Keep Cmd

Turn a computer of yours into a keep: an always-on home for your AI agents and your conversations, for Loop Cmd and Hearth Cmd. Your data lives on your machine. Every agent runs in a sandbox.

What you need

• Linux on a 64-bit Intel/AMD (x86_64) or ARM (aarch64) machine. macOS comes later.
• Linux 6.12 or newer, with Landlock on. Agents run in a Landlock sandbox, and Keep Cmd won't set up without it. Check that cat /sys/kernel/security/lsm lists landlock.
• systemd, to run the keep as a service.
• An agent harness you install yourself, signed in with your own account: Claude Code, Codex, Gemini CLI, GitHub Copilot CLI or pi.
• Loop Cmd on your phone, to pair with the keep.

Install

curl -fsSL https://keepcmd.com/install.sh | sh

It installs one file, ~/.local/bin/keepcmd, and needs no root. Before installing, it checks the download against Keep Cmd's signed release. Want to read it first? Here it is. If ~/.local/bin isn't on your PATH, the installer says how to add it.

Set up your keep

1. Make this machine a keep

keepcmd hub setup

This makes the keep's keys and shows your recovery key: 24 words, shown once. Write them down and keep them somewhere safe. They unlock your backups. For Hearth Cmd too, add --household MyHouse.

2. Run it as a service

keepcmd service install
sudo loginctl enable-linger $USER

The first line starts the keep now and at every login. The second, run once, keeps it running after you log out and starts it at boot.

3. Check network control

keepcmd hub network status

Agents reach the network only through the keep's proxy, and won't start until that can be enforced. If the status says it can't be (common on Ubuntu), or that a firewall may keep Hearth Cmd or displays out, run the one root step:

sudo ~/.local/bin/keepcmd hub network install

4. Pair Loop Cmd

keepcmd hub pair

It shows a QR code. In Loop Cmd, open the Keep tab, tap Scan pairing code and scan it, or paste the link it prints. The code works once, for 10 minutes. Your phone can be anywhere: pairing goes through the relay, so this machine just needs to be online. For Hearth Cmd, on the same Wi-Fi: keepcmd hub pair --app hearth.

5. Let your agents in

keepcmd hub harness lists the harnesses the keep found, and their versions. To sign Claude agents in with your Claude account: keepcmd hub login-claude. For pi agents, give the keep a model provider's API key with keepcmd hub provider key anthropic (or openai, google, openrouter); it asks for the key, and agents never see it. Then, in Loop Cmd, open Keep → New agent.

Back up

keepcmd hub backup --to /path/to/a/folder

Backs the keep up, encrypted to your recovery key. It remembers the folder and backs up nightly, keeping the last 14. To move to a new machine: keepcmd hub restore <backup file>, with your recovery key. Your phones reconnect on their own.

Updates

A keep running as a service updates itself overnight from the signed release feed, and checks each release's signature first. To check or update now:

keepcmd hub update --check
keepcmd hub update --now

Uninstall

1. If you ran the root step (hub network install), first remove its firewall rules and AppArmor profile: sudo ~/.local/bin/keepcmd uninstall
2. Then, as yourself: keepcmd uninstall. It stops and removes the service and the program. Your keep's data stays, and it tells you where.
3. To erase the keep itself as well: keepcmd uninstall --delete-data. It removes ~/.keepcmd (its keys, its database and your conversations' copy) and ~/keepcmd_agents (your agents' folders), after you confirm. This can't be undone: without a backup and your recovery key, that keep is gone.

keepcmd uninstall needs Keep Cmd 0.1.14 or later. A keep updates itself overnight, or run keepcmd hub update --now.

To delete your Loop Cmd account too, see loopcmd.com.

Something not working? See Support.