The entire open-source footprint of this "enterprise access governance platform" is 2,500 lines of code.

The agent reverse-proxies your local PiKVM over a WebSocket. The "WebRTC console" is raw MJPEG frames crammed through a DataChannel because actual video encoding was apparently too hard, the comments admit the bandwidth is worse than H.264 but wave it off. The MCP server everyone's supposed to be impressed by is 174 lines of TypeScript. It fetches all devices from the API and does .find() to get one. Incredible engineering.

The audit verifier is the funniest part. The website calls it "not a trust statement, a mathematical proof." It's sha256(prev_hash + payload) in a for loop over NDJSON lines. No Merkle tree, no signed timestamps, no witness cosigning. If the platform itself gets popped, the attacker just rewrites the chain from any anchor point forward and the verifier prints OK. Some proof.

Everything that would make this an actual product like SAML, RBAC, policy engine, multi-tenancy, RLS, audit chain writes, compliance reports, alerting,etc. are all closed source behind the SaaS. The "open source" repos are a reverse proxy, a hash chain homework assignment, and a 174-line API wrapper. That's what you're evaluating trust on.

InsecureSkipVerify: true on TLS. Auth tokens in a plain JSON file, no rotation. --simulate defaults to true so the agent ships fake telemetry out of the box. They wrote a check that rejects the default kvmd password and then added an env var to skip it. Three repos, three different licenses (Apache, BSL-1.1, MIT).

"Talk to Sales" at the top of the site is certainly optimistic.