Don't ship with a hole in the hull.

Keelix scans your Docker host and finds the security holes before an attacker does. 93 checks across the host, your containers, and what is exposed to the internet. It runs on your box and tells you what to fix.

operator@host — keelix
# install — free & open source (Apache-2.0)
$ curl -fsSL https://keelix.dev/install.sh | sh
# checks the whole box — 93 checks
$ keelix scan
CHECKS93 deterministic
COVERShost · containers · AI tooling
CLI PRICE$0 · Apache-2.0
Scan Record — Security PostureREF KLX·2606·64
REVIEW64/100
VERDICT · AMBERHOLD FOR REVIEW
Exposure
CC6.6
WARNINGRedis bound to 0.0.0.0 — reachable from the internet
Supply chain
CC7.1
PASSno KEV-listed CVEs on routable services
Host
A.8.20
PASSSSH password auth disabled
AI tooling
CC7.2
CRITICALplaintext secret in MCP config
WHOLE BOX

Host, containers, exposure.

It checks the operating system, the containers, and what is actually reachable from the internet.

CONTROLS

Maps to frameworks, too.

Every check also names the SOC 2, ISO 27001, or CIS control it covers. Handy when a compliance review comes around.

AI TOOLING

Covers AI agents and MCP.

19 checks for the AI agents and MCP servers on your box, the questions now landing on security reviews.

Continuous

It keeps watching.

Sentinel re-runs the checks on a schedule and tells you the day something drifts. Bring your own AI key (Anthropic, OpenAI, Gemini, or a local model) and it explains what changed. The AI only reads results. It cannot touch your box. Free in the CLI, no cloud account needed.

Sentinel — Tick Log
04·14 02:00 · 93 CHECKS · 91/100 · GREEN
ENTRIES 017–044 · NO CHANGE · 0 ALERTS
05·12 02:00 · NEW FINDING · SSH PASSWORD AUTH ENABLED · WARNING
05·13 02:00 · 93 CHECKS · 92/100 · GREEN · FIXED
06·11 14:02 · NO CHANGE · 0 AI CALLS
The report

A report of what to fix.

Markdown, HTML, or PDF. Every finding comes with what it means and how to fix it. Keelix Cloud keeps the history and a link you can share.

Security Posture ReportREF KLX·2606·93
Attestation
PREPARED BY KEELIX CLI · CATALOG v2.4.0
93 CHECKS EXECUTED · SAME INPUT, SAME VERDICT
FORMATS: MARKDOWN · HTML · PDF
Control coverage matrix
CC6.1Logical access controlsPASS
CC6.8Unauthorized softwarePASS
CC7.1Configuration monitoringPASS
CC7.2Anomaly monitoringCRITICAL
NOT ASSESSED — 12declared, with reasons
Pricing

Free to run. Cloud keeps the history.

The CLI does everything: all 93 checks, the report, and Sentinel. It is free and open source. Keelix Cloud stores your scans, tracks changes over time, and sends alerts. $19 a month, or $190 a year.

Free
All 93 checks
Report (Markdown, HTML, PDF)
Sentinel
CI gate (GitHub Action)
$0 · Apache-2.0 · forever
Cloud
Scan history and trends
Scheduled scans
Alert channels
Share link · teams · SSO · audit log
$19 a month · $190 a year

RUNS ON YOUR BOX · NO ACCOUNT · NO TELEMETRY

operator@host — keelix
# install — free & open source (Apache-2.0)
$ curl -fsSL https://keelix.dev/install.sh | sh
$ keelix scan