limbs.dev

Agents have
brains.
They still need
hands.

Opinionated CLI tools that give an agent a body: a grip for secrets, hands that refuse to treat silence as safety. Not a framework. Not plugins.

Small black figure on a stool, no real arms, staring at a key and an empty work glove on the table.
Plate I A model can think. It still cannot pick up the key.

csec

moving here

The grip.

A per-machine encrypted secret store. Master key in the OS vault, AES-256-GCM at rest, age-encrypted sync over SSH. The value never appears in argv, a URL, or a log.

curl -fsSL https://csec.pwan0.com/install | bash

Currently at csec.pwan0.com. Moving to csec.limbs.dev.

Keys hanging from a nail fall to the floor. The black figure presses a keyring into its own body.
Plate II Hung on a nail, a secret falls. Gripped, it stays.

ahh

beta

The hands.

One Go binary: scan untrusted text, mail, telegram, watch, doctor. SAFE means every required scanner covered the bytes. A missing model is UNKNOWN, never a quiet pass.

curl -fsSL https://staging.ahh.limbs.dev/install | bash

Staging until the first signed stable release. Origin: ahh.limbs.dev.

Black figure holding a spiked envelope at a distance with wooden tongs, writing unknown on a tag, unused safety stamp under the desk.
Plate III Do not shake hands with a stranger's letter.

The market sells more arms. It does not sell a no.

Frameworks add tools. Operators get the bill, the wrong bot, the mail that should never have left, the run nobody can rewind. Same doctrine: silence is not consent.

tab

coming soon

The till.

Provider dashboards tell you after the month closes. tab is a ceiling on this process, today. Model calls, search, scrape. When the till is empty the request does not leave the machine. A missing meter is not a successful 200.

Small black figure sitting on a closed wooden cash box, pinning a receipt that is trying to wriggle out.
Plate IV When the till is empty, the call stays in.

who

coming soon

The name.

Multi-agent demos share a shell. Then a child inherits the parent's Telegram, two loops poll one bot, and everyone is "the assistant." who is identity as allowlist. This process wears one name. Environment is not a souvenir.

Small black figure putting on one named coat. A second unlabeled coat lies on the floor.
Plate V One name, one coat. The other mouth is not yours.

veto

coming soon

The last look.

ahh looks at what comes in. The leak is what goes out: a client mail with a private quote, a push that contains a key, a body with a name. veto is the same tri-state on the way out. UNKNOWN does not send.

Small black figure at a closed door, holding an envelope tagged unknown, not posting it through the slot.
Plate VI UNKNOWN does not go through the door.

undo

coming soon

The rewind.

Git is for people who meant the commit. An agent run is a transaction you did not type. undo records the mutations and rewinds the last run: files, and where it can, the call that already left. There is no agentctl rollback. Operators still revert by hand and miss the API.

Small black figure pulling an orange thread so papers fly backward into a folder.
Plate VII The last run comes back on a thread.

ink

coming soon

The fingerprint.

Traces say a tool ran. They do not say which bytes in the repo are human. ink stains every agent write. You can ask whose hand this file is. Unreviewed agent edits do not count as yours.

Small black figure painting a page and leaving an inky handprint in the corner. A human pencil lies unused.
Plate VIII Every write carries a hand.

keep

coming soon

The gut.

ahh scans the prompt. The next attack lives in what the agent remembers after the prompt is gone. keep is memory you can inspect and jar. A missing scrub is not a clean mind.

Small black figure putting a slip of paper into a sealed quarantine jar, not into the open keep crock.
Plate IX Poisoned memory is jarred, not swallowed.

book

coming soon

The diary.

Traces live in someone else's SaaS. book is an append-only log of every tool call on this machine, with a signature. You can book verify. A missing log is not an empty day.

Small black figure stitching loose pages into a bound notebook with orange thread and a knot.
Plate X If it happened, it is sewn in.

kit

coming soon

The lock.

npm pins packages. Agent skills are still a folder you copied. kit treats a skill as supply chain: hash, signature, bill of materials for the run. Unsigned does not load.

Small black figure putting a sealed wrench into a padlocked toolbox. Loose unlabeled tools lie on the floor.
Plate XI Unsigned tools stay on the floor.

tick

coming soon

The clock.

The model invents dates. tick is the agent's now: monotonic, freezeable, not a guess. A run without a clock is not a timeline.

Small black figure winding a mechanical clock. A scrap of paper with guessed dates lies ignored.
Plate XII Now is wound, not guessed.

The origin is not the trust anchor.

The installer is trust-on-first-use over TLS. It checks a checksum from the same host, which catches a corrupt download, not a compromised origin.

Every later update is verified against an ed25519 public key compiled into the binary you already have. A tool never accepts a manifest signed by another channel’s key, and never accepts a version below the one it last saw.

Not for you if you want a plugin marketplace, fifty integrations, or to empower your AI.