Projects/Aken
Since 2026
A collector runs on the server as an unprivileged user and only makes outbound HTTPS requests. It redacts logs before they leave the machine, encrypts them, and passes them through a relay with a short TTL to an MCP server running locally, which offers the agent typed read jobs - either in a live session with approvals in the terminal, or over a single reviewed artifact. The agent never gets a shell, an SSH key, or a network path to the server.