CLI

keon is a drop-in neonctl-shape client for the Kisenon platform.

Install on macOS / Linux

curl -fsSL https://kisenon.com/install.sh | sh

Detects your platform, downloads the matching keon-<os>-<arch> binary, verifies the sha256 against /dl/latest/manifest.json, and installs into ~/.local/bin — or /usr/local/bin if that directory is writable (e.g. as root). It adds the directory to PATH in your shell rc file if it is not already there. The script is POSIX sh; bash is not required.

Install on Windows

The primary channel is winget:

winget install Seiraiyu.Keon

Or run the install script directly:

irm https://kisenon.com/install.ps1 | iex

It installs into %LOCALAPPDATA%\keon and adds that to your user PATH.

Installer environment variables

Both scripts read these. With curl | sh, set them on the sh side: curl -fsSL https://kisenon.com/install.sh | KEON_INSTALL_DIR=/opt/bin sh.

First login

keon login
keon me

keon login runs a loopback OAuth flow — no pasting keys. It starts a local listener on a random port, opens your browser to the console's authorize page, and waits for the redirect. After you authorize, the CLI exchanges the one-shot code at POST /v1/cli/exchange for a long-lived nsk_-prefixed API key, scoped to your active organization.

The key is persisted at ~/.config/keon/credentials.json with mode 0600. The CLI keeps only the resulting key — never the OAuth code, state, or any provider token. keon logout removes the file and tries to revoke the key server-side (best-effort: it warns and still exits 0 if the revoke fails); you can also revoke it any time from Settings → API keys. See Auth for the full flow.

Common commands

keon projects list
keon branches list --project <id>
keon connection-string <branch> --project <id>

keon connection-string prints the bare direct URI (so psql "$(keon connection-string main --project <id>)" works), whatever your output default is. --pooled prints the pooler URI instead and exits 1 with pooler_not_enabled if the endpoint has no pooler. -o json returns {"connection_string": "…"}.

Deleting a project also deletes its branches and endpoints — pass --cascade, or, if the project has any branch besides main, the API returns 409 has_branches:

keon projects delete <id> --cascade

The same --cascade flag applies to keon branches delete <id>.

Agent workflows

keon covers the agent-safe surface, not just projects and branches:

• keon sandbox — drive agent sandboxes: ephemeral, capture-and-promote database environments for agents.
• keon ledger — read the promote ledger and verify capture/promote attestations.
• keon ip-allow — manage a project's IP allowlist.

Other top-level commands include orgs, endpoints, databases, roles, snapshots, operations, usage, and audit. Run keon --help for the full set.

Output format

Default is JSON. For tables: keon config set output table, or pass --output table per command.

Install the Claude skill

keon install --skills

Drops a SKILL.md + reference docs into ./.claude/skills/keon/ so a Claude agent can drive the CLI without a setup turn.

Troubleshooting

macOS: "developer cannot be verified"

Only happens when the binary was downloaded via a browser with the Gatekeeper attribute set — install.sh does not set it. Strip it:

xattr -d com.apple.quarantine $(which keon)

Windows: SmartScreen warning

Click "More info" → "Run anyway". Once per machine. Installing via winget install Seiraiyu.Keon avoids the prompt. SmartScreen reputation on Windows builds over time.

macOS: which binary is signed

Only keon-macos-universal — the one install.sh fetches — is signed and notarized. The per-architecture keon-macos-arm64 and keon-macos-x64 binaries are not.

File a bug

github.com/Seiraiyu/seiraiyu-neon/issues