Kelvar Book a demo

Autonomous cyber defense

Kelvar's always-on agents watch your code and alerts, forge the fix, and record every action in a ledger you can verify.

Book a demo Run it free
curl -fsSL https://github.com/Faisalnwz01/vigil/releases/latest/download/install.sh | sh

macOS 14+ on Apple Silicon. Research preview.

Connects to GitHub today. Cloud guards are in preview

See exactly what it does.

Point it at a repo. Kelvar audits it, records what it confirms, and returns a verdict you can gate a merge on.

$ python3 -m vigil.cli scan ./target-app
{
  "verdict": "block",
  "summary": { "critical": 1, "medium": 1 },
  "findings": [
    { "check": "zero_click", "severity": "critical",
      "path": "webhook_handler.py", "line": 4,
      "message": "unsafe deserialization sink (zero-click RCE vector)" },
    { "check": "deps", "severity": "medium",
      "path": "requirements.txt", "line": 1,
      "message": "requests 2.30.0 affected by CVE-2023-32681" }
  ]
}
Real output from the built-in scanner on a small sample repo with planted flaws. The agents go deeper than this first pass.

One audit, end to end.

Ask an agent to audit a folder it can't see yet. It builds itself a read-only room, reads, and reports. Nothing is trusted until a check passes.

  1. chat

    You ask

    "Audit target-app for zero-click and CVE risk." The Zero-Click Rapid Defender picks it up.

  2. authoring.apply

    It builds a read-only room

    A child worker is authored with read access to that one path and nothing else.

  3. file.read

    It reads the code

    Source files and dependency manifests, inside a sandbox limited to the admitted path.

  4. security.finding

    Findings are recorded

    Six confirmed on the sample repo: three critical, two high, one medium. Each carries file, line and advisory, and lands on the Findings screen.

  5. file.write

    Hand one to the patch agent

    It prepares a minimal fix in an isolated git worktree. A deterministic verifier must pass before the ledger records a mark.

Five jobs, covered around the clock.

Each project pairs a specialist agent with a sandboxed room and a policy, so every check runs with only the access it needs.

Zero-click and CVE response

Hunts deserialization sinks, SSRF and critical CVEs, then drafts a virtual patch before attackers find the way in.

Cloud posture and IAM (preview)

AWS, GCP and Azure guards are in preview and do not scan yet. GitHub is the connected guard today. Read-only by default.

Code and supply chain

Audits lockfiles, workflows and look-alike packages on every pull request.

Secrets and compliance

Finds leaked API keys and private keys in code, history and logs, and keeps SOC 2, HIPAA and PCI evidence current.

24/7 SOC

Triages SIEM and webhook alerts, links signals across surfaces and escalates only confirmed incidents.

Connect once. Kelvar handles the rest.

  1. Connect

    Add GitHub or a SIEM feed. Cloud guards are in preview. Access stays read-only until you opt in to write-back.

  2. Watch

    Agents audit continuously and record each confirmed finding with the evidence behind it.

  3. Block

    Risky merges and payloads are stopped at the gate. Fixes arrive as small patches built in an isolated worktree.

Every action leaves proof.

Findings, blocks and patches are written to an append-only, hash-chained ledger. A result is marked verified only after a deterministic check passes, never on a model's say-so.

Read the architecture
    Illustration. Each hash is computed in your browser from the entry before it.

    Start free. Add control when you need it.

    Community

    $0

    Local scans for secrets, vulnerable dependencies and misconfigured infrastructure code, from the CLI.

    Run it free

    Team

    $49 per developer, per month

    A daemon with watchers: pull request gate, on-push scanning, dependency and config drift, Slack alerts.

    Book a demo

    Business

    $99 per developer, per month

    Adds interception that blocks merges on critical findings, IaC and cloud config checks (live cloud guards are in preview), and a signed audit trail for SOC 2.

    Book a demo

    Managed

    $5k per month, and up

    The Kelvar team runs the agents for you, so security coverage does not depend on a new hire.

    Book a demo

    Need it inside your own network? On-premise appliances start at $75k per year.

    Questions security teams ask.

    Does Kelvar change my code or infrastructure?

    Not unless you allow it. Guards connect read-only, write-back is opt-in, and every change an agent makes is recorded in the ledger with the evidence that justified it.

    Where does it run?

    On your own machine or on an on-premise appliance. Scans are local-first, and nothing leaves your environment except the model calls you choose to enable.

    Which models can it use?

    Any provider you connect, including local and custom models through an OpenAI-compatible endpoint. The kernel does not depend on a specific vendor.

    What happens when it finds something?

    Confirmed findings appear on the Findings screen with file, line and advisory. From there you can hand one to the patch agent, which prepares a minimal fix in an isolated worktree.

    Put a watch on everything you ship.

    Book a demo