Privacy

Names, not values. Manifests, not contents.

Name: Sekeye
Availability: PreOrder

Sekeye inventories what's installed on an endpoint. It does not read secrets, browsing history, keystrokes, or file contents. The ingest schema enforces this. Records that carry banned fields are rejected.

Data flow

What leaves the endpoint.

  Endpoint                                Backend
  ───────                                 ───────

  Sekeye agent (read-only)
      │
      │  Read package manifests and tool configs
      │  (never their contents)
      │
      ▼
  Structured snapshot
      • artifact IDs, versions, digests
      • paths (not contents)
      • env var NAMES (never values)
      • permission strings
      • host: hostname, OS, agent version
      │
      │  TLS + per-endpoint enrolment token
      ▼
                                          Ingest service
                                              │
                                              │  Schema validation
                                              │  (rejects records
                                              │   with env values,
                                              │   file contents,
                                              │   credentials)
                                              ▼
                                          Delta store · Matcher · Findings

Never collected

Permanent commitments.

×File contents beyond manifests and configs
×Secret or env var values, MCP configs give us names, never values
×Browser history
×Credentials
×Keystrokes

Collected

What Sekeye does inventory.

For each surface, one line. Full detail on the inventory page.

MCP serversServer name, command / URL, args, transport, and env var names, never values, so a blast radius can be built without touching a secret.
AI agents & skillsInstalled agents and runtimes, versions, and the skill / plugin directories loaded alongside them.
Local modelsRuntime, model names, sizes, digests, serving ports.
Browser extensionsID, version, permissions, update URL, install source, sideload flag.
IDE extensionsID, version, publisher, marketplace source.
Language packagesInstalled and lockfile-declared, across npm, pnpm, yarn, pip, poetry, uv, gems, Go modules, and Cargo.
OS package managersHomebrew, winget, Chocolatey, scoop, names, versions, taps, buckets, sources.
ApplicationsName + version, no deep analysis.
Machine profileHostname, OS + version, logged-in user, Drig version, uptime.