daemon

start, stop, restart, status

kcap daemon start [--name <n>] [--server-url <url>] [--max-agents <n>] [--log-file <path>] [--log-level <level>] [-d|--detach]
kcap daemon stop [--name <n>] [--yes]
kcap daemon restart [--name <n>] [--when-idle | --force]
kcap daemon status [--name <n>]

start runs in the foreground unless -d. Several daemons can run under different names. Name resolution: --name, KCAP_DAEMON_NAME, the profile’s daemon.name, then the lowercase OS username. --max-agents 0 is unlimited; KCAP_MAX_AGENTS overrides even the flag. Log levels: trace, debug, information (default), warning, error, critical, none

A bare restart runs only when idle; --when-idle queues it and returns; --force terminates running agents. status shows the running version and any pending restart

logs, doctor

kcap daemon logs
kcap daemon doctor [--clean]

logs prints the last 50 lines of daemon.log plus the startup capture. doctor reports lock and PID state, installed services, duplicate Claude MCP registrations and stale binary paths; --clean removes stale entries and canonical duplicates, leaving held locks and customised entries

service

kcap daemon service install [--name <n>] [--profile <p>] [--max-agents <n>] [--no-start] [--verify] [--replace] [--retire <id>]
kcap daemon service uninstall | start [--verify] | stop | ensure [--json] | status [--json]

A per-user service: launchd on macOS, a systemd user unit on Linux, a Scheduled Task on Windows. It captures the shell’s PATH and environment at install and pins the profile; reinstall after changing either. --verify (macOS) waits for readiness and rolls back on failure; --replace takes over an existing registration; --retire removes an old service id during a rename. ensure installs or starts as needed and seeds launch consent to prompt

shim ensure

kcap daemon shim ensure [--json]

Checks that kcap resolves in your login shell; on macOS offers to link /usr/local/bin/kcap with an administrator prompt

consent

kcap daemon consent show
kcap daemon consent set-default allow|deny|prompt
kcap daemon consent allow|deny [--requester <user>] [--kind agent|review|review-flow] [--repo <path-or-glob>] [--vendor <v>]
kcap daemon consent remove <index>
kcap daemon consent log [-n <count>]

Controls launches requested through the server. The owner is always allowed; kcap agent start bypasses it. First matching rule wins, else the default; prompt denies on timeout or with no approval UI. allow and deny need at least one match option. log works while the daemon is stopped. Daemons started by hand default to allow; services created by ensure to prompt

reviewer affirm

kcap daemon reviewer affirm --vendor kiro|gemini|antigravity|opencode|pi|grok|muse [--name <n>]

Records the installed reviewer build as the minimum this daemon may run; restart the daemon to apply. Opt a vendor out of unattended review with KCAP_<VENDOR>_UNATTENDED_REVIEWER=0 in the service’s environment