Every agent gets a name and an owner.

A git forge for code that agents write. Each session gets its own identity, every push lands in the audit log, and agents can ask how the code connects.

Join the waitlist Sign in

Browse the live demo or read the docs.

The Fleet page, listing live agent sessions with their owners, activity and a Revoke button

No training on your code. Data use →
Every action audited. Audit log →
Scoped, revocable tokens. Agent tokens →
Open standards: OAuth, WebAuthn, MCP. Standards →
Self-host the single binary. Self-host →

Start with one repo

Point it. It indexes.

Paste any GitHub, GitLab, or git remote URL. No install, no webhook setup. History, symbols, audit row, and graph arrive together.

import

$ citadel-cli import https://<remote>/repo.git
1. cloning over HTTPS (read-only)
2. building symbol index
→ cloned
→ 986 symbols indexed (go + ts)
→ audit row written - keyed to your namespace
→ knowledge graph ready

Next action

After indexing, the repo is queryable. Search symbols, view the knowledge graph, or open the wiki to start documenting. See all migration options.

What arrives

Everything, at once.

The import produces the same four outputs as a native push: a full clone, a symbol index, an append-only audit entry, and a queryable knowledge graph. Nothing is deferred.

cloneindexauditgraph

Permissions and scope

accessRead-only clone over HTTPS or SSH. GitHub OAuth, GitLab token, or any public remote.

arrivesCommit history, branches, tags, source files, and symbol graph. From GitHub, GitLab, and Gitea, also labels, milestones, issues, and pull requests.

not includedCI status and star counts stay on your origin host. Bitbucket imports bring code and git history only.

What you get

Four surfaces, one index.

Knowledge graph

Code, queryable.

Symbols, callers and cross-language edges, rebuilt on every push.

Explore the graph →

Wiki

Docs that stay in sync.

Reference blocks and coverage reports tied to the graph.

See the wiki →

Agents

Built for MCP.

Scoped tokens, real protocol tools, an audit entry for every action.

Agent access →

Migration

Bring your repos.

Import or mirror from any git remote. History and indexing arrive together.

Import path →

No harvesting

We never index your code to rank, sell or train an AI model.

No trending feed, no showcase, no training corpus. The only index we build is yours. Follow the live demo loop →

push

$ git push origin main
→ audit row #1170 keyed to dev@example.com
→ kg 986 symbols indexed (go + ts)
→ pg edges +6

What a push produces

Four artifacts land on every push.

Artifact	Written
audit row	actor - action - namespace - timestamp
kg symbols	functions, types, consts - each with a body hash
pg edges	depends_on - pins - from go.mod, package.json
cross-lang edge	TS fetch() resolved to its Go handler

See it live

Follow the loop, step by step.

Every stop below is a public, anon-readable surface running on our own source. No account needed.

A push writes an audit receipt.

Every commit lands one append-only row in the audit log: who pushed, what changed, when. Open the repo home to see the push receipts keyed to this namespace.

repo home →

The receipt produces a queryable project graph.

Each push rebuilds the knowledge graph: symbols extracted, cross-language edges indexed, callers mapped. Open insights to query the live graph for this repo.

graph + index →

Every symbol is searchable across languages.

The index is fully searchable by name, kind, and file. Functions, types, and variables from Go and TypeScript resolve in a single query. Open search to browse it.

searchable context →

Agents read the same index over a real protocol.

The wiki surface exposes the same project context that an MCP client receives: pages, symbol tables, caller lists. No scraping, no polling. Open the wiki to browse it.

agent-readable wiki →

Try a symbol search on the live demo

symbol search

$ GET /api/namespaces/rethunk/kg-cross-lang-smoke-utdjor/kg/symbols?q=AssignSeat
→ matches: AssignSeat (function) seat.go
→ callers: 3 resolved across 2 files
→ total: 1

Run this search live →Agent token docs →Browse the wiki →

Security & governance

Built for teams that get audited.

Self-host

Offline license, no phone-home.

SCIM 2.0

RFC 7643/7644 provisioning

Scoped tokens

Per action and namespace, revocable

Audit retention

90 / 365 / 2555-day retention by tier

Device policy

AAGUID passkey allowlists

Data export

Full account export on request

FAQ

Direct answers.

Do you index my code to train models?

No. We never index your repositories to train, rank, or sell.

Is it self-hostable?

Yes - one Go binary, offline license validation, no phone-home. Run it air-gapped.

How do agents connect?

A bearer token to the built-in MCP server - over 76 purpose-built tools, no HTML scraping.

Can I bring my existing repos?

Import over HTTPS or SSH, or mirror continuously with source-wins push rejection.

Is the audit log tamper-evident?

Not yet. Today it is standard Postgres rows; hash-chaining is on the roadmap. We won't claim WORM until it ships.

What does it cost?

Free for solo and open source. Pro is $4 per seat / month; Enterprise is $15 per seat / month and adds SSO, SCIM, policy, and seven-year audit retention. Self-hosted on-prem pricing is separate. See full pricing

git, indexed.

A push is the unit of work. Browse the public demo or start with your own namespace.

Browse the live demo Join the waitlist

Already have an account? Sign in