Back to APJFAY StudioPortfolio · Hostkeep · a site built by APJFAY Studio
Hostkeep

MCP for Windows Private beta · running on real machines

Ask your machines
what happened
last night.

Your AI assistant checks the logs on your Windows machines and tells you what broke. No remote desktop, and only the access you allow.

Get set up Try the demo
  • Every project walled off
  • Read-only by default
  • No admin rights, no Hostkeep cloud

Private beta: we set it up with you personally.

Backed byThe Climate Truth
A small castle keep on a hill at night, one window lit, a beacon pulsing above it
An ordinary night on vm-2

02:04 · nightly-import exited with code 1

Your assistant has a way in.
You decide how far it goes.

07:31 · the morning after

One question.
A clear answer.

Pick a situation and watch what happens.

your assistant · hostkeep @ vm-2connected
  1. The nightly import on vm-2 failed at 02:04. What happened?
  2. project_roots_listvm-23 projects
  3. filesystem_searchtrading-bot · "ERROR|Timeout" in logs/3 matches
  4. filesystem_read_rangelogs/import-10-08.log · lines 1180–121435 lines
  5. git_logtrading-bot · since Monday4 commits
  6. git_diffa41f9c2 · config/feeds.json1 file
  7. AI

    The 02:00 run timed out calling the price feed (log line 1197: TimeoutError after 5000 ms). On Tuesday, commit a41f9c2 “switch price feed” moved to a slower endpoint but kept the 5-second timeout.

    Suggested fix: 30 seconds and one retry. Shall I run the tests first?

  8. Yes, run them.
  9. run_teststrading-bot · unit-tests (fixed task)48 passed
  10. AI

    All 48 tests pass. The fix is a one-line change in config/feeds.json. This project is read-only for me, so the edit is yours to make.

Scope on this machine

project trading-botaccess readtasks unit-tests

What Hostkeep records

  1. 07:31:05project_roots_listok
  2. 07:31:06filesystem_searchok
  3. 07:31:07filesystem_read_rangeok
  4. 07:31:08git_logok
  5. 07:31:09git_diffok
  6. 07:31:41run_testsok

Seven walls

01020304050607

Every call passed all seven checks and was recorded.

6calls
0changes
0refused
Illustrative session. Tool names, scopes and refusal codes are real Hostkeep behavior. Hostkeep has no chat window of its own: your assistant is the interface.
03:10 · what it's for

Built for the work that breaks at night.

Bots, scrapers and client servers that run on Windows while you sleep.

07:31Workflow · W1

Diagnose a failed job

The cause, from the logs and recent changes.

“Why did last night's import on vm-2 fail?”

READ-ONLY
07:38Workflow · W2

Collect outputs and logs

A summary of what last night's run produced.

“Summarise today's scraper output and list the failures.”

COLLECTED
07:46Workflow · W3

Keep clients apart

Each client is its own walled-off project.

“Run the unit tests for the Acme project only.”

WALLED
04:00 · how it works

Draw the walls once. Ask forever.

One small program per machine. You choose what it can see and do.

  1. Install on the machine

    No admin rights, nothing opened to the internet.

  2. Name projects and tasks

    Pick the folders it may read and the tasks it may run.

  3. Connect your assistant

    Connect your assistant with a token. Then just ask.

config/local.jsonreal format
{
  "host": "127.0.0.1",
  "auth": { "tokenEnv": "HOSTKEEP_TOKEN" },
  "projectRoots": [
    { "id": "trading-bot", "path": "D:\\bots\\trading",
      "allowWrite": false },
    { "id": "client-acme", "path": "D:\\clients\\acme",
      "allowWrite": true, "writablePaths": ["reports"] }
  ],
  "commands": [
    { "id": "unit-tests", "executable": "npm", "args": ["test"],
      "rootIds": ["trading-bot"], "testCommand": true }
  ],
  "hostAccess": { "enabled": false }
}
04:40 · security model

Seven walls. None of them trust the AI.

Assistants can be tricked. So every limit is enforced on your machine, not left to the AI.

Security plan of the keepSeven concentric walls around the keep. A request enters through the gates on the south side. An attempt to reach another client's folder from inside is stopped at wall 03. 7 INDEPENDENT CHECKS · NONE TRUST THE AINKEEPTOKEN + HOST CHECKED../client-zen/.envREFUSED · PATH_OUTSIDE_ROOT01020304050607REQUEST PATHREFUSEDWALL (CHECK)HOSTKEEPSECURITY PLAN · SHEET S-1SCALE NTSREV 2026-10-08
  1. WALL 01

    A locked gate

    Every request needs your access token first.

  2. WALL 02

    Only what you switch on

    Tools you haven't enabled don't exist for the AI.

  3. WALL 03

    Walled-off projects

    It can't reach files outside the project.

  4. WALL 04

    Read-only by default

    Writing is switched on per project, per folder.

  5. WALL 05

    Tasks, not a shell

    It runs only the commands you wrote down.

  6. WALL 06

    Secrets stay home

    Your token never reaches the programs it starts.

  7. WALL 07

    Everything on the record

    Every action is logged, and edits to the log show.

Each wall is tested, and unfinished parts are listed openly. Read the full security model →

05:20 · proof

Trust should come with receipts.

Measured on Windows 11.

FIG. 1 · TESTS
192/ 192 pass

Automated tests, all passing.

full suite · Windows 118 OCT 2026E-1
FIG. 2 · CONTAINMENT
0/ 100,000
43,220 folder swaps0 escapes

Escapes from a project under a 100,000-step attack.

stress suite8 OCT 2026E-2
FIG. 3 · SOAK
17,766calls
start 141 MB260 MB

One hour non-stop, zero errors. Memory stays flat.

62 one-minute samples7 OCT 2026E-3
FIG. 4 · SPEED
0.57ms median
p500.57 ms
p950.94 ms
p991.16 ms

Per file read, safety checks included.

local NTFS8 OCT 2026E-4
06:40 · for good causes

Free for nonprofits and climate groups.

Same product, same personal setup, no charge. During the beta and after it.

Get set up free
The Climate Truth logo Backed byThe Climate TruthA grassroots climate advocacy network that Fay is part of.
07:05 · questions

Good to know.

What exactly is Hostkeep?

A small program that runs on a Windows machine or VM and lets an AI assistant work on it through the Model Context Protocol (MCP). It can read logs, search code, query data and run tasks you defined, inside project folders you choose.

Where does my data go?

There is no Hostkeep cloud. Hostkeep runs on your machine and answers your assistant directly. What the assistant reads goes to the AI provider you chose, and nowhere else.

How is it different from remote desktop or IT management tools?

Remote desktop gives a person the whole screen. IT management suites manage fleets for IT departments. Hostkeep gives your assistant a narrow, recorded view of specific projects, so "what went wrong?" takes one message instead of a login session.

Can the AI run anything it wants?

No. By default it can only read inside the projects you named. Writing is switched on per project, control files stay protected, and it can only run commands you defined in advance, with checked parameters. Broader host access exists as a separate, advanced option that is off by default.

All questions →

07:30 · MORNING

You already know what broke.

Now onboarding the first teams. Tell me what you run on Windows, and I'll set it up with you.

Get set up Read the security model
fay@hostkeep.tech