The control plane for your AI agents.
See what every agent is doing, set what each one may do, and approve the risky parts from your phone. Works with Claude, Gemini, Codex, Cursor and local models, over MCP and A2A.
In development · early access
Your agents have real power. Nobody's watching all of them.
Coding agents run shell commands, edit files, push code and call cloud APIs on your machines. Each vendor has its own permission prompts, its own config files, its own logs. There's no single place to see what they're all doing, set the rules once, or say no from your phone. It's the identity and access problem, now for agents.
The control plane for autonomous agents
Dashboard
Every agent session on every enrolled machine, live: what's running, which tool it's calling, what's waiting for you.
Policies
Allow, ask or deny, per agent, tool, path and command. "Gemini may read the repo, but asks before git push. Nobody reads ~/.ssh." Start from a template.
Approvals on your phone
Risky actions wait for you. Review full git diffs (+/−) and safe deploy approvals on your phone, confirmed with a passkey (fingerprint/face) and signed by a key that can't be exported from the app. Encrypted Web Push alerts you even with the app closed, dismissing automatically once approved.
Audit log
Every tool call, approval and denial, chained so that any edit is detectable, and checkpointed off the machine. Searchable and exportable.
Secrets out of config files
API keys stay in your OS keyring and are handed to a tool only when it runs.
One tool layer
Install an MCP tool once and every agent client gets it, behind the same policy gateway.
Agents that cooperate (A2A)
Your agents get A2A Agent Cards and can hand work to each other or to outside A2A agents. Policy decides who may delegate to whom.
One history & mobile chats
Every conversation across vendors and interfaces in one searchable timeline on your machine. Chat directly with any agent from your phone, waking closed sessions on demand, or use "Continue here" to migrate imported web chats without altering the original. Transcripts stay on your PC and phone; the hub only relays them end-to-end encrypted. AI titles are an explicit opt-in sent to Google only if enabled.
We can only enforce what passes through us.
Policies apply at three points: the MCP gateway in front of every tool we install; the pre-tool hooks of clients that offer them (Claude Code, Codex, Gemini CLI, Antigravity), which cover their built-in shell and file tools; and sandboxed runs started from your phone. An agent's built-in tools in a client without hooks are outside our reach, and the dashboard shows those sessions as "not enforced".
MCP connects agents to tools. A2A connects agents to each other.
Both are open standards, and we don't replace either. Agent Hub is the layer on top: identity, policy, approval and audit for the traffic they carry.
Three simple steps
Install.
One command on Windows or Linux. Setup asks before changing anything and backs up every file it touches.
Pair your phone.
Scan a QR code on your PC, then type the 6-digit code your phone shows. Nothing secret travels over the network.
Set the rules, then relax.
Pick a policy template, watch the dashboard, and approve the risky parts with your fingerprint.
Security isn't a feature here. It's the architecture.
Built by an identity and security practitioner. Read the threat model, including what we can't protect against.
Open source (AGPL-3.0). Self-host it or let us host it.
Run everything on your own Cloudflare account for free, or use our Cloud and skip the setup.
The control plane for your AI agents.
See what every agent is doing, set what each one may do, and approve the risky parts from your phone. Works with Claude, Gemini, Codex, Cursor and local models, over MCP and A2A.