Local-first agent governance

Let AI code. Don't let it touch your repo unchecked.

Skep runs coding agents in an isolated worktree, independently re-verifies the patch on a clean copy, and gives you the final approval before anything reaches your repository.

Install skep View on GitHub

$  pipx install skep

Or uvx skep to try it · macOS Seatbelt / Linux bubblewrap · Python 3.12+ · MIT

RUN 7d31f9c2

RUNNING 00:18:42

01 WORKER STARTED

isolated worktree

02 FILES CHANGED

3 files, +142 −12

03 WORKER CLAIM

"tests passing"

04 INDEPENDENT VERIFY

replayed on a clean copy

05 PATCH READY

awaiting your approval

SUMMARY

workerclaude_code

modeworkspace

verify cmduv run pytest

re-verifypassed [confirmed]

lands onskep/7d31f9c2

PATCH PREVIEW

src/auth/session.py

45     def is_authenticated(user):
46 -    if not user or user.expired:
46 +    if not user or user.is_expired():
47         return False

Works with the agents you already use

Claude Code Codex Aider Ollama Built-in worker

The worker's claim is never the evidence.

A model saying "tests passed" is a sentence, not a proof. Skep replays the patch on a clean worktree and re-runs the recorded command itself.

See the full lifecycle

Sandbox

Disposable Git worktree with the root filesystem read-only and network by policy.

Execute

The agent edits, runs commands, and emits a durable event stream as it goes.

Verify

Skep re-applies the patch to a fresh baseline worktree and re-runs the checks.

Approve

You read the patch and the evidence. Approval lands it on skep/<id>, never main.

The risk

Raw coding agents move fast, and wide.

They are genuinely productive. They can also install packages, run broad shell commands, edit outside the intended project, and report success without a separate verifier.

They mutate repos directly

An agent can edit, commit, or push before you have read a single line of the actual diff.

They run broad commands

Package installs, arbitrary shell, and outbound network calls need an explicit boundary.

They overstate verification

"Tests passed" from the same process that wrote the code is not an independent check.

The control plane

Skep puts the agent behind a contract.

Sandbox

OS-level containment

macOS Seatbelt and Linux bubblewrap keep writes and network inside policy. If no backend can be applied, the worker does not start.

Sandboxing

Verify

Evidence over claims

A run is confirmed only when the worker said passed and Skep's own replay says passed too.

Verification layer

Approve

A patch, not a promise

Approval applies the patch to a branch named skep/<task_id>. Skep never pushes it.

Policies & approvals

Audit

A record you can read later

Every run, event, command, approval, artifact, and decision is written to a durable local ledger.

Observability & logs

Approvals

Start narrow. Get quieter, not looser.

When a worker hits a gate, Skep stops and asks in the same terminal. Approve once, or approve and remember — a remembered approval that resumes successfully becomes a learned template for similar future work in that repo.

The default policy never widens on its own.

Every decision is recorded with repo, action, resource, and actor.

Templates capture only the permissions that actually worked.

Read the approvals flow

$ skep run ~/code/app "add rate limiting" --execution-mode workspace

approval needed: shell.run
  reason:  shell.run requires approval for command: python -m pytest
  [a] approve once  [b] approve + remember  [d] deny  [s] skip
> b

resumed: original-task -> resumed-task
  state:        completed
  verification: passed
  re-verify:    passed [confirmed] (G10)
  saved template: rate-limiting

Quickstart

Five minutes, start to patch.

Install, run a task, review the evidence, approve the branch.

Full quickstart guide

1Install from PyPI

pipx install skep
# Linux sandbox backend:
sudo apt install bubblewrap

2Run a supervised task

skep run /path/to/repo \
  "fix the failing test" \
  --execution-mode workspace

3Review, then approve

skep status --personal
skep review <task_id>
skep review <task_id> --approve

The command deck

A chat box that is also a command line.

Any message starting with / is parsed by the UI and executed against the same HTTP API the buttons use — the assistant's model never sees it. Reads render immediately; mutations show the same confirmation card a model proposal would, audited under actor operator-command.

Explore the CLI

/help

List the deck

/workon

Select a repository

/runs

Recent runs

/approvals

Pending queue

/policy

Effective policy

/land

Land a patch (confirm)

Honest limits

Skep makes agents safer. It is not a silver bullet.

The boundary is real, and it is worth stating exactly where it stops.

Reads are not fully confined

The environment allowlist is what closes secret exposure, not the filesystem boundary.

Verification is only as strong as the command

If a worker records true, Skep can only confirm that true exits zero.

Your machine is still your machine

Malware, a compromised OS, or secrets committed to the repo are out of scope.

Read the full security model

Put a verification layer between agents and your code.

Local-first, open source, no account, no cloud. Your code stays with you.

Install skep View documentation