# AX Check: keepersecurity.com
Checked 2026-11-05.

Keeper's docs are solid, but live pricing is blank on the page
CLI install, SDKs and auth steps are all documented clearly. Business and Personal plan dollar amounts render as empty placeholders instead of real prices.

## Onboarding needs a login

## Coding sessions
All three independent sessions found the Commander CLI docs and quoted Business-plan pricing, but each flagged that dollar figures were missing or rendered dynamically rather than stated as text, so prices came from memory, a live API call, or were marked unverified. Secrets Manager and PAM pricing were consistently reported as quote-only with no number given.

### DeepSeek V4.1 Flash
[View public run](https://agents.withgauge.com/p/runs/5985544f-34b7-452f-8246-2ffa4b954a24) · [Read transcript](https://www.ax-check.com/keepersecurity.com/sessions/deepseek.json)
Quoted Business at $4 and Enterprise at $6 per user per month, billed annually. Said Secrets Manager is a per-user, per-year add-on needing a Business plan or trial, PAM pricing is quote-only, and the pricing page was the source (seq 79, seq 60, seq 112)
#### End-to-end onboarding
- **Onboarding needs a login**: The agent never obtained real Keeper credentials. It built a working SDK-based CLI example (keeper_example/example.py) using the official keeper-secrets-manager-core package, but had no Keeper account/trial to generate a real One-Time Access Token. It tested the no-credentials path (clean exit with instructions) and then tried a fabricated placeholder token, which failed with a SDK-level error, not a successful authenticated call. The session ended asking the human to supply a real Business/trial account and a One-Time Access Token — an unresolved need for human-provided credentials.
  Event 101:

  ```text
  KSM_TOKEN='US:ZmFrZS10b2tlbi1ub3QtcmVhbA==' timeout 40 ../.venv/bin/python example.py list 2>&1 | tail -15; echo "exit=${PIPESTATUS[0]}"
  ```
  Event 102:

  ```text
  keeper_secrets_manager_core.exceptions.KeeperError: Initialization failed: 'ksm-config.json' has been removed. Please generate a new One-Time Token and try again.
  ```
  Event 112:

  ```text
  To run end-to-end I'd need you to supply a Keeper Business account/trial and a **One-Time Access Token** from a Secrets Manager Application (or an already-bound `ksm-config.json`). With that, `example.py` should work as-is.
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No self-service way to get a Secrets Manager token without a paid/trial Business account**: Product behavior: Keeper Secrets Manager requires a Business plan (or trial) and several manual console steps (create role, shared folder, secret, application, client device) before a One-Time Access Token exists. The agent had no such account in the sandbox and could not generate one itself, so it could only exercise the SDK's no-credential error path and a deliberately fake token, both of which failed as expected rather than demonstrating a real authenticated call.
  Event 98:

  ```text
  No credentials found.
  Set KSM_TOKEN to a Secrets Manager One-Time Access Token, or point
  KSM_CONFIG at an already-bound config file.
  exit=1
  ```
  Event 102:

  ```text
  keeper_secrets_manager_core.exceptions.KeeperError: Initialization failed: 'ksm-config.json' has been removed. Please generate a new One-Time Token and try again.
  ```

#### Suggested Changes
- **Fix the broken pricing page link referenced from the Secrets Manager product page**: The Secrets Manager product page (keepersecurity.com/secrets-manager.html) links to 'Keeper business pricing page' which 404s as /pricing/business-and-enterprise.html when fetched directly in some paths and several other /pricing/* subpaths (business/, password-management/, personal/, privileged-access-management/) also returned 'page doesn't exist.' Verify by curling the linked pricing URL from the Secrets Manager page and confirming it resolves to live pricing content instead of a not-found page.
  Event 47:

  ```text
  ===== https://www.keepersecurity.com/pricing/business/ =====
  ===== https://www.keepersecurity.com/pricing/password-management/ =====
  ===== https://www.keepersecurity.com/pricing/personal/ =====
  ===== https://www.keepersecurity.com/pricing/privileged-access-management/ =====
  ```
  Event 54:

  ```text
  Title: The page you requested doesn't exist.
  
  URL Source: https://www.keepersecurity.com/pricing/business/
  ```
- **Add a free or sandbox tier for Secrets Manager API/SDK evaluation**: The Secrets Manager quickstart (docs.keeper.io quick-start-guide) requires a Keeper Business License as a prerequisite before any SDK call can be made, with no mention of a scoped free-tier or sandbox token for developers to try the API without committing to a trial/paid plan. Check by having a brand-new, credential-less developer attempt to obtain a Secrets Manager One-Time Access Token without first starting a Business trial; success would mean a token is issued without the full console workflow.
  Event 53:

  ```text
  ### Keeper Business License
  
  Secrets Manager is available for Business accounts. If you are not a Keeper customer yet, you can [start a free trial](https://www.keepersecurity.com/trial/keeper-free-trial/) from our website.
  ```

### Kimi K3
[View public run](https://agents.withgauge.com/p/runs/fc25cc66-7cc4-4f31-b0ab-efd2160072ed) · [Read transcript](https://www.ax-check.com/keepersecurity.com/sessions/kimi.json)
Gave per-user plan prices pulled from the live pricing API and named the basis: USD, before VAT, billed annually, per user. Flagged Secrets Manager as custom, quote-only pricing. (seq 69, seq 77, seq 110)
#### End-to-end onboarding
- **Onboarding needs a login**: The agent never obtained real Keeper Secrets Manager credentials (a one-time token) and never made an authenticated call against the hosted product. It only scaffolded a local example script and pulled public pricing/docs pages. No account, Secrets Manager application, or token existed in the sandbox, so no SDK call was actually executed against Keeper's API.
  Event 110:

  ```text
  I did not install or run the SDK live because I’m blocked: there’s no Keeper account, Secrets Manager application, or one-time token available in this environment.
  ```
  Event 97:

  ```text
  keeper-secrets-manager-core==17.3.0
  ```
  Event 99:

  ```text
  export KSM_TOKEN='US:BASE64_ONE_TIME_TOKEN'
  python3 keeper_example.py
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No Keeper account or one-time token available**: Building a working Keeper Secrets Manager example requires a one-time access token issued from a Keeper vault/application, which requires a human-created Keeper account. This is a normal credential gate, not a product defect, and the agent correctly identified it instead of faking success.
  Event 110:

  ```text
  I did not install or run the SDK live because I’m blocked: there’s no Keeper account, Secrets Manager application, or one-time token available in this environment.
  ```
- **Shell quoting error during price scraping**: One bash heredoc command with nested single/double quotes failed with a syntax error while trying to grep the pricing page. This was a self-inflicted scripting mistake, immediately recovered by rewriting the command in the next tool call rather than a product issue.
  Event 29:

  ```text
  /bin/bash: -c: line 1: unexpected EOF while looking for matching `"'
  
  
  Command exited with code 2
  ```

#### Suggested Changes
- **Publish Secrets Manager pricing on the public pricing/add-ons page**: The public business-add-ons page lists Keeper Secrets Manager as 'Custom Pricing' with a 'Request a Quote' link, forcing a sales contact for a developer tool, while the internal pricing API (checkout_api_web) actually returns concrete figures like secretManagerUserCost and secretManagerMonthlyOverageCost. Add Secrets Manager's list price directly to https://www.keepersecurity.com/pricing/business-add-ons/ so developers can self-serve plan a project without a sales call; verify by checking the Secrets Manager card shows a dollar figure instead of only 'Custom Pricing'.
  Event 77:

  ```text
  Keeper Secrets Manager<sup>&reg;</sup></h3><p>Secure your environment and eliminate secrets sprawl by removing hard-coded credentials from your source code, config files and CI/CD systems. <a href="/secrets-manager.html">Learn More</a></p><div class="actions centered"><p class="pricingTag"><strong>Custom Pricing</strong></p><a href="/request-quote.html" class="btn-clear-black">Request a Quote</a>
  ```
  Event 69:

  ```text
  "SecretManager": {
          "secretManagerMonthlyOverageCost": 20,
          "secretManagerUserCost": 2400
      }
  ```

### Qwen 3.8 Max
[View public run](https://agents.withgauge.com/p/runs/2ec9d421-7fb8-4630-a1e7-24f585defc51) · [Read transcript](https://www.ax-check.com/keepersecurity.com/sessions/qwen.json)
Quoted ~$3.75–4.50/user/month for Business, annual billing, and said the figures were unverified because the page renders them in JS. The figures came from memory and Secrets Manager got no number (seq 123, seq 129, seq 136)
#### End-to-end onboarding
- **Onboarding needs a login**: Agent never obtained real Keeper Secrets Manager credentials. It installed the SDK and ran it against the SDK's own built-in mock (MockConfig/ResponseQueue), which generates fake tokens and fake encrypted responses entirely locally with no network calls to Keeper's hosted service. When run without a real KSM_CONFIG token, the actual example script exited immediately with a blocked message instructing the user to get a token from the Keeper Admin Console. No authenticated operation against the real hosted Keeper service was ever demonstrated.
  Event 118:

  ```text
  Application can access 2 secret(s):
    - uid=0ee32efab29c41c4b506ca  title=Prod DB
        login: ['admin']
        password: ['s3cret-prod']
  ```
  Event 118:

  ```text
  BLOCKED: no KSM_CONFIG env var.
  Set KSM_CONFIG to a base64 application config token from your
  Keeper Admin Console (Secrets Manager -> Add Application).
  ```
  Event 71:

  ```text
  config = MockConfig.make_config()
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No self-service way to get a Keeper Secrets Manager token**: Calling the real hosted KSM service requires an application config token issued from the Keeper Admin Console, which requires human admin access. This is a normal credential/login requirement (not a product defect) and the agent correctly identified it rather than attempting workarounds that touch the live service.
  Event 118:

  ```text
  BLOCKED: no KSM_CONFIG env var.
  Set KSM_CONFIG to a base64 application config token from your
  Keeper Admin Console (Secrets Manager -> Add Application).
  ```
  Event 136:

  ```text
  actually calling the live service needs a real `KSM_CONFIG` token from your Keeper Admin Console (Secrets Manager → Add Application → copy one-time config token). I can't create that without your admin credentials
  ```
- **SDK v17 API differs from older examples/docs, causing repeated trial-and-error**: The agent's first attempts used an older API shape (SecretsManager(configuration=...), record.fields, client.get_secret(uid)) that failed against the installed v17.3.0 SDK, requiring multiple rounds of introspection and fixes. This is an agent-side mismatch with stale assumptions rather than a live product failure, but it added friction and wasted turns.
  Event 35:

  ```text
  fails gracefully with bad token: TypeError SecretsManager.__init__() got an unexpected keyword argument 'configuration'
  ```
  Event 76:

  ```text
  AttributeError: 'Record' object has no attribute 'fields'. Did you mean: 'field'?
  ```
  Event 136:

  ```text
  the SDK API changed in v17 (`SecretsManager(token=...)`, fields live in `record.dict["fields"]` / `get_standard_field_value()` rather than the old `.fields` attribute) — some docs/examples online still show the old signatures.
  ```
- **Public pricing page renders figures via JavaScript, blocking scrape**: Fetching the static pricing.html page returned only placeholder text with no dollar figures, since the numbers load client-side via JS; a plain curl could not extract them, forcing the agent to report rounded/approximate figures instead of exact pricing.
  Event 123:

  ```text
  - How much does Keeper charge? Keeper offers flexible, user-based pricing to meet the needs of businesses and enterprises: Keeper Business - Starts at per user per month, billed annually.
  ```
  Event 136:

  ```text
  Keeper's public pricing page renders actual numbers via JavaScript, so I couldn't scrape exact figures
  ```

#### Suggested Changes
- **Add a static/server-rendered pricing fallback on keepersecurity.com/pricing.html**: The pricing page's dollar figures only populate via client-side JavaScript, so a plain HTTP fetch (curl) returns text with blank numeric fields. Render the per-user dollar amounts server-side (or in page HTML/meta) so simple fetch-based tools can read exact figures. Verify by curling the page and confirming the per-user price appears in the raw HTML/text, not just after JS execution.
  Event 123:

  ```text
  Keeper Business - Starts at per user per month, billed annually.
  ```
- **Document the v17 keeper-secrets-manager-core API surface in the package/README**: The installed SDK (v17.3.0) exposes SecretsManager(token=...) and record.dict['fields']/get_standard_field_value(), which differ from what the agent initially assumed (configuration= kwarg, record.fields attribute, get_secret() singular method). Add or update the PyPI package README / docstrings with the current v17 constructor signature and field-access pattern so first-time integrators do not hit AttributeError/TypeError on first try. Verify by having a fresh agent import the SDK and construct a client purely from the README instructions without errors.
  Event 35:

  ```text
  fails gracefully with bad token: TypeError SecretsManager.__init__() got an unexpected keyword argument 'configuration'
  ```
  Event 76:

  ```text
  AttributeError: 'Record' object has no attribute 'fields'. Did you mean: 'field'?
  ```

### Task given to each agent
Help me build a simple example using Keeper. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop.

No product credentials were supplied and no purchases were authorized.

## Score: B · 72/100 (provisional)
Grades come from completed site checks. Coding sessions and skipped checks do not affect the score.

### Clarity
- **Failed** — Homepage answers Markdown requests

  ```text
  Homepage returned text/html for a Markdown Accept header; no Markdown representation offered.
  ```

- **Pass** — llms.txt provides an actionable documentation index

  ```text
  llms.txt lists products, pricing, docs, developer resources and integrations as an organized index.
  ```

- **Pass** — llms.txt provides navigation guidance

  ```text
  llms.txt groups links under clear headings like Products, Pricing, Developers and Resources.
  ```

- **Pass** — llms.txt mentions offered API, MCP, and skills

  ```text
  llms.txt mentions Developer Resources with SDKs, Keeper Agent Kit and Model Context Protocol (MCP) support.
  ```

- **Pass** — A compact guide representation exists

  ```text
  llms.txt is a compact Markdown guide covering products, pricing, docs, developers and MCP.
  ```

- **Pass** — A focused guide is directly retrievable

  ```text
  llms.txt fetched directly at /llms.txt as text/plain Markdown, 2089 tokens.
  ```

- **Pass** — Equivalent instructions fit a token budget

  ```text
  llms.txt is 2089 tokens, well under the 8000-token budget.
  ```

- **Skipped** — Product-docs links survive format changes

  ```text
  Homepage Markdown unsupported, so link preservation across formats cannot be measured.
  ```

- **Skipped** — The compact guide is independently actionable

  ```text
  Getting-started page is a video/SCORM index, not a concrete first-step quickstart; no compact guide fetched.
  ```

- **Skipped** — Install and next-step links resolve

  ```text
  No install or next-step links were sampled and fetched; only the getting-started page resolved.
  ```


### Onboarding
- **Pass** — Docs lead to a relevant quickstart

  ```text
  llms.txt links Developer Resources and Commander installation setup; docs.keeper.io overview covers Commander CLI.
  ```

- **Pass** — Installation commands are extractable

  ```text
  Commander installation page lists Windows, macOS, Linux binary install and developer setup routes.
  ```

- **Pass** — Code examples are available without interaction

  ```text
  Commander overview and CLI page show terminal commands, SDKs via NuGet/PyPI, and SuperShell usage.
  ```

- **Pass** — Prerequisites and auth boundaries are explicit

  ```text
  Commander overview states auth via Master Password, MFA, SSO or Biometrics with Passkeys.
  ```


### Pricing
- **Failed** — Pricing is readable without interaction

  ```text
  Pricing pages render plan names and 'user / month billed annually' but the actual dollar amounts are blank.
  ```

- **Failed** — Prices are stated, not gated

  ```text
  Business and Personal plan prices appear as empty placeholders ('XXX billed annually'), so amounts are effectively gated.
  ```

- **Pass** — Pricing units and limits are explicit

  ```text
  Pricing states per-user monthly billing, annual terms, and user ranges (5–10 users, 5 family users).
  ```

- **Pass** — Agents identify pricing and its assumptions

  ```text
  3 of 3 sessions were judged on pricing; 0 fell short. DeepSeek V4.1 Flash: Quoted Business at $4 and Enterprise at $6 per user per month, billed annually. Said Secrets Manager is a per-user, per-year add-on needing a Business plan or trial, PAM pricing is quote-only, and the pricing page was the source (seq 79, seq 60, seq 112) Kimi K3: Gave per-user plan prices pulled from the live pricing API and named the basis: USD, before VAT, billed annually, per user. Flagged Secrets Manager as custom, quote-only pricing. (seq 69, seq 77, seq 110) Qwen 3.8 Max: Quoted ~$3.75–4.50/user/month for Business, annual billing, and said the figures were unverified because the page renders them in JS. The figures came from memory and Secrets Manager got no number (seq 123, seq 129, seq 136) This behavioural item does not affect the fast grade.
  ```


### Activation
- **Skipped** — An API reference or OpenAPI spec is reachable

  ```text
  No API reference or OpenAPI spec was fetched; only CLI/SDK docs and marketing pages appear.
  ```

- **Skipped** — An MCP server is documented and well-formed

  ```text
  llms.txt mentions MCP support but no MCP server documentation page was fetched.
  ```

- **Pass** — A CLI install path is documented

  ```text
  Commander CLI install page links Windows, macOS, Linux, Python, .NET and PowerShell setup guides.
  ```

- **Skipped** — SDK packages resolve on their registries

  ```text
  SDKs said to be on NuGet, PyPI and GitHub, but no registry lookup result was fetched.
  ```

- **Skipped** — Agent skills are published

  ```text
  llms.txt references a Keeper Agent Kit for coding agents, but no skills page was fetched.
  ```



[Full report data](https://www.ax-check.com/keepersecurity.com/report.json)
