Quickstart

Install, try it on one repo, then run the admin web app locally. Every command in order, and what to do when one fails.

Private beta · free · takes about 10 minutes

1. Install the CLI

One static binary, no runtime, no account. Pick whichever line matches your machine.

There is deliberately no .msi or setup wizard. Skeg is one executable on your PATH; an installer package would add an uninstall entry, possibly ask for administrator rights, and give you nothing a copy of a file does not. The Windows script installs per-user into %LOCALAPPDATA%\Programs\skeg and needs no elevation.

Every path above verifies integrity: the shell and PowerShell installers check the download against the release's signed SHA256SUMS and refuse to install anything they cannot match; Scoop and WinGet carry the hash in their manifest; Homebrew carries it in the formula. Read install.sh or read install.ps1 before running either.

$ skeg version
skeg 1.0.0-rc2 (Apron, release candidate)
$ skeg
level 0 · not started      next: skeg try

Bare skeg always prints where you are and the single next step. skeg glossary <term> explains any word it uses.

2. Try it on one repo

$ cd your-repo
$ skeg try
added 22 files (tracked) · baseline: 0 high · level 1 · TRY
$ skeg undo    # removes exactly what it added; your files untouched

No gateway, no account, no login. You get the docs skeleton, agent rules (CLAUDE.md, AGENTS.md, .cursorrules from one source), a PR template, CI gates and a security scan of the working tree and git history. Endpoint hooks start in audit mode — they log, they do not block.

Worth trying next, in the same repo: skeg spec new "Your feature" --ticket AB-1, then skeg status, then skeg review --dry-run.

3. The admin web app

This is the local web app. It is part of the same binary — nothing extra to install, no Node, no Docker, no account.

$ skeg onboard --company "Your Co"     # creates the workspace folder
$ cd your-co-engineering
$ skeg admin
admin app on http://127.0.0.1:4200  ·  ctrl-c to stop

Open that address in your browser. It binds to the loopback interface, so it is reachable only from your own machine unless you deliberately change that.

Options

Roles, when more than one person uses it

By default a local single-owner run has full access. To split duties, set roles before starting:

$ SKEG_ADMIN_ROLES="tok-a:admin,tok-s:security,tok-p:product-lead" skeg admin

Behind an SSO proxy (oauth2-proxy, Pomerium, IAP) use header-based identity instead — set SKEG_ADMIN_SSO_HEADER and map your groups to roles. Admin ⊇ security ⊇ product-lead ⊇ viewer; every mutating action is written to a hash-chained audit log you can verify.

The eight screens

• Company — name and policy preset: startup, SOC 2, regulated or agency
• Products — the projects work is organised into
• Repos — paste two or three repository links and click Connect. Skeg applies the template, turns on the gates, sets branch protection and runs a baseline security scan before anything ships
• Policies — a slider per rule: audit, warn, block. Product overlays can only tighten the company baseline; an attempt to loosen it is rejected
• Tools — what you declared next to what developer machines actually report, with shadow tools and unrouted installs flagged
• Team & SSO — groups, roles, and the one command each developer runs
• Status — a checklist of what is done and what is still open
• Settings — gateway URL and tokens, stored outside the workspace and never committed

4. Set up a team (optional)

Only needed when you want the AI gateway, real logins, budgets and dashboards. Everything above works without it.

$ cp .env.example .env      # fill: provider key, master key, one login provider
$ docker compose up -d      # gate, authd, Postgres, Redis, logs, dashboards
$ curl -s localhost:4000/skeg/health

Then each developer runs skeg login --gateway https://<your-gate>, optionally skeg hooks install for endpoint governance and skeg agent install for continuous coverage. Kubernetes: helm install skeg deploy/helm/skeg gives multiple replicas, autoscaling, network policies and TLS. Fully offline: add docker-compose.local-model.yml and run your own model.

Which models? Set two lines in skeg/models.yaml — any OpenAI- or Anthropic-style endpoint works, hosted or self-hosted. Check with skeg models.

Versions and release names

Plain SemVer, and the promise matters more than the number: a patch is fixes only and always safe to take; a minor adds capability and will not change an existing command, config or gate verdict; a major breaks something and is announced 90 days ahead with a migration path and a deprecation warning from the CLI first.

Minor releases carry a codename, alphabetically, from the parts of a hull: 1.0 Apron, 1.1 Ballast, 1.2 Chine, 1.3 Deadwood, 1.4 Futtock, 1.5 Garboard. Names are for humans and never appear in a tag or a filename. skeg version prints both.

Each minor is supported until two further minors ship. Security fixes land on the current stable and the one before it.

Contributing

Apache-2.0, no CLA — you keep your copyright; just sign off your commits with git commit -s. Setup is two minutes: clone, make build, bash tests/regression.sh.

Easiest useful contributions: a stack pack (templates/repo/stacks/<name>/ — lint, test, build, CI job, agent rules; no Go at all) · a redaction pattern the gate misses, with its canary case · a skeg why explanation for a confusing gate failure · a glossary entry (CI fails if a term is undefined) · a hook rule for a destructive command we do not catch · an IDE or agent integration · making an error message less irritating, which is the highest-leverage work in the repo.

Pushed back, and why: a third-party Go dependency in the CLI, gate or authd (standard library only — it is a supply-chain promise) · a hard-coded model name (a CI guard fails the build) · a behaviour change with no test · telemetry that collects more · anything that needs customer content to leave their network · a 900-line PR, held to the same size gate as everyone.

Use skeg spec new then skeg pr: the same loop the product asks of your team. If an agent wrote most of it, say so in the PR — that is normal here.

Telling us what to fix

From the terminal where it happened. It prints exactly what would be sent first — version, platform, and whether a repo, template and hooks are present. Never your code, paths, branches or prompts.

$ skeg feedback bug "pr guessed the wrong ticket"
$ skeg feedback suggestion "let me skip the size cap on docs-only changes"

Prefer writing? Use the form or email feedback@skeg.dev.

Troubleshooting