full control loop for a founder and one collaborator.