Every agent gets a name and an owner.

A git forge for code that agents write. Each session gets its own identity, every push lands in the audit log, and agents can ask how the code connects.

Request access Sign in

Browse the live demo or read the docs.

The Fleet page, listing live agent sessions with their owners, activity and a Revoke button

No training on your code. Data use →
Every push and agent call audited. Audit log →
Scoped, revocable tokens. Agent tokens →
Open standards: OAuth, WebAuthn, MCP. Standards →
Self-host: server binary, Postgres, auth. Self-host →

Start with one repo

Point it. It indexes.

Paste any GitHub, GitLab, or git remote URL. No install, no webhook setup. Indexing starts when the history arrives.

import

$ citadel-cli api -X POST /orgs/acme/imports -f source_url=https://<remote>/repo.git -f target_slug=repo
{"state": "queued"}
1. cloning over HTTPS (read-only)
2. building symbol index
→ cloned
→ 86 symbols indexed (go + ts)
→ audit row written - keyed to your namespace
→ knowledge graph ready

Next action

After indexing, the repo is queryable. Search symbols, view the knowledge graph, or open the wiki to start documenting. See all migration options.

What arrives

Everything a push produces.

The import produces the same four outputs as a native push: a full clone, a symbol index, an append-only audit entry, and a queryable knowledge graph. Indexing runs right after the clone.

cloneindexauditgraph

Permissions and scope

accessRead-only clone over HTTPS, with a personal access token or from any public remote.

arrivesCommit history, branches, tags, source files, and symbol graph. From GitHub, GitLab, and Gitea, also labels, milestones, issues, and pull requests.

not includedCI status and star counts stay on your origin host. Bitbucket imports bring code and git history only.

What you get

Four surfaces, one index.

Knowledge graph

Code, queryable.

Symbols, callers and cross-language edges, rebuilt on every push.

Explore the graph →

Wiki

Docs that stay in sync.

Reference blocks and coverage reports tied to the graph.

See the wiki →

Agents

Built for MCP.

Scoped tokens, real protocol tools, an audit entry for every action.

Agent access →

Migration

Bring your repos.

Import or mirror from any git remote. Indexing starts when the history arrives.

Import path →

No harvesting

We never index your code to rank, sell or train an AI model.

No trending feed, no showcase, no training corpus. The only index we build is yours. Follow the live demo loop →

push

$ git push origin main
→ audit row written, keyed to dev@example.com
→ knowledge graph: 86 symbols indexed (go + ts)
→ project graph: 14 SQL edges

What a push produces

Four artifacts land on every push.

Artifact	Written
Audit row	actor - action - namespace - timestamp
Graph symbols	functions, types, consts - each with a body hash
Dependency edges	dependencies and pins from go.mod and package.json
Cross-language edge	TS fetch() resolved to its Go handler

See it live

Follow the loop, step by step.

Every stop below is a public page on the demo repo. No account needed.

A push writes an audit receipt.

Every push lands one append-only row in the audit log: who pushed, what changed, when. Open the repo home to see the commits behind it.

repo home →

The receipt produces a queryable project graph.

Each push rebuilds the knowledge graph: symbols extracted, cross-language edges indexed, callers mapped. Open the architecture map to see the graph for this repo.

architecture map →

Every symbol is searchable across languages.

The index is fully searchable by name, kind, and file. Functions, types, and variables from Go and TypeScript resolve in a single query. Open search to browse it.

searchable context →

Agents read the same index over a real protocol.

The wiki exposes the same project context that an MCP client receives: pages, symbol tables, caller lists. No scraping, no polling. Open the wiki to browse it.

agent-readable wiki →

Try a symbol search on the live demo

symbol search

$ GET /api/namespaces/citadel-demo/kg/symbols?repo=payments&q=CapturePayment
→ matches: CapturePayment (function) internal/payments/service.go
→ also: capturePayment (function) web/src/payments.ts
→ also: handleCapturePayment (function) internal/httpapi/handlers.go
→ total: 3

Run this search live →Agent token docs →Browse the wiki →

Security & governance

Built for teams that get audited.

Self-host

Offline license, no phone-home.

SCIM 2.0

RFC 7643/7644 provisioning

Scoped tokens

Per action and repo, revocable

Audit retention

90 days, 1 year or 7 years, by plan

Device policy

AAGUID passkey allowlists

Data export

Full account export on request

FAQ

Direct answers.

Do you index my code to train models?

No. We never index your repositories to train, rank, or sell.

Is it self-hostable?

Yes. A server binary plus Postgres and an auth service, offline license validation, no phone-home. Run it air-gapped.

How do agents connect?

A bearer token to the built-in MCP server - 93 purpose-built tools, no HTML scraping.

Can I bring my existing repos?

Import over HTTPS, or mirror continuously with source-wins push rejection.

Is the audit log tamper-evident?

Partly. A database trigger keeps audit rows append-only for the application. Rows that age out go to a hash-chained archive when object storage and a retention period are set. It is not WORM-locked at the storage layer.

What does it cost?

Free for solo and open source. Pro is $4 per seat / month; Enterprise is $15 per seat / month and adds SSO, SCIM, policy, and seven-year audit retention. Self-hosted on-prem pricing is separate. See full pricing

git, indexed.

A push is the unit of work. Browse the public demo or start with your own namespace.

Browse the live demo Request access

Already have an account? Sign in