CLI

keon is a drop-in neonctl-shape client for the Kisenon platform.

Install on macOS / Linux

curl -fsSL https://kisenon.com/install.sh | bash

Detects your platform, downloads the matching keon-<os>-<arch> binary, verifies the sha256 against /dl/latest/manifest.json, and installs into /usr/local/bin (or ~/.local/bin).

Install on Windows

The primary channel is winget:

winget install Seiraiyu.Keon

Or run the install script directly:

iwr -useb https://kisenon.com/install.ps1 | iex

keon login
keon me

keon login runs a loopback OAuth flow — no pasting keys. It starts a local listener on a random port, opens your browser to the console's authorize page, and waits for the redirect. After you authorize, the CLI exchanges the one-shot code at POST /v1/cli/exchange for a long-lived nsk_-prefixed API key, scoped to your active organization.

The key is persisted at ~/.config/keon/credentials.json with mode 0600. The CLI keeps only the resulting key — never the OAuth code, state, or any provider token. keon logout revokes the key server-side and removes the file; you can also revoke it any time from Settings → API keys. See Auth for the full flow.

Common commands

keon projects list
keon branches list --project <id>
keon connection-string <branch> --project <id>

Deleting a project also deletes its branches and endpoints — pass --cascade, or the API returns 409 has_branches:

keon projects delete <id> --cascade

The same --cascade flag applies to keon branches delete <id>.

Agent workflows

keon covers the agent-safe surface, not just projects and branches:

keon sandbox — drive agent sandboxes: ephemeral, capture-and-promote database environments for agents.
keon ledger — read the promote ledger and verify capture/promote attestations.
keon ip-allow — manage a project's IP allowlist.

Other top-level commands include orgs, endpoints, databases, roles, snapshots, operations, usage, and audit. Run keon --help for the full set.

Output format

Default is JSON. For tables: keon config set output table, or pass --output table per command.

Install the Claude skill

keon install --skills

Drops a SKILL.md + reference docs into ./.claude/skills/keon/ so a Claude agent can drive the CLI without a setup turn.

Troubleshooting

macOS: "developer cannot be verified"

Only happens when the binary was downloaded via a browser with the Gatekeeper attribute set. Strip it:

xattr -d com.apple.quarantine $(which keon)

Windows: SmartScreen warning

Click "More info" → "Run anyway". Once per machine. Installing via winget install Seiraiyu.Keon avoids the prompt. (The macOS binaries are signed and notarized; SmartScreen reputation on Windows builds over time.)

File a bug

github.com/Seiraiyu/seiraiyu-neon/issues

On this page