CLI Reference - Neural Inverse

keystone-capture-agent

The headless capture daemon. Records AI coding assistant activity to an encrypted local store.

keystone-capture-agent [COMMAND]

Commands

Command	Description
(none)	Run capture daemon in foreground
`inspect`	View recent captured events in plaintext
`export`	Export signed JSON bundle
`schema`	Show event types and field schema
`status`	Show daemon status and chain health
`install`	Install as system service (auto-start on login)
`uninstall`	Remove system service
`hooks`	Manage AI tool integration hooks
`api`	Run REST API server for scripts and integrations
`stream`	Stream events as JSON Lines (pipe to `jq`, etc.)
`query`	Query events with filters
`version`	Show version information
`help`	Show help

Environment Variables

Variable	Default	Description
`KEYSTONE_DATA_DIR`	`~/.keystone-capture`	Data directory for encrypted store and keys
`KEYSTONE_LOG_LEVEL`	`info`	Log level: `debug`, `info`, `warn`, `error`
`KEYSTONE_HOOK_ADDR`	`127.0.0.1:9193`	Hook receiver address for AI tool webhooks

inspect

View recent captured events in plaintext.

keystone-capture-agent inspect [OPTIONS]

Flag	Default	Description
`-n`	`50`	Number of events to show
`-action`	(all)	Filter by action prefix (e.g., `file`, `process`, `shell`)

Examples:

# Show last 50 events
keystone-capture-agent inspect

# Show last 200 file events
keystone-capture-agent inspect -n 200 -action file

# Show process detections
keystone-capture-agent inspect -action process

export

Export a signed JSON bundle suitable for auditors and compliance review.

keystone-capture-agent export [OPTIONS]

Flag	Default	Description
`-o`	`-` (stdout)	Output file path
`-pseudonymize`	`false`	Replace usernames with pseudonyms. Note: pseudonymized exports are NOT independently verifiable
`-anchor`	`false`	Request RFC 3161 timestamp from TSA for audit-grade external proof
`-tsa-url`	`timestamp.digicert.com`	RFC 3161 TSA URL

Examples:

# Export to stdout (pipe to jq for viewing)
keystone-capture-agent export | jq .

# Export signed bundle to file
keystone-capture-agent export -o audit-2026-10.json

# Export with RFC 3161 timestamp anchor
keystone-capture-agent export -o audit.json -anchor

# Export with privacy pseudonymization
keystone-capture-agent export -o audit.json -pseudonymize

Export bundle format:

{
  "version": 1,
  "exported_at": "2026-10-03T12:00:00Z",
  "agent_version": "0.1.0",
  "chain_status": {
    "total_events": 365,
    "head_hash": "f039eca40199acdb...",
    "chain_valid": true
  },
  "signed_data": "base64...",
  "signature": "base64...",
  "public_key": "base64...",
  "events": [...]
}

schema

Print the event type schema — all event categories and their fields.

keystone-capture-agent schema

status

Show daemon status, data directory, chain health, and event counts.

keystone-capture-agent status

Output includes:

Data directory path
Store initialization state
Total events and chain integrity
Signing key status
Running processes detected

install / uninstall

Manage the system service for auto-start on login.

# Install as launchd (macOS) or systemd (Linux) service
keystone-capture-agent install

# Remove the service
keystone-capture-agent uninstall

Platform	Service Manager	Service Name
macOS	launchd	`com.neuralinverse.keystone-capture`
Linux	systemd (user)	`keystone-capture.service`

hooks

Manage AI tool integration hooks. Hooks allow Keystone to receive real-time notifications from AI tools.

keystone-capture-agent hooks [SUBCOMMAND]

Subcommand	Description
`install`	Install hooks for all detected AI tools
`uninstall`	Remove hooks from all AI tools
`status`	Show hook status for each tool

Supported AI tools:

Tool	Hook Type	Config Location
Claude Code	`settings.json` hooks	`~/.claude/settings.json`
Codex	Hook config	`~/.codex/hooks.json`
Copilot CLI	Hook config	`~/.copilot/hooks`
Kiro	Hook config	`~/.kiro/hooks`
Cursor	Extension hooks	`~/.cursor/`
Gemini CLI	Hook config	`~/.gemini/hooks.json`
Windsurf	Extension hooks	`~/.windsurf/`
Cline	VS Code extension	VS Code settings
Trae	Extension hooks	`~/.trae/`

api

Run a REST API server for programmatic access.

keystone-capture-agent api [OPTIONS]

This starts the same API server used by the tray UI. See API Reference for all endpoints.

stream

Stream events in real-time as JSON Lines. Useful for piping to jq, log aggregators, or custom tooling.

keystone-capture-agent stream [OPTIONS]

Examples:

# Stream all events
keystone-capture-agent stream

# Stream and filter with jq
keystone-capture-agent stream | jq 'select(.action | startswith("file"))'

# Stream to a file
keystone-capture-agent stream >> events.jsonl

query

Query captured events with filters.

keystone-capture-agent query [OPTIONS]

Flag	Description
`--type TYPE`	Filter by event type (e.g., `file.open`, `process.detected`)
`--since DURATION`	Events since duration (e.g., `1h`, `24h`, `7d`)
`--target PATTERN`	Filter by target path (substring match)

Examples:

# Query file events from last hour
keystone-capture-agent query --type file --since 1h

# Query events targeting a specific project
keystone-capture-agent query --target /Users/dev/myproject --since 24h

keystone-capture-tray

Desktop menu bar app with web UI.

keystone-capture-tray [FLAGS]

Flag	Description
(none)	Run as macOS menu bar tray icon
`--window`	Open the web UI directly in a browser/webview

The tray app provides:

Menu bar icon with quick status
Start/stop capture from the menu
Web UI for monitoring, configuration, and audit verification
All API endpoints on a local port

keystone-capture-verify

Independent chain verification tool. Can be distributed to auditors — it only needs the export bundle and the public key.

keystone-capture-verify [OPTIONS] <export-file>

Flag	Default	Description
`-expect-key`	(none)	Expected key fingerprint (first 16 hex chars of public key)
`-json`	`false`	Output results as JSON
`-version`		Show version

Verification checks:

Check	Description
Ed25519 signature	Verifies the `signature` is valid for `signed_data`
Data integrity	Verifies `signed_data` matches the events array
Chain linkage	Verifies `previous_hash` → `entry_hash` continuity
Head hash	Verifies `head_hash` matches the last `entry_hash`
Key pinning	Optionally verifies the public key fingerprint matches `-expect-key`

What verifiers CANNOT check (requires the HMAC key, which stays on the capture machine):

entry_hash derivation (chain_status is the exporter's claim)
That events weren't omitted before export

Examples:

# Verify an export bundle
keystone-capture-verify audit-2026-10.json

# Verify with key pinning
keystone-capture-verify -expect-key f039eca40199acdb audit.json

# JSON output for CI/CD integration
keystone-capture-verify -json audit.json | jq .

Was this page helpful?

On this page