aken.
v0.4 · pre-release

Give your agent
eyes on production.

Let Claude Code, Codex or Cursor read redacted production logs through MCP, without SSH access or copy-paste.

For solo developers, small SaaS teams, and people looking after client servers. Your agent talks to Aken through a local MCP server on your machine.

Get started See how it works
Apache-2.0 No account needed
Production context, without the keys
your server · aken collect

$ sudo aken collect \
  --unit nginx --since 1h

aken collect: review before anything leaves this machine

sourceunit:nginxredactionIP addresses, tokens, emails

Upload 2814 lines, 412.3 KiB, 1 chunk, TTL 4h, relay https://relay.aken.dev
Local /var/lib/aken/runs/ (kept 30 days; includes the placeholder mapping)

14:02:18 upstream timed out
14:02:18 client: <ip#1>
14:02:19 authorization: <token#1>

[s] send [v] view everything [f] view flagged lines [a] abort

reviewed encrypted shared
Your coding agent via MCP

“The timeouts start at 14:02. I’ll search the surrounding log lines for the upstream error.”

searchcontexttail
Collecting a log snapshot · synthetic log data

Your agent. Your workflow.

Claude CodeCodex CLICursorBuilt on MCP

Less log wrangling. More debugging.

Stop being the
copy-paste middleman.

Your agent needs production context. So you open a terminal, find the logs, scrub a few values, paste a wall of text… and do it again for the next question.

Aken turns the logs you choose into a redacted, read-only view your agent can explore. It searches for the relevant lines, asks for more when it needs it, and helps you connect the dots.

One session. Room to investigate.

From server to answer

You open the window.
Your agent takes a look.

Three steps. A clear boundary.
You decide what crosses it.

On your server 01 / 03

Set the scope.

Aken can read files under /var/log, plus any directories you add with --allow. For a live session, keep it running while your agent investigates.

# Open a live session
$ sudo aken serve

# Or collect a snapshot to review first
$ sudo aken collect \
    --unit nginx --since 1h
Runs as an unprivileged user. Outbound HTTPS only.
Explore live sessions
On your machine 02 / 03

Context, on your agent’s terms.

Connect your agent to the local MCP, then join the session with the token from your server. Ask your agent where the errors started or what to check next.

$ aken-mcp join
# Paste the token at the prompt, not in chat.

Ask: Use the aken MCP to check the nginx journal for errors.
Read-only tools, within the scope you set.
Connect your agent
In your server terminal 03 / 03

You approve the reads.

By default, Aken asks you to approve your agent’s requests before running them. It redacts and sends the results, pausing for your review when it flags strings to inspect.

Job j7 from the agent: plan of 4 reads
[a] approve   [d] deny   [v] view params

14:02:07Z  tail /var/log/app/app.log  100 lines, 2 strings to inspect
[s] send   [d] drop
With --level 0, in-scope requests run without approval and every result is sent, flagged or not.
Understand approval levels

Small tool. Useful boundaries.

Everything you need
to follow the evidence.

Answers without the log dump

Search with regex, tail a file, or read around a matching line. Check service status, running processes, and disk usage.

Logs · services · processes · disk usage

Redact values. Keep the story.

The same value gets the same placeholder within a session, so your agent can connect events across lines. Add rules for your own app.

203.0.113.5 <ip#1>

Start with the logs you have

Read journald units, plain files, globs, and Docker logs using the journald driver. Choose sources without setting up a central log platform.

journald · files · Docker

Context with an expiry date

Live sessions expire after 8 hours by default and snapshots after 4. Set either to last up to 24 hours, or end a session early when you’re done.

aken-mcp end

A local record of what left

Everything Aken sent and the placeholder mapping are kept locally for 30 days by default. Review exactly what you shared on your server.

Your server. Your audit trail.

Open to inspection

All of Aken's code, including the relay, is open source under Apache-2.0. The hosted relay at relay.aken.dev is an operated service governed by the terms of service. Signed releases and reproducible builds help you verify what you run.

Read the source

A clear line between context and access

Share the evidence.
Keep the keys.

Through Aken, your agent gets redacted, read-only results.
No shell, SSH key, or network path to production.

Redaction is an extra layer of protection and can miss sensitive data. Anything your agent reads goes to its model provider. The protocol and code have not been professionally reviewed.

Read the threat model

Log lines can carry prompt-injection attempts. Through Aken the agent only has read-only tools, but keep its other permissions tight.

Sandbox the agent

Bring your next “why is this failing?”

Less pasting.
More investigating.

Install the collector on your server and the MCP on your machine. Open a session, connect your agent, and follow the evidence.

Collector: Linux amd64 / arm64
MCP: Linux x64 / arm64 · Apple Silicon macOS

Requirements

Your server needs Linux amd64 or arm64, systemd/journald for service logs, and sudo to install. Your machine needs Linux x64 or arm64, or Apple Silicon macOS. The npm installer requires Node 18+. No Go toolchain needed. Windows and Intel Macs are not supported yet.

Hosted relay

Free, no account, best effort, and run by one maintainer. Hosted in Germany (netcup, Cloudflare R2). Limits: 10 session creations per hour per address, 128 MiB per artifact, and a 24 h maximum lifetime. The relay counts, but does not yet enforce, two servers per developer address per 24 h. Relay details · Terms of service

On your server

  1. Install the collector

    curl -fsSL https://aken.dev/install.sh | sudo bash

  2. Start a live session

    sudo aken serve

    This prints a token. Keep the server terminal open while your agent investigates.

On your machine

  1. Install the MCP and register your agent

    With Node 18 or later:

    npm install -g aken-mcp

    Without Node, use the script installer:

    curl -fsSL https://aken.dev/install-mcp.sh | bash

    If the installer prints a PATH instruction, follow it before registering your agent.

    Register Claude Code in your terminal:

    claude mcp add aken -- aken-mcp serve

    Register Codex CLI in your terminal:

    codex mcp add aken -- aken-mcp serve

    For Cursor, add this to .cursor/mcp.json:

    {
  "mcpServers": {
    "aken": {
      "command": "aken-mcp",
      "args": ["serve"]
    }
  }
}

    Merge the aken entry with any existing servers.

  2. Join the session

    aken-mcp join

    Paste the token from your server at the prompt. Keep it out of agent chat.

Try it without installing

On your server, run this instead of steps 1 and 2. Then complete steps 3 and 4 on your machine.

curl -fsSL https://aken.dev/run.sh | sudo bash -s -- serve

Verify before you install

Full setup instructions

A few good questions

Before you
open the window.

What can I use today?

With aken serve, your agent investigates live while you approve its requests in your server terminal. It can read logs and files, list directories, and check service status, processes, and disk usage. Approve requests one at a time or as a plan of up to 40 reads. To share a fixed snapshot instead, use aken collect: review the redacted logs, then upload them for your agent to explore.

Does my agent get access to the server?

Through Aken, your agent gets a fixed set of read-only tools and cannot run arbitrary commands. File reads stay under /var/log or directories you allow, and only where the unprivileged collector user has permission. There is no remote shell or inbound listener. Aken does not remove access your agent already has through other tools; keep SSH keys and SSH agent sockets outside its sandbox.

Can the relay read my logs?

Content is encrypted on your server and decrypted by the local MCP. In a live session, your agent’s requests are encrypted too. The relay has no content keys. It can see operational metadata such as identifiers, sizes, and expiry times. Free, no account, best effort, and run by one maintainer. Hosted in Germany (netcup, Cloudflare R2). Limits: 10 session creations per hour per address, 128 MiB per artifact, and a 24 h maximum lifetime. The relay counts, but does not yet enforce, two servers per developer address per 24 h. Read about the relay. Keep the token private. Anyone holding a snapshot token can read that snapshot until it expires, and a live session token pairs your machine with the collector.

What happens when a session expires?

The relay stops serving the content and any live session ends. Copies are kept locally for 30 days by default, and content already fetched or shared with a model provider is not recalled. Open a new session when you need fresh context.

Is Aken open source?

All of Aken's code, including the relay, is open source under Apache-2.0. The hosted relay at relay.aken.dev is an operated service governed by the terms of service. You can run your own relay. You can inspect the code and verify signed releases before running anything on your server.