Install the daemon
Neku runs as a small daemon on each machine your agents work on. It holds tool calls that need a decision and streams session state to your devices.
macOS
The installer writes to ~/.neku, puts neku on your PATH and registers a user-level service. No root, no kernel extension, no inbound port.
Linux
Runs as a systemd user service. The installer writes to ~/.neku, puts neku on your PATH. No root, no kernel module, no inbound port.
Windows (WSL2)
Neku runs inside your WSL2 Linux distribution — open your Ubuntu shell first, then run the same steps as Linux.
tmux and the multiplexer layer need a real Linux userspace, so Neku is WSL2-only on Windows — not the native shell.
Requirements
- macOS, Linux, or Windows via WSL2
- arm64 or x86_64
- A supported agent CLI on your PATH
- Outbound network access — no inbound port
- No root and no kernel extension
outbound only · no inbound port, nothing dials in
Then pair a device
Pairing exchanges keys between host and device. The account server never sees them.
Run neku pair
The daemon prints a one-time code and waits two minutes for a device to answer.
code 49K2 7 · · expires 1:58
Enter it on the device
Open the app, add a host, type the code. Keys are exchanged end to end and pinned to the device.
device key pinned · revocable any time
Start an agent
The host shows up in your inbox. The next held tool call reaches you as a push with a countdown.
NEEDS YOU auto-deny 0:42
Agents are detected automatically
The daemon finds supported CLIs on PATH and attaches to their sessions.
claude-code
Detected on PATH. Full supervision: states, spans, held tool calls and approvals.
codex
Detected on PATH. Full supervision: states, spans, held tool calls and approvals.
opencode
Detected on PATH. Full supervision: states, spans, held tool calls and approvals.
Check it, then pocket a decision surface
Verify what you downloaded, then put approvals on every device you carry.
Verify the download
Every release is published with a SHA-256 for each artifact. Compare before you run the installer.
Get the app
One account, up to your tier's device limit. Approvals work the same on every surface.
- Web app — app.neku.sh · pair in the browser
- iOS · App Store
- Android · Google Play
Two commands, then your agents are on a leash.
Free tier covers one host and two devices. No card to start.
runs on your machines · end-to-end encrypted · timeouts deny