Get started / Quickstart
Quickstart
Install the CLI, scan the machine you are on, and produce your first dated Evidence Register. Takes about two minutes and requires no account.
curl -fsSL https://staging.keeprails.dev/install.sh | sh Note
The scan uploads nothing. Connecting the machine to a TEAM organization is a separate, previewed, consented step.
What you get
Four artifacts land in ./keeprails/, all dated with the scan boundary declared:
Commands
Every command runs data-local unless it explicitly syncs.
keeprails scan Discover the MCP servers, skills, plugins, CLIs, and AI clients configured on this machine from local evidence, and print a register summary. Runs locally and anonymously; nothing is uploaded.
keeprails report --evidence Write the dated, source-attributed evidence register to a file (--out evidence.json; add --cyclonedx for a register-shaped CycloneDX BOM). Generated data-local — the artifact you hand to a GRC platform.
keeprails scan --aibom Write the CycloneDX 1.6 AI-BOM: the same evidence plus package URLs for the AI SDKs your code declares, the AI-specific component properties, and an explicit coverage note.
keeprails login --device Pair this machine to your org through a browser-approved device flow. An org owner or admin approves the pairing in the dashboard.
keeprails scan --sync Run a scan and upload only sanitized tool-identity metadata to your org plane (--days 30 sets the observation window). Requires a paired machine.
keeprails apply Preview and apply only the reversible configuration changes you approve, keeping a backup so any change can be rolled back.
keeprails verify-register Recompute the register hash to confirm no entries changed since they were collected.
keeprails version Print the binary version and the knowledge-base snapshot it resolves identities against.
Verify the boundary
The summary prints the framework coverage it can support and the provenance behind it — the rubric and knowledge-base snapshot that produced the mapping, and the register's integrity hash. Abridged here; the real output also lists entry counts and the per-framework answer fragments.
$ keeprails report --summary Audit-ready evidence summary (evidence, not certification) Framework coverage iso42001: A.4.4 soc2: CC6.1 Provenance keeprailsVersion=… rubricVersion=… kbSnapshotVersion=… mapping=cm-6 integrity=…
Enroll a fleet
An admin creates the org, each machine pairs through a browser-approved device flow, and the sync uploads sanitized tool-identity metadata only.
$ keeprails login --device Approve this machine in the browser… Paired to org acme-inc $ keeprails scan --sync --days 30 Uploaded sanitized tool-identity metadata only
What is in pilot
Today the deliverable is the evidence file you upload to Vanta or Drata yourself; direct push into those platforms is being built. Not yet in the register: data-sensitivity classification, tool version and provider fill, in-app review and sign-off, and change history across the period. KeepRails produces audit-ready evidence, not certification.