Connecting to Fleet
The Harness is a fully functional standalone tool — no sign-in required. Connecting to Kenaz Fleet is opt-in and adds team-layer features on top of what you already have.
What Fleet adds
When you sign in to Fleet from the Harness (Settings → Account → Sign in to Fleet), the following become available:
| Feature | What it does |
|---|---|
| Pushed configuration | Your Fleet admin can distribute a signed config bundle: mandated skills, an MCP allow/block list, preferred default model, and Cedar policy deltas. These apply automatically and are verified against Fleet's signing key before they take effect. |
| Shared tool catalog | Skills and MCP recipes published by your org show up in your Harness without you having to find and install them manually. |
| Settings sync | Provider profiles, model preferences, installed MCP recipes, and UI theme can sync across your devices (last-write-wins per category). You control which categories sync. |
| Telemetry (opt-in) | If you choose to share telemetry, the Harness can send redacted usage spans to Fleet. Default is none. Requires a separate consent step — sign-in alone does not enable it. |
What Fleet cannot see
Fleet receives only what you explicitly opt in to:
- Your API keys stay in the OS keychain on your machine. They are never uploaded.
- Your prompts and responses go only to the AI provider you configured. Fleet does not intercept or log conversations.
- Your local audit log stays on disk. Fleet has no access to it unless you set up a hook to export events to a SIEM of your choice.
- Telemetry is off unless you explicitly set a consent level above
nonein Settings → Privacy → Crash Reporting.
How to sign in
- Open Settings → Account.
- Enter your Fleet URL (e.g.
https://fleet.kameas.aifor the hosted service, or your self-hosted URL). - Click Sign in — a browser window opens for PKCE authentication.
- After authenticating, the Harness receives a token, fetches your org's config bundle, and installs any mandated skills or MCP allow-lists.
To sign out: Settings → Account → Sign out. Signing out removes the local token and stops all sync. Any mandated configuration that was applied remains installed (as local copies) until you manually remove it.
What gets applied and when
Config bundles are signed with Fleet's ed25519 key and verified before any content is applied. The Harness polls for updates every five minutes while signed in. If verification fails, the previous bundle stays active and a banner appears in Settings → Account.
The bundle can carry:
- Mandated skills — installed read-only; you cannot delete them while signed in.
- MCP allowlist — restricts which MCP recipes can be installed. An explicit empty list blocks all new MCP installs.
- Model preferences — sets a default model and optionally restricts the provider picker.
- Cedar policy deltas — fine-grained permission rules merged into the local Cedar engine.
None of these can exfiltrate data from your machine. They govern what the Harness is allowed to do, not what it sends back.
Your role and plan
Capabilities available to you depend on your Fleet role and subscription tier:
- Free — can sign in and receive pushed config; no telemetry options.
- Pro — adds aggregate telemetry consent (counts and durations, no payload content).
- Team / Enterprise — adds full redacted telemetry and org-wide mandated skill distribution.
See Fleet: Plans and roles for the full tier breakdown.
Questions about privacy or data? See Troubleshooting & FAQ for a summary of what stays on your machine.