Keld Signal Overview

Introduction to Keld Signal

Keld Signal gives you a unified view of AI spend across the providers, tools, teams, and projects in your organization. It installs two background components on each user's computer:

• Telemetry collection: configures the AI tools on the machine (for example, Claude Code and OpenAI Codex) to send AI usage telemetry to Keld Atlas.
• On-device data enrichment: classifies each prompt on the machine, masks anything sensitive, and sends only derived, masked signals. Raw prompt text never leaves the machine.

The data Keld Signal collects appears in the Keld Atlas dashboard. What you see depends on your role:

• Everyone sees a personal Briefing of their own usage and spend.
• Administrators additionally see the organization-wide Briefing, the Activity feed (a live stream of AI activity across the organization), and Observability (how usage breaks down across Dimensions, plus the rules that control attribution).

Installing Keld Signal

You can download Keld Signal installers during Keld onboarding. If you did not download them then, you can get them any time.

To install Keld Signal:

1. Log in to your Keld Atlas dashboard.
2. Open the install panel. If you are an administrator, click Integrations in the sidebar. Everyone else clicks Connect tools.
3. Download the Keld Signal installer for your platform (Windows, macOS, or Linux).
4. Run the installer and sign in with your Keld Atlas identity when prompted.
5. The installer detects the tools you use (Claude Code, Codex, or Gemini CLI) and configures each one automatically.
6. Your usage appears in Keld Atlas within seconds, attributed to your identity.

Keld Signal is associated with your Keld user identity and your personal ingest token, so there is nothing sensitive for you to manage. The ingest token is issued per user, which is what lets Keld attribute usage to a specific person rather than relying on what a tool reports about itself.

First run

The first time Keld Signal starts, it downloads the on-device classification model into .keld/models in your home folder. Enrichment is held until that download finishes: prompts are queued on disk and processed once the model is ready, so nothing is lost, but classified spend takes a few minutes longer to appear on the first run than it will afterward. Telemetry collection is unaffected and starts immediately.

Platform notes

Keld Signal runs on Windows, macOS, and Linux. On macOS and Linux it can also capture prompts by reading local session transcripts, which means it works with tools that have no hook mechanism. That transcript reader is not yet available on Windows, where capture relies on the command hook that the installer configures.

Resource footprint

On-device enrichment runs a local machine-learning model, so it is worth knowing what it uses:

• Memory: the enrichment process runs under a 4 GB budget by default. It runs inference in a separate child process that is recycled when it approaches that ceiling, so memory is reclaimed rather than accumulating over time.
• CPU: capped at roughly two threads, with pacing that backs off as host load rises. Only one classification runs at a time.
• Disk: the model weights, queued prompts, and local state live under .keld in your home folder. The on-disk queue is bounded and discards the oldest entries rather than growing without limit.
• Network: outbound only, to Keld Atlas. Keld Signal does not open any inbound ports to the network; its local interface is bound to the loopback address and requires a per-user secret.

Enrichment is optional. If your organization turns it off, Keld Signal collects telemetry only and none of the above applies.

Data sources

Keld Signal collects spend data from three source types, and you can use any combination of them. The data is merged into a single view in your Keld Atlas dashboard.

AI provider account connections

Provider connections pull billed usage and cost data directly from your AI provider accounts via their read-only admin APIs. This gives you authoritative spend numbers and requires no changes to your existing tooling.

What provider connections give you:

• Billed cost and usage by provider, model, and time period
• Token counts (input and output separately if the AI provider exposes them)
• Seat and subscription costs alongside usage costs
• Per-key and per-project breakdowns where the provider exposes them

What they don't give you:

• Which team or person generated the spend
• Which tool or platform made the call
• Per-prompt categorization, which is generated on the user's device

Supported providers:

To connect a provider, click Integrations in the Keld Atlas sidebar.

AI tool telemetry

Your AI coding tools stream OpenTelemetry (OTel) data directly to Keld. This gives you per-prompt visibility, including the metadata needed for team, person, and repository attribution.

What telemetry gives you, in addition to provider connection data:

• Spend by tool (for example, Claude Code or OpenAI Codex)
• Spend by team, person, and repository
• Latency and token counts per request
• Live activity in the Activity feed

Telemetry is metadata only: your prompts, code, and responses are never sent to Keld.

Supported tools:

Setup is self-serve. Install Keld Signal as described in Installing Keld Signal above, then run keld signal setup. It auto-detects installed tools, previews every configuration change, and backs up each file before editing. Per-tool copy-paste snippets are also available in the Keld Atlas dashboard.

Agent frameworks

Autonomous agents are tracked separately from the people who run them, and their runs appear on the Agents & Apps tab in Keld Atlas. Any framework can report today by pointing its OpenTelemetry exporter at Keld with an agent key from Teams → Agent API Keys.

First-class Keld Signal setup, where the installer detects and configures the framework for you, is coming soon for the following:

Data freshness

Provider connection data syncs hourly, and you can trigger a manual sync from Integrations, which also shows the last-sync timestamp per connection. Tool telemetry is pushed as prompts complete and appears in near real-time.

During the preview, Keld does not import historical spend. Your data starts from the moment you connect a provider or install Keld Signal.

How enrichments work

Enrichments are the labels Keld Signal attaches to each prompt your team sends: small, structured tags that turn raw AI usage into something you can attribute, group, and report on. They are computed on the device, so your prompts and code never leave the machine. Only the resulting labels travel to Keld Atlas.

Each pass asks one question

An enrichment is a single classification pass over the prompt. There are four kinds:

• Single-label: pick exactly one label. Task type works this way, resolving to one of code_generation, summarization, and so on.
• Multi-label: apply any labels that fit.
• Entity: pull out spans of a given type. Those spans are masked on the device before anything is sent.
• Structure: pull several related fields out of the prompt into one record.

Passes run in order

Passes form a short pipeline. Independent passes run first, and later passes build on their results. Job Subcategory works this way: which subcategories are available depends on the Job Category decided earlier.

Built-in, plus custom passes of your own

Keld ships a set of built-in passes:

• Task type: the kind of work the prompt asks for
• Job Category and Job Subcategory: which part of the business the work belongs to
• Activity: the kind of activity being performed
• Domain: the subject area, with extracted entities
• Sensitivity: whether the prompt contains concrete sensitive data (PII, secrets, PHI, or PCI), with those spans masked
• Speech act: the form the prompt takes, such as a command or a question

The built-ins are fixed — administrators can view and test them but not edit or rename them. Administrators add custom passes of their own, or start from a gallery of ready-made ones, at Classifications in Keld Atlas. Custom definitions then publish to every device in the organization. See Classifications in the Keld Atlas Administrator Guide.

What they power

Enrichment labels drive the Job Categories view, the built-in CapEx / OpEx classification, and the sensitivity flags shown on entries in the Activity feed. All of it works without anyone reading the underlying prompts.

Attribution to a person, team, or repository does not come from enrichment. That comes from the identity on each telemetry event, which is resolved from the user's ingest token.

What leaves the machine is controlled organization-wide from Settings, in the Keld Atlas account menu.

Everything Keld Signal keeps locally lives under .keld in your home folder: your credentials, the classification model, the on-disk queue of pending work, and prompt-length statistics used to bound memory. No prompt text is stored there.

Troubleshooting

Check your setup. Run keld signal status to see which tools are configured, or keld signal doctor to check that configuration for problems. For the enrichment service specifically, run keld-agent status.

No usage appears in Keld Atlas. Confirm the tool you used is supported and configured (keld signal status). If it is, check that the enrichment service is running with keld-agent status. On a first run, allow time for the model download described above.

You are asked to sign in again. If Keld Signal cannot refresh its credentials, it writes a marker file at .keld/reauth-required and reports it in keld signal status. Run keld login, then restart the service with keld-agent restart.

Removing Keld Signal. Run keld signal uninstall to remove the telemetry configuration and hook from your tools. Your historical usage stays in Keld Atlas, attributed to you.