Your agent writes the code. Kekkai keeps it safe.

It makes your coding agent work like a careful security reviewer, and tells you honestly what was checked and what wasn't.

Get KekkaiWatch it work
Works withClaude CodeCodex CLIOpenCode

Watch Kekkai work inside Claude Code

Five moments from one week of building an invoicing app, from the first line of checkout code to an advisory after launch. Your agent does the work. Kekkai tells it what to check and keeps score.

Your agent reads the payments guide before it writes checkout code.

Every review ends with a record of what was checked and what wasn't

Kekkai never says your app is secure. Each finding carries a label for how strong the evidence is, and the report lists what was not checked and why. Your agent tells you when a review is only partial.

found from the code, not tested
Your agent read it in the code. Nothing ran.
found by an automatic check
One of Kekkai's own checks found it.
reproduced; intent unconfirmed
Kekkai's test made it happen on throwaway data; you haven't confirmed the access rule yet.
this test did not reproduce the claim
The test ran and didn't show it. Not a pass, and not a fix.
live test not run: <reason>
No test ran, and the reason says why. Never counted as safe.
kekkai-report.html · billow
Review partial
31 Oct 2026, 16:42

Automatic checks finished; checklist review incomplete: 7 not started.

Open findings
2
Waiting for you
1
Checklist reviewed
41 of 48
Not checked
4
Another customer can open your invoice PDFsreproduced; intent unconfirmed
Webhook events aren't de-duplicatedfound from the code, not tested
Not checked or still unknown
  • Routes were not enumerated; bugs not identified by the agent or automatic checks were not tested
  • Live test not run: the app's data may not be disposable
  • Does one organization see another's data? Waiting for your answer
  • GraphQL live testing: no live protocol verifier
The report is one HTML file on your machine. It works offline and loads nothing from the internet.

Kekkai never sends your code to us

Kekkai runs where your project lives and never runs a model of its own. Your coding agent does the reading and fixing, under its own provider's rules. Here is exactly what goes where.

Never sent to Kekkai

  • Your source code, config files and lockfiles
  • Findings, evidence, test receipts and reports
  • Secrets Kekkai finds, and the credentials your tests use
  • File paths, folder names, repo URLs and project names

Everyday commands check for new advisory data at most once a day, and download it when there is some. No request carries anything about your project. Offline mode turns this off.

Sent only while email alerts are on

  • Each project's package list: ecosystem, name, version, direct or dev, hosting platforms, and which ecosystems were readable
  • A random project ID and a nickname you choose ("Project 1" by default)

Alerts start on when you sign up. The list is encrypted where we store it, but whoever controls our Cloudflare account could read it. Turn alerts off and the list never leaves your machine; you can still check by hand with kekkai watch --once.

To count a repo once across your machines, Kekkai sends a one-way fingerprint of its first commit, made per account. For a private repo it reveals nothing; for a public repo, someone with our database could test whether your account works on that repo. Linked computers renew their license once a day, which tells us a license was in use that day. Backups keep data for up to 30 days. Full details are in the privacy policy.

Choose how much work your agent does

Kekkai does the cheap, exact work itself and hands your agent small tasks. Only you change the mode, with kekkai mode set.

Guard

No agent tokens

Automatic checks only: packages, leaked secrets including your built bundle, risky config and debug routes. Runs before each git push.

Standard

Default

Guard, plus the guides before risky code, a light review of each change while you build, and the full checklist before you deploy.

Thorough

Most agent work

Standard, starting from a full review, plus optional live tests on your machine, with your consent and a database you confirmed is a throwaway.

Works inside the agent you already use

kekkai init writes a short skill and a block in AGENTS.md. Kekkai never edits your agent's settings, permissions or hooks.

  • Claude Codetested and released
  • Codex CLItested and released
  • OpenCodetested and released
  • Cursornot yet tested
  • Gemini CLInot yet tested

Other agents that read AGENTS.md can follow the same block. Kekkai hasn't tested them.

Knows your stack

A 48-item checklist with extra items for your framework, and 23 guide topics your agent reads before writing auth, payments, uploads and more. Stack add-ons today:

  • Next.js
  • SvelteKit
  • Nuxt
  • React Router
  • Astro
  • Express
  • Hono
  • NestJS
  • FastAPI
  • Flask
  • Django
  • Rails
  • Laravel
  • Go
  • PHP
  • Supabase
  • Firebase
  • Convex
  • Expo
  • React Native
  • Electron
  • Tauri
  • Capacitor

Deeper tests exist for Supabase row-level security and Firestore rules, run in Docker on your machine. Any other app still gets the full generic checklist and the automatic checks.

One product, three sizes

Every plan has every feature. Plans differ only in how many projects they cover.

Hobby

One or two side projects

$15/ month$19

$180 billed once a year

2 projects

Choose Hobby

Pro

Recommended

Several apps in active development

$22/ month$28

$264 billed once a year

8 projects

Choose Pro

Max

Studios and agencies with many client apps

$42/ month$49

$504 billed once a year

20 projects

Choose Max

Every plan includes

The 48-item security checklist, matched to your stack

Guides your agent reads before auth, payments, uploads and 20 more topics

Package checks for malware, look-alike names and known vulnerabilities

Automatic checks for leaked secrets, risky config and debug routes

Optional local tests for two-user access, Supabase RLS, Firestore rules and webhooks

Email alerts when a new advisory affects a package one of your projects uses

Local reports in HTML, JSON and SARIF, plus the dashboard

Signed pack updates with new advisories and guides

A project counts the first time you use Kekkai in it. The same repo on two of your computers counts once, and removing a project frees its place. Payments are in test mode during the beta.

Questions

Does Kekkai see my code?
No. The CLI runs where your project lives and sends no code, findings or secrets to us. With email alerts on, each project's package list is sent so we can email you about new advisories; turn alerts off and it stays on your machine. Your coding agent is a separate product with its own rules. See what goes where.
Which coding agents does it work with?
Claude Code, Codex CLI and OpenCode are tested and released. Cursor and Gemini CLI are not tested yet. Other agents that read AGENTS.md can follow Kekkai's block, untested.
Does it run its own AI?
No. Kekkai never runs or pays for a model. Your agent does the reading and fixing; Kekkai gives it the checklist, the guides and the checks, and keeps the record. Guard mode runs only Kekkai's automatic checks and uses no agent tokens.
Will it block my deploys or installs?
No. Kekkai informs and never blocks. It tells your agent and you what it found and what wasn't checked; what to do is your call.
Does a clean review mean my app is secure?
No tool can show that, and Kekkai never says it. A review lists what was checked, how strong each result is, and what was not checked, so you can see the gaps.
What counts as a project?
A project counts the first time you use Kekkai in it. The same repo on two of your computers counts once, and removing a project frees its place. If you move to a smaller plan, you choose which projects stay active.
What happens if I cancel?
Your plan runs to the end of the period you paid for, and reports you already have stay readable. Licenses last up to a week, renew while a computer is online, and never run past the end of your plan. A computer that can't reach us keeps working for up to 30 days after its license runs out.
Is there a free plan or a trial?
No. Kekkai is a paid product. During the beta, payments run in test mode for invited accounts.

Set it up before your agent's next session

One command to install, one to link your account, one per project.

$ curl -fsSL https://staging.trykekkai.com/install.sh | sh
$ kekkai login
$ kekkai init
Get Kekkai