Kiwi — Coding agents that run where you say.
Sign inGet started
Now live — sign in with GitHub at app.runkiwi.dev<br>Agentic coding in infrastructure you control.<br>Coding agents your security review can actually approve.<br>You define the task and the test—Kiwi does the rest. It plans the work, writes the code, and verifies it in a completely isolated sandbox before landing a single, clean PR. Keep your API keys secure and deploy on our cloud or yours.<br>Start free — sign in with GitHubSee how it runs<br>Managed cloud or your own VPC · Actor–Critic verdicts recorded per step · One job → one branch → one PR<br>$npm i -g kiwi && kiwi submit "Add pagination to the users API"Copy
kiwi/job-42 · migrate-authLive run
tokens0<br>cost$0.000<br>RUNNING
Copilots hand you suggestions. Sandbox vendors hand you a box. Kiwi runs the work end to end—inside a boundary you set, with a record of what happened.<br>Model code runs with no network and no key<br>Every edit, verdict and test run recorded<br>Your own Anthropic, OpenAI or Gemini key<br>Managed cloud, or your own VPC
Offload the grind · Focus on the architecture
Bug Triage<br>Feature Implementation<br>Code Review<br>Refactoring<br>Test Generation<br>Dependency Updates<br>Security Patching<br>Bug Triage<br>Feature Implementation<br>Code Review<br>Refactoring<br>Test Generation<br>Dependency Updates<br>Security Patching<br>Bug Triage<br>Feature Implementation<br>Code Review<br>Refactoring<br>Test Generation<br>Dependency Updates<br>Security Patching<br>Bug Triage<br>Feature Implementation<br>Code Review<br>Refactoring<br>Test Generation<br>Dependency Updates<br>Security Patching<br>Bug Triage<br>Feature Implementation<br>Code Review<br>Refactoring<br>Test Generation<br>Dependency Updates<br>Security Patching<br>Bug Triage<br>Feature Implementation<br>Code Review<br>Refactoring<br>Test Generation<br>Dependency Updates<br>Security Patching
How it worksOne task in. One PR out.<br>Kiwi plans your task into a graph of scoped workers, runs them in parallel on a single job branch, and lets the dependencies carry findings forward. What you asked for is the objective; a terminal verify worker runs the full suite to prove the change broke nothing before the PR opens.
kiwi submita plain-English task<br>Plantask → worker DAG<br>Swarmworkers run in parallel<br>Composecommits to one branch<br>Verifythe suite still passes<br>Shipone reviewable PR
Control PlaneLEASE QUEUE ONLINE<br>Jobkiwi/job-42<br>Workers3 RUNNING · 1 DONE
ANALYZEanalyze · map the session call sites<br>DONE<br>root node<br>[actor] Reading every caller of the session store…<br>[finding] 3 call sites assume in-memory state<br>✓ summary handed to dependents
IMPLimpl · auth handler<br>RUNNING<br>depends_on w1<br>[actor] Switching the handler to the Postgres store…<br>$ go test ./pkg/auth<br>[critic] Reviewing diff…
IMPLimpl · session store<br>RUNNING<br>depends_on w1<br>[actor] Migrating store to Postgres…<br>$ go test ./pkg/session<br>[critic] minimal, scoped — approve
IMPLimpl · migration script<br>RUNNING<br>depends_on w1<br>[actor] Writing 0002_sessions.sql…<br>commit → kiwi/job-42<br>✓ committed to job branch
VERIFYverify · full suite + open PR<br>QUEUED<br>depends_on w2, w3, w4<br>waiting on w2, w3, w4 to go green…
Composing one PR…branch kiwi/job-42 · verify pending
Why KiwiContainment and evidence, not just throughput<br>Generating a diff is the easy part now. The hard part is deciding it's safe to merge. Kiwi runs the work inside a boundary you define and keeps the record of what produced it, what reviewed it, and what proved it.
01<br>Does what you askedThe whole point<br>Your description is the objective — not a failing check. “Add an example to the docs” is as ordinary a job here as a bug fix, because the test command is a guard proving the change broke nothing, never the definition of done. A run that changes nothing is reported as a failure rather than quietly called a success, and while the suite is red Kiwi will not edit the failing test — that is how a fix gets faked.
02<br>Two-phase sandboxContainment<br>Dependencies install in a networked phase handed an empty environment — no git token, no registry credential, nothing — so a hostile postinstall hook can reach the network with nothing to send. Then the network goes off and your test command runs the model’s code offline. Model-generated code never has network access, and the phase that does never holds a secret; your provider key is sealed to the daemon and withheld from both.
03<br>Every step on the recordEvidence<br>Each iteration writes a structured event: which model proposed the edit, whether the Critic approved or rejected it and why, whether the test passed, plus tokens, cost and duration. Those events are assembled into a per-job execution record, hash-chained to the one before it and shown with its hash and attestation state — so a run can be checked rather than taken on trust. A run that took three attempts shows you the two that were turned down.
04<br>File Loop (Actor–Critic)Default<br>For bounded edits, an Actor proposes a patch and a Critic reviews it before a single byte is written to disk. Rejected edits never reach your test command — they go back to the Actor with the reason...