limbs.dev

Agents have
brains.
They still need
hands.

Two binaries today. A grip for secrets. A bag of hands that refuse to treat silence as safety. A third on the way, because hands without a leash leave the house. Not a framework. Not plugins.

Small black figure on a stool, no real arms, staring at a key and an empty work glove on the table.
Plate I A model can think. It still cannot pick up the key.

csec

moving here

The grip.

A per-machine encrypted secret store. Master key in the OS vault, AES-256-GCM at rest, age-encrypted sync over SSH. The value never appears in argv, a URL, or a log.

curl -fsSL https://csec.pwan0.com/install | bash

Currently at csec.pwan0.com. Moving to csec.limbs.dev.

Keys hanging from a nail fall to the floor. The black figure presses a keyring into its own body.
Plate II Hung on a nail, a secret falls. Gripped, it stays.

ahh

0.5.0

The hands. One bag.

One Go binary. Scan untrusted text, mail, telegram, watch, ask a human, doctor, signed update. SAFE means every required scanner covered the bytes. A missing model is UNKNOWN, never a quiet pass. csec stays out of the bag: a secret store shared by everything on the machine must not share this binary's fate.

curl -fsSL https://ahh.limbs.dev/install | bash

Signed stable. Origin: ahh.limbs.dev. Staging remains at staging.ahh.limbs.dev.

ahh scan FILE
ahh mail inbox|send
ahh tg inbox|send
ahh watch
ahh ask|tell|warn|ack
ahh inbox
ahh doctor
ahh update check|apply
Black figure holding a spiked envelope at a distance with wooden tongs, writing unknown on a tag, unused safety stamp under the desk.
Plate III Do not shake hands with a stranger's letter.
Black figure stuffing tongs, a clock and a cash box into one worn satchel. A multi-zipper plugin pack lies unused. A keyring stays gripped inside the body.
Plate IV Many hands. One bag. The keys stay out.

Inside the bag, next.

These are future ahh commands, not separate installs. Roadmap items have an issue. Moodboard items do not, yet.

Small black figure putting on one named coat. A second unlabeled coat lies on the floor.

who

roadmap

The name.

This process wears one name. An unnamed agent is refused, not defaulted. Environment is not a souvenir.

ahh#18

Small black figure winding a mechanical clock. A scrap of paper with guessed dates lies ignored.

tick

roadmap

The clock.

The model invents dates. tick is monotonic, freezeable, not a guess. A run without a clock is not a timeline.

ahh#19

Small black figure stitching loose pages into a bound notebook with orange thread and a knot.

book

roadmap

The diary.

Append-only, signed. You can ask whether it actually happened. A missing log is not an empty day.

ahh#20

Small black figure at a closed door, holding an envelope tagged unknown, not posting it through the slot.

veto

roadmap

The last look.

ahh already looks at what comes in. The leak is what goes out. UNKNOWN does not send.

ahh#21

Small black figure sitting on a closed wooden cash box, pinning a receipt that is trying to wriggle out.

tab

roadmap

The till.

A ceiling on this process, today. When the till is empty the model call stays in. A missing meter is not a successful 200.

ahh#22

Later in the bag.

Moodboard. No issue until there is a case as sharp as the five above. They are not promised.

Small black figure pulling an orange thread so papers fly backward into a folder.

undo

moodboard

The rewind.

An agent run is a transaction you did not type. The last run comes back on a thread.

Small black figure painting a page and leaving an inky handprint in the corner. A human pencil lies unused.

ink

moodboard

The fingerprint.

Every agent write carries a hand. Unreviewed edits do not count as yours.

Small black figure putting a slip of paper into a sealed quarantine jar, not into the open keep crock.

keep

moodboard

The gut.

The next attack lives in what the agent remembers after the prompt is gone. Poisoned memory is jarred, not swallowed.

Small black figure putting a sealed wrench into a padlocked toolbox. Loose unlabeled tools lie on the floor.

kit

moodboard

The lock.

Agent skills are still a folder you copied. Unsigned does not load.

leash

coming soon

The leash.

ahh looks at what the hands pick up. csec holds the keys. The packet still walks out through Claude Code, curl, the browser the model asked for. leash is default-deny egress for this process. A host that is not on the list is not a successful 200. UNKNOWN does not leave the machine.

Not an ahh command. Like csec, it has to bind every runtime on the machine, so it cannot share ahh's fate.

No installer until there is a binary. Case: limbs#4.

Black figure clipping a short leash from its waist to a floor ring. An envelope with legs runs toward an open window and cannot reach it. A host list hangs beside the window.
Plate V Hands without a leash leave the house.

The origin is not the trust anchor.

The installer is trust-on-first-use over TLS. It checks a checksum from the same host, which catches a corrupt download, not a compromised origin.

Every later update is verified against an ed25519 public key compiled into the binary you already have. A tool never accepts a manifest signed by another channel’s key, and never accepts a version below the one it last saw.

Not for you if you want a plugin marketplace, fifty integrations, or to empower your AI.