Answers without the log dump
Search with regex, tail a file, or read around a matching line. Check service status, running processes, and disk usage.
Logs · services · processes · disk usage
Open source. Early days. Ready to try.
Give your agent
Give your agent
eyes on production.
The context to find the problem.
The boundaries to keep you in control.
Aken brings redacted production logs to your coding agent. No SSH keys to hand over. No endless copy-paste.
PRODUCTION CONTEXT, WITHOUT THE KEYS
$ sudo -u aken aken collect \
--unit nginx --since 1h
Review before anything leaves this machine.
sourceunit:nginxredactionIP addresses, tokens, emailsrelay TTL4 hours
14:02:18 upstream timed out
14:02:18 client: <ip#1>
14:02:19 authorization: <token#1>
14:02:18 client: <ip#1>
14:02:19 authorization: <token#1>
[s] send [v] view [a] abort
reviewed encrypted shared
Your coding agent via MCP
“The timeouts start at 14:02. I’ll search the surrounding log lines for the upstream error.”
searchcontexttail
YOUR AGENT. YOUR WORKFLOW.
LESS LOG WRANGLING. MORE DEBUGGING.
Stop being the
copy-paste middleman.
Your agent needs production context. So you open a terminal, find the logs, scrub a few values, paste a wall of text… and do it again for the next question.
Aken turns the logs you choose into a redacted, read-only view your agent can explore. It searches for the relevant lines, asks for more when it needs it, and helps you connect the dots.
One session. Room to investigate.FROM SERVER TO ANSWER
You open the window.
Your agent takes a look.
Three steps. A clear boundary.
You decide what crosses it.
ON YOUR SERVER 01 / 03
Set the scope.
Aken can read files under /var/log, plus any directories you add with --allow. For a live session, keep it running while your agent investigates.
# Open a live session
$ sudo -u aken aken serve
# Or collect a snapshot to review first
$ sudo -u aken aken collect \
--unit nginx --since 1h Runs as an unprivileged user. Outbound HTTPS only.
Explore live sessions ON YOUR MACHINE 02 / 03
Context, on your agent’s terms.
Connect your agent to the local MCP, then join the session with the token from your server. Ask your agent where the errors started or what to check next.
$ aken-mcp join
# Paste the token at the prompt, not in chat.
Ask: Check the nginx journal for errors. Read-only tools, within the scope you set.
Connect your agent IN YOUR SERVER TERMINAL 03 / 03
You approve the reads.
By default, Aken asks you to approve your agent’s requests before running them. It redacts and sends the results, pausing for your review when it flags strings to inspect.
Job approval
[a] approve [d] deny [v] view params
Flagged result review
[s] send [d] drop With --level 0, in-scope requests run without approval and every result is sent, flagged or not.
Understand approval levels SMALL TOOL. USEFUL BOUNDARIES.
Everything you need
to follow the evidence.
Built for solo developers, small SaaS teams,
and people looking after client servers.
Redact values. Keep the story.
The same value gets the same placeholder within a session, so your agent can connect events across lines. Add rules for your own app.
203.0.113.5 <ip#1>
Start with the logs you have
Read journald units, plain files, globs, and Docker logs using the journald driver. Choose sources without setting up a central log platform.
journald · files · Docker
Context with an expiry date
Live sessions expire after 8 hours by default and snapshots after 4. Set either to last up to 24 hours, or end a session early when you’re done.
aken-mcp end
A local record of what left
Aken keeps a local copy of everything it sent and the placeholder mapping on your server. Review exactly what you shared, with configurable retention.
Your server. Your audit trail.
Open to inspection
The collector, local MCP, redaction rules, and protocol are open source. Signed releases and reproducible builds help you verify what you run.
Read the sourceA CLEAR LINE BETWEEN CONTEXT AND ACCESS
Share the evidence.
Keep the keys.
Through Aken, your agent gets redacted, read-only results.
No shell, SSH key, or network path to production.
Redaction is an extra layer of protection and can miss sensitive data. Anything your agent reads goes to its model provider. The protocol and code have not been professionally reviewed.
Read the threat modelBRING YOUR NEXT “WHY IS THIS FAILING?”
Less pasting.
More investigating.
Install the collector on your server and the MCP on your machine. Connect your agent, open a session, and follow the evidence.
Install AkenCollector: Linux amd64 / arm64
MCP: Linux amd64 / arm64 · macOS arm64
Open-source tools · Hosted relay · No account needed
CONNECT YOUR AGENT
Install aken-mcp on your machine with Node 18 or later:
npm install -g aken-mcpNo Node? Use the script installer.
Register it in your terminal:
claude mcp add aken -- aken-mcp serveThen run aken-mcp join and paste the token from your server at the prompt.
A FEW GOOD QUESTIONS
Before you
open the window.
What can I use today?
With aken serve, your agent investigates live while you approve its requests in your server terminal. It can read logs and files, list directories, and check service status, processes, and disk usage. Approve requests one at a time or as a plan of up to 40 reads. To share a fixed snapshot instead, use aken collect: review the redacted logs, then upload them for your agent to explore.
Does my agent get access to the server?
Through Aken, your agent gets a fixed set of read-only tools and cannot run arbitrary commands. File reads stay under /var/log or directories you allow, and only where the unprivileged collector user has permission. There is no remote shell or inbound listener. Aken does not remove access your agent already has through other tools; keep SSH keys and SSH agent sockets outside its sandbox.
Can the relay read my logs?
Content is encrypted on your server and decrypted by the local MCP. In a live session, your agent’s requests are encrypted too. The relay has no content keys. It can see operational metadata such as identifiers, sizes, and expiry times. Keep the token private. Anyone holding a snapshot token can read that snapshot until it expires, and a live session token pairs your machine with the collector.
What happens when a session expires?
The relay stops serving the content and any live session ends. Your server’s local copy follows its own retention setting, and content already fetched or shared with a model provider is not recalled. Open a new session when you need fresh context.
Is Aken open source?
The collector, local MCP, relay, protocol, and redaction rules are available under Apache-2.0. The hosted relay at relay.aken.dev runs the same aken-relay binary, and you can run your own. You can inspect the code and verify signed releases before running anything on your server.