Product · Agent Health Check
See endpoint-resident AI before anything leaves the machine
One command runs the bounded local collectors and reports the AI apps, agents, models, IDE extensions, MCP servers, SDK dependencies, and supported permissions it found. No account, no upload, no daemon.
How it works
Read, report, and stop there
The audit is deliberately a dead end unless you ask for more. It reads local configuration, prints what it found, and exits.
- 01
Read local configuration
The command inventories MCP servers, skills, and plugins from the configuration on this machine, and records whether each is defined at user scope or project scope.
- 02
Check against a signed catalog
Findings are evaluated against a signed rule catalog. The catalog can be downloaded without uploading your scan — the check runs on your side.
- 03
Report and exit
You get three to five prioritized findings with the evidence behind each. Nothing is sent, and nothing is changed.
What we see
The boundary, stated per command
This page's claims map to a data contract, not a privacy policy. The audit stage sends nothing at all; these are the limits that apply even after you connect.
What the audit reads
Configuration files your user account owns: MCP server definitions, skill and plugin manifests, their scope, declared permissions, versions, and endpoint categories. It computes a canonical fingerprint per asset so the same server can be recognized across machines.
What it never reads
Prompts and responses. Source code and diffs. Shell command text and terminal output. Tool inputs and outputs. Secret and environment-variable values. CLAUDE.md contents. These are excluded at the reader, not filtered after collection.
Findings
What one machine can prove on its own
The first catalog is deliberately small. Every finding here is provable from local configuration alone — no telemetry, no history, no team context required.
Duplicate and shadow servers
The same MCP server defined twice, or a project definition silently overriding a global one.
Scope conflicts
An asset defined at both user and project scope with different settings, where the effective configuration is not the one you would expect.
Unverifiable provenance
A server whose origin cannot be established. Reported as unverifiable — not as unapproved, which is a claim only a team baseline can make.
Unpinned versions
An executable or package reference that can drift under you between sessions.
Explicitly broad permissions
A provable grant of broad filesystem, network, or shell access — read from the declaration, not guessed from behavior.
Plaintext transport
A server reachable over plaintext, or an endpoint in a category worth a second look.
Context
Estimated context load, labelled as an estimate
The audit reports what your installed tool definitions cost you in context before you type anything. It is an estimate, and it says so.
$ keeprails scan Evidence coverage rubric v3 · kb 2026-07-27 Health observed Best-practice observed Hygiene partial evidence Freshness observed Efficiency no evidence 4 of 5 dimensions evaluated from local evidence
The context estimate itself is a register field, not a terminal line:
estimated.contextTokensPerSession carries the per-session total and
assetCosts the per-asset breakdown behind it, both written by
keeprails report —evidence. Reversible changes are previewed with
keeprails apply —capability CAPABILITY.
Reversibility
Nothing changes without a preview you approved
Cleanup is offered, never applied. The path is the same one every KeepRails remediation uses.
Preview before apply
You see the exact diff — which file, which key, what before and what after — and confirm it. A configuration you created is never silently modified.
Backup and atomic write
Changes go through a backup-and-atomic-write path, so a partial failure cannot leave the configuration in a state neither you nor we intended.
Roll back
Every applied change can be rolled back, and keeprails uninstall restores the previous
configuration and removes hook state.
Coverage
What this command cannot tell you
Stated here rather than discovered later. These are the limits of a single local scan, and the honest reason the free 30-day observation exists.
Whether an asset is used
A one-shot scan sees what is installed, not what runs. It will never call an asset unused — that claim needs either an observation window or a deterministic configuration fact.
How this machine compares
Variance across a team needs more than one machine. One audit is one data point.
Whether a server is approved
Approval is a team decision against a baseline. Locally, provenance can only be verifiable or unverifiable.
Where it stops
No payloads are read. A tool the collectors cannot defensibly match is counted as unattributable rather than guessed into a category.
Related
Each surface feeds the next: what the scan finds becomes a finding, and a finding becomes a reversible change.
FAQs about Agent Health Check
What is the Agent Health Check?
A local command that inventories supported endpoint-resident AI on one machine and reports findings such as duplicate definitions, scope conflicts, unverifiable provenance, unpinned versions, and explicitly broad permissions. It runs entirely on your machine and needs no account.
Does it send my setup to KeepRails?
No. The anonymous audit sends no inventory. It may download a signed rule catalog to check against, but the scan result is never uploaded. Sync only begins if you later run `keeprails connect`, which previews every field and path before enabling it.
Does it read my prompts, code, or shell commands?
No. Prompts, assistant responses, source code, diffs, shell command text, tool payloads, secret values, and CLAUDE.md contents never leave the device, and the audit does not collect them. Local detectors can report that a sensitive value is present without reporting the value itself.
Will it change my configuration?
Not without an explicit preview and your confirmation. No command silently changes a configuration you created. Cleanup shows the exact diff first, writes atomically with a backup, and can be rolled back.
Is this an IDE extension or a background daemon?
Neither. It is a command you run. There is no always-on process and no editor plugin.
How is this different from a token or cost dashboard?
A cost dashboard reports spend. The Agent Health Check reports what is installed, at which scope, from where, and whether it can be verified — and token and context figures appear only as evidence for those decisions, never as the product.
Does it need admin rights or MDM?
No. It reads the configuration your user account already owns. KeepRails does not deploy through MDM and never will — that is a permanent boundary, not a missing feature.
See what your fleet is actually running
The scan runs locally and reports in your terminal. No account, no upload.
keeprails scan