See the config change before it ships.

Diffkeel renders the config each environment receives and diffs it against what runs there now. A change nobody reviewed fails the build.

Install Read the first diff
$curl -fsSL get.diffkeel.example | sh

macOS and Linux, one binary

Free CLI, no accountYAML, JSON, TOML and env files
diffkeel diff prod
--- prod, running since 2026-10-21 +++ prod, rendered from this commit @@ api.yaml @@ replicas: 4 -timeout: 30s +timeout: 5s @@ worker.yaml @@ -queue.concurrency: 8 +queue.concurrency: 16 @@ prod.env @@ -DB_PASSWORD: ******** (a1f3) +DB_PASSWORD: ******** (9c07)
1Binary, with no runtime to install
4Formats read: YAML, JSON, TOML, env
0Secret values printed, ever
9 MBDownload for macOS or Linux

One diff, three places

$ diffkeel diff prod
rendered prod from 3 files in 41 ms
✓api.yamltimeout 30s to 5s
✓worker.yamlqueue.concurrency 8 to 16
✓prod.envDB_PASSWORD changed, value masked
3 changes, 1 secret, 0 reviews
$ diffkeel check --env prod --require-review
3 changes in prod need a review
✓api.yamltimeout 30s to 5s
✓worker.yamlqueue.concurrency 8 to 16
✓prod.envDB_PASSWORD changed, value masked
exit 1: deploy stopped
# diffkeel.toml
[env.prod]
files = ["base.yaml", "prod.yaml", "prod.env"]
live = "./scripts/read-live-config.sh prod"
mask = ["DB_PASSWORD", "API_TOKEN"]
review = "required"

Four commands

Render, diff, mask, gate.

Render

The config each env gets

Overlays, defaults and env files resolved into the final values.

Diff

Against what runs now

Compared with the live config, key by key, not file by file.

Mask

Secrets stay masked

A changed secret shows as changed, with a short hash. Its value never prints.

Gate

Unreviewed changes fail

A prod change without a review exits 1, in any CI that runs a container.

Where it runs

Laptop, team, agent.

On a laptop

Before the pull request.

zsh · feature/shorter-timeouts
$ diffkeel diff staging rendered staging from 2 files in 18 ms api.yaml timeout 30s -> 10s api.yaml retries 3 -> 5 1 file, 2 changes, 0 secrets $ diffkeel render staging --key api.timeout 10s from staging.yaml, line 12 over base.yaml, line 4 (30s) $ diffkeel diff staging --json | wc -l 2

For the team

Stored diffs and approvals, on Team.

POST/v1/diffs/{id}/approve
Requestapplication/json
{ "env": "prod" }
Response200 OK
{ "id": "df_8k2", "approved": true }

In an agent

JSON output an agent reads.

Ask an agent

Run diffkeel diff prod --json and explain each change in one line.

Free CLI

Diff your next deploy.

Install one binary and run it in the repository you deploy from.

The first five minutes
$ diffkeel init wrote diffkeel.toml with 2 environments: staging, prod $ diffkeel diff prod 3 changes, 1 secret, 0 reviews $ diffkeel check --env prod --require-review exit 1: 3 changes need a review
InstallSee Team