Frequently asked questions.

A developer tool: a native macOS executor that spins up disposable iOS simulator capsules and lets your agents — Claude, Codex, Cursor — drive the app inside them while you watch in the browser. The session produces sealed captures, steps and a verdict for review. “Kelvin” is what we call the product day to day; the full name is Kelvin Code.

Yes. The iOS runtimes come from Xcode and Kelvin does not replace it. Kelvin runs in the background on your Mac; you watch the session in the browser.

To receive jobs and open Live sessions, enroll the Mac in a Kelvin Cloud organization.

For control and Live sessions, Kelvin needs macOS 15 or newer on Apple Silicon, Xcode with an iOS runtime, and idb-companion via Homebrew. The binary may open on macOS 14 with limited features.

Nothing. The beta is free and asks for no card. If there is a price, it will be announced before it applies.

Download the latest Kelvin for Mac version from the public releases page. Updates are manual for now.

Only from github.com/andermelo/kelvin-releases and this site. We distribute Kelvin through no other channel.

Name, profile picture and verified e-mail — the openid, email and profile scopes, and nothing beyond. Kelvin Code does not request access to Google Drive, Gmail, Calendar, contacts or repositories. Dashboard sign-in identifies the person; Kelvin for Mac uses a one-time enrollment code to connect this Mac to the organization.

Kelvin for Mac sends Cloud the data needed for a shared run: the app and run artifacts, evidence and live frames. It makes outbound connections only; Kelvin opens no inbound port on the Mac.

The app you send is checked by two hashes — the received bytes and the extracted app tree — before any simulator is touched. And everything is bound to an organization: asking for another organization's object answers “not found”, without confirming that it exists. Negative tests cover that path.

Every critical action enters an audit trail: membership and role changes, machine enrollment and revocation, approval of the app that was sent, run transitions, control granted and handed back, accepted input, approvals and publication. Live control belongs to one person at a time and the handover is explicit — and the text you type never enters logs or the audit trail.

Not today. What you sent to the Cloud stays for as long as your organization exists: nothing is deleted on a schedule, no process sweeps evidence, and an expiry shown on a screen is the ceiling of what that package could survive, never a countdown. If you want something deleted, ask by e-mail and we delete it by hand. What does disappear on its own is a room's state when it ends: chat, proposals, tickets and seats.