Run Keel locally

The whole platform runs on one machine through .NET Aspire: the metadata database, cache, identity provider, sample source databases, the API, the background worker, the scheduler, the MCP server and the web app.

Prerequisites

• .NET SDK 10.0.1xx or later (the code also builds on .NET 11).
• Node.js 22+ (24 recommended) with pnpm 10.
• Docker Desktop, running. On Windows, Docker Desktop publishes container ports on IPv4, which is why the sample sources use 127.0.0.1.

Start the stack

dotnet run --project src/Keel.AppHost

The console prints a login link for the Aspire dashboard. When every resource is healthy:

What	Where
Web app	http://localhost:5173
API	http://localhost:5080 (OpenAPI at /openapi/v1.json, Scalar UI at /docs)
MCP server	http://localhost:5090/mcp/{endpoint}
Aspire dashboard (traces, logs, metrics)	http://localhost:15080
Keycloak (dev identity provider)	http://localhost:8080 — realm keel
Mailpit (invitation and notification emails)	http://localhost:8025
Sample source: Chinook on PostgreSQL	127.0.0.1:5434, database chinook, read-only user keel_reader
Sample source: Chinook on SQL Server (Azure SQL Edge on arm64)	127.0.0.1:14330, database Chinook

Open http://localhost:5173, choose Continue with SSO with the email left empty, and sign in with one of the dev realm users — owner@keel.local, admin@keel.local, steward@keel.local, modeler@keel.local, analyst@keel.local or viewer@keel.local, password keel. Each is mapped to the matching role in the Anchor Demo tenant and its Sales Analytics workspace, which the API seeds on start in Development (Keel:Seed:Demo=true). The two Chinook databases are already registered there as sources. To try self-serve sign-up, start the AppHost with Keel__Signup__Mode=SelfServe and open /signup: both emails (Keel's link, then Keycloak's set-password link) arrive in Mailpit (Sign in and set up).

Make it a full demo

The start-up seed only creates the tenant, the users and the sample sources. To get a scanned, reviewed, released and governed model in one step, run the demo seeder.

Generated secrets

The AppHost generates and remembers (in its user secrets) the runtime database password, the Keycloak admin password, the secret-store master key and the sample databases' password. You never type them; the dashboard shows them under each resource's parameters.

AI features

Keel works without an LLM: every inference stage falls back to heuristics, and the assistant says that AI is off. To turn on LLM-assisted naming, metric suggestions, glossary clustering and the assistant, give the API and the worker an Anthropic key:

dotnet user-secrets set "Keel:Llm:ApiKey" "<key>" --project src/Keel.Api
dotnet user-secrets set "Keel:Llm:ApiKey" "<key>" --project src/Keel.Worker

The tenant's provider is set in Settings › AI & privacy (default anthropic; none turns AI off for the tenant). What is sent to the model is described in Proposals, evidence and trust.

Only the frontend

cd web
pnpm install
pnpm dev          # proxies /api to http://localhost:5080

Resetting

Local data lives in the Docker volume keel-postgres-data. To start from scratch, stop the AppHost and run docker volume rm keel-postgres-data. See Upgrades for when a reset is required.