Skip to main content

Zyvor Keep

Your agent gets a real computer.
You keep the keys.

Keep gives an untrusted AI agent its own sealed computer on hardware you control, while you hold the policy, the credentials and the approvals. Open source.

Try it in 60 secondsRead the docs
  • 0egress connects, on stage
  • 1signed policy you can diff
  • 3open layers, one stack

How it works

A real computer for an agent you can’t fully trust.

A sealed cell, keys you hold, approvals only you can give, and a counter that proves it.

The agent works in its own microVM with its own kernel. It cannot reach your machine, and the network rules live on the host, outside its reach.

Enforced by the host

  • Gateway reachable
  • QUIC and WebRTC
  • Cloud metadata
  • Public DNS

If a connection slips through anyway, the session freezes.

The cockpit

What you watch while it works.

A goal, its plan, the decisions the policy made, and the egress counter — with the honesty badge always on.

Scripted for illustration — real cockpit: /app/keep

Why Keep

You run it. You read it. You take it with you.

  • You run it

    A laptop, a mini-PC or your own FluxVM host. Same API everywhere.

  • You read it

    Policy is a signed keep.policy.yaml you can diff in git. Apache-2.0.

  • You take it with you

    keepctl pack writes your policy, agent manifest and migration notes to a folder. keepctl unpack restores them on another FluxVM node. Secrets are not included.

  • Bring your own modelA model socket. The cell stays the same.
  • Signed policyFail-closed Sentinel loaded from a signed YAML file.
  • A real cellFirecracker/KVM microVM on FluxVM with its own kernel.
  • Approvals on your phoneBuy, send and delete are approved out of band, never in the chat.
  • Cockpit and browser viewSee taint, recent decisions, tabs, screenshots and a read-only screencast.
  • One-click use casesPDF brief, contract clauses, security questionnaire, meeting actions, log triage, SBOM summary, CSV cleanup.
  • Host network pinFluxVM TC/eBPF: deny_udp and gateway-only ports, enforced outside the guest.
  • Pack and unpackPolicy, manifest and migration notes leave as files. Secrets stay in the vault.

Security profiles

Three rungs. One says what it can’t prove.

Keep labels every cell with the evidence it actually has. Measured is software-test; hardware attestation stays gated until a verified run.

Evidence
software-test
Hardware attestation
Never
Can the host read it?
Yes — the host can still see a measured VM
What you may claim
A software-test measurement. Never hardware attestation.
attestation illustrative · field names from KEEP-0.2
profile: "measured"
image_hash: "(soft)"
evidence_class: "software-test"
snp_launch_verified: false
tdx_launch_verified: false
host_recover_allowed: true  // dual keys, audited
operator_can_read: true

Muse’s Secure VM is described as having the same limit today (public detail is thin). Keep states its limit here, in the product. Security profiles ›

Try it

Run it in 60 seconds.

No KVM needed.

bash
git clone https://github.com/zyvorai/fabric && cd fabric
cargo test --manifest-path agent-runtime/Cargo.toml --lib
./scripts/keep-e2e.sh
Then brief a PDF ›

For phone makers

An agent computer per user. The keys stay on the phone.

How an Android maker, or anyone with a phone and an account system, can offer this: a sealed cell per job in your cloud, approvals only the user’s enrolled phone key can sign, and the model you choose.

Phone, vendor gateway and push relay on the vendor side; shards running Keep cells on the Keep side.
Keep for phone makers ›

Mac, Windows, developer and office files

Files from a Mac or a PC, read in a sealed cell.

Ready-made use cases for what people export from their machines and tools (GitHub, Xcode, VS Code, browsers, Excel) and for the paperwork around invoices, purchase orders, staff and claims. Keep reads the file you give it; it does not connect to the computer or drive its desktop, and it is not your books of account.

  • macOS · System reportDrop in: system_profiler outputModel, chip, memory, macOS version, protection flags, uptime
  • macOS · Homebrew auditDrop in: brew list --versionsPackage count, kept old versions, outdated packages, toolchains
  • macOS · Log triageDrop in: log show, compact styleError processes, repeated errors, sandbox denials, kernel trouble
  • macOS · Update historyDrop in: softwareupdate --historyWhat was installed, versions, dates, betas
  • Windows · System infoDrop in: systeminfo outputOS and build, boot time, memory, domain, hotfix KBs
  • Windows · HotfixesDrop in: Get-HotFix as CSVKB numbers, kinds of update, who installed, dates
  • Windows · Installed softwareDrop in: An installed-programs CSVTop publishers and programs, first rows
  • Windows · Event logDrop in: Get-WinEvent as CSVCounts by level, provider and id; error and warning rows
  • Office · Receivables from mailDrop in: A mail exportInvoice numbers, overdue and paid lines, due dates, amounts
  • Office · PO line itemsDrop in: A purchase order as textPO number, GSTINs, HSN codes, lines with amounts, open points
  • Office · Employee ledgerDrop in: A monthly ledger CSVRows per employee and month, the first rows
  • Office · Reimbursement claimsDrop in: A mail exportClaimants, amounts, approved and pending, categories
  • Developer · GitHub pull requestsDrop in: gh pr list --jsonStates, authors, labels, merges per month, titles
  • Developer · GitHub issuesDrop in: gh issue list --jsonOpen vs closed, authors, labels, issues per month
  • Developer · Failed CI logDrop in: gh run view --log-failedError lines, failing steps, exit codes, repeated errors
  • Developer · Dependabot alertsDrop in: The alerts JSON from gh apiSeverities, packages, ecosystems, advisories
  • Developer · Git log digestDrop in: git log, pipe-separatedCommits per author and month, prefixes, merges
  • Developer · Xcode build logDrop in: xcodebuild outputResult, errors by file, repeated messages, failed tests
  • Developer · Xcode crash reportDrop in: A legacy .crash reportApp, OS, exception, crashed thread, frames
  • Developer · VS Code extensionsDrop in: code --list-extensionsCount, publishers, names
  • Developer · VS Code settingsDrop in: settings.jsonSettings set, telemetry and trust lines, secret-looking names
  • macOS · Apps inventoryDrop in: system_profiler SPApplicationsDataTypeApps, where each came from, signer, kind
  • macOS · Launch itemsDrop in: launchctl listNon-Apple items, exit statuses
  • Windows · ServicesDrop in: Get-Service as CSVStatus and start-type counts, names
  • Windows · Scheduled tasksDrop in: schtasks /query /fo csv /vTasks, state, last result, run-as account
  • Browser · BookmarksDrop in: A bookmarks HTML exportTop sites, folders, titles
  • Browser · Browser historyDrop in: Google Takeout BrowserHistory.jsonTop sites, how pages were reached, titles
  • Excel · Excel sheetsDrop in: A sales register, stock or attendance sheetRows per customer, location or employee; the first rows

Extractive: no model reads the file, and the office packs list and count rather than add up. The Windows samples follow the commands’ documented layouts and are not yet checked against a real Windows export. The output can name hosts, accounts and software, and the evidence class is software-test. Details and commands.

Meta Muse vs Keep

Same threat model. Different owner.

Where it runsMeta’s cloud only.Your laptop, mini-PC or FluxVM host.
PolicyA closed policy engine.A signed keep.policy.yaml you can diff in git.
The cellIts own dedicated cloud VM; a separate Sentinel on the same machine, kept apart at the system level.A Firecracker/KVM microVM per cell on FluxVM, with its own kernel; the network policy is applied by the host, outside the guest.
ModelTied to Muse Spark.Bring your own model socket.
The full comparison ›

Honesty

What we don’t claim yet.

  • Keep runs on measured VMs today, and its evidence class is software-test. Until it runs on verified confidential hardware with a key only you hold, the host can still see inside the VM, and we will not claim otherwise.
  • Muse details here are as publicly described; public detail is thin. Corrections welcome.

Run the open version.

Quick startFabric vs the field