Disposable capsule
A private simulator device per run, made by cloning. In an earlier test, we measured 3.3 s to clone and 16.1 s until the capsule was usable.
FEATURES
Execution happens on the selected Mac. Cloud coordinates jobs and live rooms and receives the run artifacts and evidence.
A private simulator device per run, made by cloning. In an earlier test, we measured 3.3 s to clone and 16.1 s until the capsule was usable.
Claude, Codex or Cursor can start and observe runs through Remote Live MCP. Kelvin receives the job and publishes the live session to the browser.
A run produces a package with file hashes, a chained transcript and a signature. Cloud receives the evidence for authorized reading after the session.
| requirement | why |
|---|---|
| macOS 15 or newer, Apple Silicon | It is where Kelvin input and Live sessions run. |
| Xcode | The iOS runtimes come from it — Kelvin uses them, it does not replace them. |
| macOS 15 and idb-companion, via Homebrew | For touching the screen, typing and streaming the session. Install it separately through Homebrew. |
A run seals a package with the captures, the step by step and the verdict — 26 objects, each checked against the hash the run declared. An entry only counts as received once it matches.
exercised in productionIn a real run the home screen scored 0.999983 and checkout dropped to 0.568276. The run finished whole, with a failing verdict only where there was a failure: running and concluding are separate axes.
exercised in productionThe simulator on your Mac crosses the cloud and shows up in the browser of the person you called. One real session ran 28 min 51 s; in another, 251 inputs were accepted, with control moving from the agent to the person after the current action finished.
exercised in productionSomeone who can already read the proof of a run invites one person by e-mail, with a seven-day window and revocation at any time. Anyone not invited gets “not found”, never “not allowed”.
exercised in productionThe e-mail of the person you invite is never stored — only a hash of it. The system cannot even answer whether a person is a member.
exercised in productionThe Mac you enrol identifies itself with a key anchored in hardware, and the connection is outbound only: Kelvin opens no inbound port on your machine.
exercised in production| measure | value |
|---|---|
| Objects in a sealed package | 26 |
| Size of one package | 201,743 – 203,778 B |
| Run end to end | 142.4 s – 174.0 s |
| Similarity: intact screen / broken screen | 0.999983 / 0.568276 |
| Length of a live session | 28 min 51 s |
| Inputs accepted in one session | 251 |
| Window of an invitation | 7 days |
Measured on real runs. What we did not measure is not in this table. Every version of the app shows up in the changelog.
What leaves your machine, and where it goes, is in the privacy policy.
To work through Kelvin Code Cloud surfaces, copy the URL below and add it as a custom connector. This option uses sign-in, consent and scopes.
To work through Kelvin Code Cloud surfaces, copy the URL below and add it as a custom connector. This option uses sign-in, consent and scopes.
MCP server addresshttps://mcp.kelvincode.com/mcp
Copy the URL and open Claude's connectors
The first connection always opens a consent screen. The agent signs in against your own membership: what it can do in a room is what you can do, never more, and every call stays inside the scopes you accepted.
Claude is a trademark of Anthropic. Kelvin Code is not affiliated with Anthropic and is not endorsed by it.
Kelvin runs on your Mac. Cloud is in closed alpha: access is by named invitation.