Kerna is the runtime trust layer for AI agents. It governs MCP tools, bounds execution, and keeps a receipt for every run.
npm install -g @premxai/kerna
Select a tool call to inspect its decision. Illustrative data.
Sits in front of the tools you already use
Kerna sits between a model and the MCP tools that can touch files, services, and external systems. Nothing runs until it passes the boundary.
Ask for a bounded outcome. Relevant local memory is retrieved.
Runs the task loop across model calls and tool discovery.
Explicit grants, approvals, and hard limits. Ungranted means denied.
Plugins run as untrusted child processes over stdio.
A structured record lands in SQLite for inspect and replay.
A narrow core that owns safety and orchestration, and nothing else. Your models and capabilities stay replaceable.
Tools receive no capability unless it is explicitly granted. Rules are evaluated top to bottom and the first match wins.
version = 1 default = "ask" [[rules]] id = "deny-external-actions" effect = "deny" kind = "external" [[rules]] id = "allow-worktree-reads" effect = "allow" kind = "file_read"
Consequential actions pause for a clear local decision.
notes.write_noteWaitingCreate “Standup notes” in your workspace.
Limits on calls, runtime, cost, output, and memory writes stop runaway work.
Plugins are untrusted child processes with sandboxed working directories and watchdog cleanup.
Swap models without changing the trust boundary.
Runtime, workspace, policies, and receipts live on your machine.
Every run becomes a structured, redacted record: decisions, action digests, budgets, and failures. Inspect and replay instead of trusting an opaque “done.”
$ kerna trace last tool.call.requested notes.write_note tool.policy.checked ask → approval needed approval.decided approved (local) budget.checked tool calls 4/20 tool.call.started tool.call.completed
Put Kerna in front of any client that speaks MCP. Tools routed through it are checked and recorded locally, and fail closed when a rule denies or requires confirmation.
Kerna governs tools routed through its MCP server. It does not govern a client’s native editor, terminal, or built-in tools.
# 1. Generate a reviewable contract kerna contract init --template deployment-assistant ` --name "Deployment assistant" --output .\kerna-demo # 2. Print client config (changes nothing) kerna client config --client qoder --workspace .\kerna-demo # 3. Verify a real MCP handshake kerna client doctor --client qoder --workspace .\kerna-demo # 4. Watch governed calls live kerna dashboard --workspace .\kerna-demo
Kerna is not an agent framework and owns no domain logic. Calendar, notes, search, and the rest live in external MCP plugins.
Task loop, memory injection, model calls, tool lifecycle.
scheduler.rsDenies ungranted capabilities. Asks when it matters.
permissions.rsAborts any run that exceeds its declared limits.
budget.rsSpawns and supervises plugins over stdio.
mcp_registry.rsStructured SQLite events and local memory.
events.rsA deterministic suite that runs on every pull request. A single failure is a regression to fix, not noise to average out.
Task success and safety are never blended into one number. External suites such as AgentDojo publish nothing until a matched control run produces verifiable Kerna receipts.
Every published result lists the version, commit, policy, trial count, and redacted artifacts.
Read the methodologyStart with the mock provider. No API key, ideal for learning the control loop.
npm install -g @premxai/kerna
Prebuilt binaries, desktop installers, and SHA-256 checksums are on the latest release.
# Fail-closed workspace, no API key kerna init --ci --provider mock kerna pack install productivity kerna doctor # Run a bounded task, then inspect it kerna run "Prepare my morning brief" kerna inspect last kerna trace last
Open source, local-first, and fail-closed from the first command.