The control layer for agent tools

Cut the catalog.

Your agent carries 24 tools. This turn needs 2. Kerf makes the cut before the model call, on your own machine, with zero network on the path.

Request early access

kerf.select(“where’s my order?”)24→2

scored locally, zero network2 of 24 tools passed the cut

Without kerf

Every extra tool is a new way to be wrong.

When the whole catalog reaches the model on every turn, the odds it grabs the wrong tool climb with each one you add — and some wrong tools move money or delete data. The deeper risk isn't just how many tools reach the model, but which ones: untrusted, changing, and colliding by name.

User asks“Where’s my order?”

✗refund_order

An unrequested refund goes out the door.

User says“This is broken, I’m done.”

✗delete_account

A destructive action fires on a vague complaint.

Every turnAll 32 tools in context

✗area

You pay for, and reason over, tools the turn never needed.

You can't ship an agent you don't trust to pick the right tool.

With kerf, the full catalog never reaches the model, so hallucinated tool calls drop to near-zero.

100%

Selection runs on your machine

local · no external call

0calls

No runtime cloud dependency

network on the hot path

<2.0tools

The model sees only what matters

mean set size per turn

>0.90mean

The right tool, not a plausible wrong one

selection precision

How it works

Train once. Pull the artifact. Run locally.

Tool schemas are embedded server-side into a versioned, signed artifact. At runtime the SDK scores your query against it, on-device, no round trip.

STEP 01

Train

Tool schemas are embedded into a neural vector index with a bi-encoder, then serialized, encrypted, and signed into one versioned artifact.

Server · one-time

STEP 02

Pull

The CLI or SDK pulls the artifact over a presigned URL and verifies its ECDSA P-256 signature before it ever loads. Fails closed.

Client · per release

STEP 03

Select

Every turn, select() embeds the query and returns the 2 to 3 tools above threshold. No cloud on the critical path.

Client · every turn

The CLI

Run the whole pipeline from your terminal.

kerf-cli launches an interactive prompt. Log in once, then drive the whole pipeline. Shape your tools, train, eval, and pull.

project createllm setuptools sharpentrainevalpullmonitor

kerf-cli

tool selection platform

type /help for commands · /quit to exit

› project create support-bot

✓ project created · proj_x7k

› llm setup

✓ anthropic · claude-sonnet configured

› tools sharpen

✓ 3 descriptions rewritten · similarity gate passed

› train

✓ artifact v3 built · signed ECDSA P-256 · 1.9 MB

› eval

precision 0.94 · recall 0.91 · mean set 1.8

› pull

✓ pulled v3 → ~/.kerf/artifacts/support-bot/v3/artifact.kerf

kerf · us-east-1 · api.kerf.dev

Tools sharpen

The model proposes. Kerf measures.

Sharpen uses an LLM of your choice to rewrite vague tool descriptions, but never trusts it. Every proposal passes mechanical gates, enforced in code, not in a prompt.

Schema gate

Rejects any rewrite that adds a parameter, capability, or return value the original didn’t have. A diff check, not a judgment call.

Similarity gate

Recomputes cosine similarity after the rewrite. If collision doesn’t measurably drop, the proposal is thrown out. Kerf verifies the claim.

Retry logic

Rejected proposals retry with the rejection as context, up to three attempts, then skip. Safe even with a local 7B model.

The LLM proposes.
Kerf verifies.

Run it against OpenAI, Anthropic, Bedrock, or a local Ollama model. The --llm flag is opt-in. Leave it off and sharpen is fully offline and CI-safe.

No hallucinated capability enters your catalog

Where kerf is going

Picking the right tools only matters
if you can trust them.

Agents now pull tools from everywhere. With MCP, those tools can change under you, collide by name, and show up without you noticing. Kerf is becoming the layer that verifies them, not just the one that picks them.

Today

Select

Score the full catalog and pass the model only the tools this turn needs.

Verify

Fingerprint every tool. Catch the ones that silently changed. Resolve name collisions. Pin what you trust.

Then

Control

Gate what the agent is allowed to run, before it runs. Signed and auditable end to end.

Bring your own model

Any provider. Fully opt-in. Never on the selection path.

An LLM only ever touches two things in kerf: rewriting tool descriptions in sharpen, and generating eval queries. Selection itself, the thing that runs on every turn, is local math, not a model call, regardless of what you configure here.

OpenAIopenai · api key

Low latency, strong rewrite quality.

Anthropicanthropic · api key

Low latency, strong rewrite quality.

AWS Bedrockbedrock · aws credential chain

Enterprise: data stays inside your AWS account.

Locallocal · ollama · no key

Fully offline and private. Mechanical gates protect against weak output.

The --llm flag is tri-state

Every command that could use an LLM requires you to say so, explicitly, per invocation.

absentno LLM requested--llmuse your configured default--llm openaiuse this provider, just once

Structural offline guarantee. Commands like tools sharpen --fix and plain eval are policy-forbidden from calling an LLM. No code path in kerf reads your default provider, so the pipeline stays offline no matter what's configured.

Evals

Selection you can measure, and two ways to run it.

Every artifact declares its strategy in a descriptor. The SDK runs exactly what's declared, with no guessing and no silent fallback, so you can score precision, recall, and set size against real queries.

dense_single_stage

Fast

Bi-encoder plus a cosine threshold. The default when you want selection to stay light on the turn.

Speed

two_stage_rerank

High accuracy

Bi-encoder retrieval, then cross-encoder reranking. Trades a little speed for selection quality when precision matters most.

Quality

Drop-in

Init once. Select per turn.

Kerf returns standard OpenAI-format tool definitions, so the output slots straight into whatever your stack already speaks. No adapter layer.

Init once at startup, then select per turn. Use the returned names to narrow whatever tool set your framework manages, and pass only those to the model.

Framework-agnostic by design

agent.js

import kerf from '@kerf/sdk';

await kerf.init({ projectId: 'proj_x7k' });

// on every turn, runs locally, no network
const { tools } = await kerf.select(
  "cancel my order and get a refund"
);

// tools: 2-3 relevant defs, not the full catalog
// [{ type: "function", function: { name: "cancel_order" }}]

The dashboard

Watch every project from the browser.

kerf-site gives you projects, tools, training status, and signed artifacts at a glance. No terminal required.

app.kerf.dev/support-bot/artifacts

Artifacts4 versions

Version	Status	Size	Signed	Created
v4	training			now
v3	ready	1.9 MB	✓ P-256	2m ago
v2	ready	1.8 MB	✓ P-256	1d ago
v1	failed			3d ago

Integrations

Sits under the framework you already use.

Kerf works at the tool-selection layer beneath your agent loop, narrowing context before the framework's own reasoning kicks in.

OpenAIchat.completions

Anthropictool use

LangChainbind_tools()

LlamaIndexReActAgent

CrewAIper-agent tools

Vercel AIstreaming

MCPtool filtering

⚡FastAPImiddleware

Integrity

Signed, encrypted, and yours at runtime.

Encrypted

AES-256-GCM envelope encryption with a per-project KMS key on every artifact.

Signed

ECDSA P-256 detached signatures, verified by the SDK and CLI at load and pull time.

No substitution

A build-time key fingerprint is baked into the client. If it doesn’t match, load fails closed.

Local at runtime

Once pulled, the agent runs entirely on-device. The cloud is a build pipeline, not a dependency.

Give the model less to get wrong.

Kerf is in private beta. Join the waitlist and we'll help you train your first artifact.

Selection is step one. Kerf is becoming the trust and control layer for agent tools.

· No card required· We’ll reach out to set up onboarding· Runs anywhere — no cloud dependency

Cut the catalog.

Every extra tool is a new way to be wrong.

Train once. Pull the artifact. Run locally.

Train

Pull

Select

Run the whole pipeline from your terminal.

The model proposes. Kerf measures.

Schema gate

Similarity gate

Retry logic

Picking the right tools only mattersif you can trust them.

Select

Verify

Control

Any provider. Fully opt-in. Never on the selection path.

The --llm flag is tri-state

Selection you can measure, and two ways to run it.

Fast

High accuracy

Init once. Select per turn.

Watch every project from the browser.

Sits under the framework you already use.

Signed, encrypted, and yours at runtime.

Encrypted

Signed

No substitution

Local at runtime

Give the model less to get wrong.

Picking the right tools only matters
if you can trust them.