Setting up and using Keegi.

• Web: the ask box on /app/[org].
• Slack: /keegi in a channel, or @Keegi on a thread.
• Your card: /app/[org]/me. What Keegi holds on you in this workspace, who asked, and a switch to stop being returned. Reached from Your card next to your email.
• Staff a project: /app/[org]/team. A brief in, a team and the uncovered capabilities out.
• Gaps: /app/[org]/gaps, admins. Questions this workspace could not answer.

We create the workspace and switch it on with you. From there an admin does the rest in the product, on /app/[org]/sources. There is nothing to install and nothing to run.

1. Sign in at keegi.xyz/app with Google, Microsoft, or a one-time email link. One account can belong to several workspaces, so the workspace is always in the address, never guessed from you.
2. Open Where this workspace's evidence comes fromand connect a source. Jira sends you to Atlassian and back. Linear, Slack and Notion take a credential you paste. Keegi checks it against the API before storing it, so a typo is refused while you are still looking at the field.
3. Classify what you connected: Citable, Signal-only, or Excluded. Citable can be quoted to anyone in the workspace who could already open the document. Signal-only counts towards a card and is never quoted. Excluded is not read.
4. Turn on the projects, teams, channels or pages Keegi may read, then Save. Nothing inside a source is read until you do this. A source sitting at nothing turned on says so on its own row.
5. Press Read now. The row then says when it was last read, and shows how far through it got. On Sources, Read every source now reads each connected source in turn. Under it, an admin sets how often: Every hour, Every six hours, Every night, Once a week, or Only when I ask. The line under that control is the next read, in the workspace's timezone, and the same sentence is on /app/[org]/council.
6. Admit your colleagues on /app/[org]/people. Use the address they sign in with. They do not need an account yet.

Each tab above is one source, followable end to end. The counter near the top of the sources page, x of y people have a card, is how you know the workspace is ready to be asked something.

Any of the sources can sit on one workspace at the same time. Cards are built from every connected source that is not excluded.

Signing in with Google reads nothing from Google Drive. Reading shared drives is its own step, on the Google Drive tab, with an account your company makes for Keegi.

If your company signs in with Microsoft, an admin of your Microsoft tenant approves Keegi once, before anyone else can get in. They press Continue with Microsoft and tick Consent on behalf of your organization. Until then, colleagues are told they need admin approval. Signing in with Microsoft reads nothing from Microsoft 365. Reading SharePoint is its own step, on the Microsoft 365 tab.

SAML and SCIM are not built. Do not plan the rollout around them.

/app/[org]/council is the same information written for somebody who has to approve it. Anyone in the workspace can open it, and it is meant to be handed to a works council rather than summarised for one.

An agent asks as a named person. Mint on /app/[org]/agents. Point an MCP client at https://keegi.xyz/api/mcp with Authorization: Bearer …. The key is shown once. Keegi stores a hash.

Four tools:

• who_can_help: a question, up to three colleagues with evidence. Nobody can answer is a result, not an error, and is logged as a gap.
• who_owns: who carries a named capability, and whether exactly one person does. Needs the same admin rights as the gaps page.
• assemble_team: a project brief in, a team and the uncovered capabilities out.
• escalate: hand a question to one of the people it returned. It records the introduction and sends them a Slack direct message, attributed to the agent and to the member it acts for. When it cannot reach them, the result says which step stopped it. The bot needs im:write to open that message.

There are no scores in any result.

After mint, the Try box on /app/[org]/agents is the zero-setup check. Same function an MCP client calls. A refusal is a result, not an error. It does not ask for a bearer.

MCP Inspector:

npx @modelcontextprotocol/inspector

URL https://keegi.xyz/api/mcp. Header Authorization: Bearer <key>.

Cursor, in mcp.json:

{
  "mcpServers": {
    "keegi": {
      "url": "https://keegi.xyz/api/mcp",
      "headers": {
        "Authorization": "Bearer <key>"
      }
    }
  }
}