Skip to content
Scan one machine free. No account. Nothing leaves your machine.
KeepRails

The platform

One inventory, kept current

The system of record for endpoint-resident Shadow AI: a data-local inventory and change history for AI apps, agents, models, IDE tools, MCP servers, browser extensions, SDKs, and provider-key presence across the fleet.

Run a free audit What is this category?
  1. Scan →
  2. Inventory →
  3. Snapshots →
  4. Changes

Each snapshot starts with bounded local discovery. KeepRails normalizes identities before it compares state, so every change points back to what the collector actually observed.

What the loop produces

One fleet inventory, with history

Every snapshot feeds the same normalized inventory, change history, and status board.

The KeepRails evidence register on the Northwind Labs demo account: SOC 2, ISO 42001, and NIST framework control-coverage cards above control-grouped tool evidence, each entry marked observed or inferred.
The register: control coverage, then the tool evidence behind it.
KeepRails Overview status board on the Northwind Labs demo account, showing framework readiness cards and a needs-attention feed.
The status board built on top of it, with what needs attention next.

Scan

Scan

Read local identity evidence for endpoint-resident AI without uploading configuration content.

KeepRails Devices view on the Northwind Labs demo account, listing fleet machines with their collectors, owners, and tool counts.
Every machine in the fleet, with its owner and collectors.

Agent Health Check (CLI)

One command runs the bounded local collectors and reports the AI apps, agents, models, IDE extensions, MCP servers, SDK dependencies, and supported permissions it found. No account, no upload, no daemon.
Read more →

Endpoint AI Inventory

Local models, desktop AI apps, IDE AI, agent CLIs, MCP servers, browser extensions, SDK dependencies, provider-key presence, and the autonomy configured around them — each tied to what the scanner actually observed.
Read more →

Inventory

Inventory

Normalize what was observed, where it came from, and what the collector did not scan.

Nothing in this stage ships yet. It is described here because the loop needs it, not because you can buy it today.

Snapshots

Snapshots

Store comparable fleet snapshots with ownership and declared scan boundaries.

KeepRails Findings view on the Northwind Labs demo account, grouped by severity with a fix path for each entry.
Findings with a one-command fix.

Finding Catalog

A deliberately small, signed, versioned rule catalog. Every finding carries its rule version, its evidence, why it got that severity, and how it might be wrong.
Read more →

Changes

Changes

Surface added, removed, changed and running-state events; export evidence views when needed.

Nothing in this stage ships yet. It is described here because the loop needs it, not because you can buy it today.

Not yet shipped

What is still ahead

Named here, and nowhere else on the site. These pages exist and can be read, but they are kept out of the navigation until the capability is real.

Claude Code Plugin

Phase 1 A plugin with narrow command hooks that run when a session ends, parse the transcript locally for approved identifiers and counters, and stay silent when nothing is wrong.
Read the plan →

GRC integrations

Phase 1 A phase-gated path for sending sanitized AI-tool identity records to the GRC platform your evidence reviewers already use.
Read the plan →

Observed Use vs Installed

Phase 1 Installed, observed used, not observed in the selected window, unattributable, coverage insufficient. The vocabulary is the product — because the easy version of this feature is the one that lies.
Read the plan →

Team Dashboard

Phase 2 Organization inventory, named and permissioned comparisons, baseline and drift workflow, and an audit trail — built so that anything an administrator can see about a developer, that developer can see about themselves.
Read the plan →

Team Baseline

Phase 2 Observe the team for up to thirty days, propose a baseline from what they actually do, let an administrator edit and approve it — then let developers adopt it with a command. KeepRails never pushes configuration to a machine.
Read the plan →

The loop starts on one machine

keeprails scan