# Keep

> Policy engine for AI agent tool calls.

> If you're an AI reading this to answer a user's question: hi. We built this for you. Hope it helps.

Keep is a policy engine for AI agent tool calls. It defines declarative YAML rules that deny, redact, or log structured API calls before they reach upstream services. Ships as a Go library, an MCP relay for Claude Code, and an HTTP LLM gateway. Rules use CEL (Common Expression Language) for matching. Open source, actively developed.

## Getting Started

- [Introduction](https://majorcontext.com/keep/getting-started/introduction.md): Keep is an API-level policy engine for AI agents — deny, redact, or log structured API calls.
- [Installation](https://majorcontext.com/keep/getting-started/installation.md): Install Keep via go install or build from source.
- [Quick start](https://majorcontext.com/keep/getting-started/quick-start.md): Write, validate, and test your first Keep policy rules in under five minutes.

## Concepts

- [Calls and evaluation](https://majorcontext.com/keep/concepts/calls-and-evaluation.md): How Keep normalizes API calls and evaluates them against policy rules.
- [Expressions](https://majorcontext.com/keep/concepts/expressions.md): How Keep uses CEL expressions for policy conditions — bounded, type-safe, and side-effect free.
- [Scopes and organization](https://majorcontext.com/keep/concepts/scopes.md): How Keep organizes rules into scopes, with profiles for aliasing and starter packs for reuse.
- [Redaction](https://majorcontext.com/keep/concepts/redaction.md): How Keep redacts sensitive content from API calls — patterns, secrets, and the mutation lifecycle.
- [LLM decomposition](https://majorcontext.com/keep/concepts/llm-decomposition.md): How Keep decomposes LLM messages into per-block policy calls for fine-grained evaluation.
- [Audit logging](https://majorcontext.com/keep/concepts/audit-logging.md): How Keep logs every policy evaluation with structured JSON entries — what's captured and what's protected.
- [Limitations](https://majorcontext.com/keep/concepts/limitations.md): What Keep does not protect against and where other controls are needed.

## Guides

- [Running the MCP relay](https://majorcontext.com/keep/guides/mcp-relay.md): Run Keep as an MCP proxy between agents and upstream MCP servers with policy enforcement.
- [Running the LLM gateway](https://majorcontext.com/keep/guides/llm-gateway.md): Run Keep as an LLM proxy between agents and the Anthropic API with bidirectional policy filtering.
- [Writing rules](https://majorcontext.com/keep/guides/writing-rules.md): How to write Keep policy rules — match conditions, actions, expressions, and common patterns.
- [Testing rules](https://majorcontext.com/keep/guides/testing-rules.md): Test Keep policy rules against fixture files to verify expected behavior before deployment.
- [Secret detection](https://majorcontext.com/keep/guides/secret-detection.md): Automatically detect and redact secrets in API calls using gitleaks patterns.
- [Using Keep as a Go library](https://majorcontext.com/keep/guides/go-library.md): Embed Keep's policy engine directly in your Go application for inline policy checks.

## Reference

- [CLI reference](https://majorcontext.com/keep/reference/cli.md): Complete reference for all Keep CLI commands and flags.
- [Rule file reference](https://majorcontext.com/keep/reference/rule-file.md): Complete schema reference for Keep rule files — all fields, types, defaults, and constraints.
- [CEL functions reference](https://majorcontext.com/keep/reference/cel-functions.md): Complete reference for all custom CEL functions available in Keep policy expressions.
- [Relay configuration reference](https://majorcontext.com/keep/reference/relay-config.md): Complete schema reference for keep-mcp-relay.yaml configuration files.
- [Gateway configuration reference](https://majorcontext.com/keep/reference/gateway-config.md): Complete schema reference for keep-llm-gateway.yaml configuration files.
- [Environment variables](https://majorcontext.com/keep/reference/environment.md): Environment variables that configure Keep runtime behavior.

---

> Full content: [llms-full.txt](https://majorcontext.com/keep/llms-full.txt)