Approve Claude Code and Codex commands from your phone
You started a long run, closed the laptop and went to dinner. Twenty minutes in, the agent wants to run git push --force, or rm -rf build/, or a curl to a host you’ve never heard of. Either it runs because nothing stopped it, or it sits on a prompt until morning because nobody was there.
The fix is to have the question come to you, and only the questions that matter.
The options, and what each covers
As of September 2026:
- Claude Code Remote Control (built in). Your running session shows up in the Claude mobile app. You can read output, send instructions, and approve or deny permission prompts. The work stays on your machine. It’s Claude Code only, and it answers the prompts Claude Code would have shown you in the terminal.
- Push hooks for Claude Code, such as claude-remote-approver. A hook on the permission prompt sends it to your phone through ntfy, and you tap approve or deny. It’s free and quick. Keep the ntfy topic private, because anyone who knows it can answer your approvals.
- Pushary. Per-tool auto-approve, deny or escalate across Claude Code, Codex, Cursor and Hermes. Escalations arrive as a push you can answer from the lock screen. It was $9.99 a month when we looked.
- ACP. Your rules decide which calls are held. A held call emails the workspace owner with the tool, the input, the agent and the reason. You approve or deny it on the console, which works in a phone browser. It covers the harnesses ACP hooks, and every decision lands in the same audit log as the calls that didn’t need you.
If you only run Claude Code and want a lock-screen tap, Remote Control or a push hook is the shortest path. The rest of this post is the ACP setup, for when you run more than one agent or want approvals and the audit log in one place.
Step 1: Install
curl -sf https://agenticcontrolplane.com/install.sh | bash
It detects Claude Code, Codex and the other harnesses on the machine and wires the hook, so each tool call is checked before it runs. Connect a workspace when it asks. Approvals need one, because the request has to wait somewhere you can reach from your phone.
Step 2: Decide what should reach you
Every call gets one of three outcomes:
- allow for routine work: reads, edits in the repo, tests, installs.
- deny for what should never run unattended, such as a
curlto a host you don’t use. - ask for the in-between cases: calls you’d want to see first, but that are sometimes right.
Some of this is already decided for you. The safety floor holds a force-push, destructive SQL sent to a database client, curl | sh, and deletes outside the project for your approval, with no rule needed. It always blocks rm -rf of your home or root directory, mkfs, disk wipes and fork bombs. Those hold in every mode, including audit.
Rules are set per tool and per agent tier. A call can be allow when you’re at the keyboard and ask when a background agent makes it. A new workspace starts in audit mode: everything is recorded, the floor applies, and your own rules don’t block yet. Run a normal day, read the Activity page, then turn on enforcement with /acp-enforce or the Policies page. If your phone buzzes for ls, the rules are wrong. The phone is fine.
Step 3: Answer from your phone
When a call hits an ask, the agent gets one line back, [ACP] Approval required: <reason>, and the call waits. The workspace owner gets an email with what was asked. Open the Approvals page in the console on your phone:
Approve lets the agent retry that exact call once, within the grant window. Then you ask the agent to retry. A different command, or the same one after the window closes, is held again. Deny is final, and the agent is told why.
Where the question shows up depends on the harness:
- Claude Code, at the keyboard. A safety-floor hold appears as Claude Code’s own permission dialog for the workspace owner or admin. It times out after 10 minutes. If you walk away, Remote Control is how you’d answer it from your phone. The two work together.
- Everything else. Codex, Cursor, Qwen Code and the other harnesses show the one-line hold, and you approve on the console or from the email.
- Background agents, subagents and headless runs. These are held for the console and the email.
A request nobody answers expires at the end of the hold window and counts as a deny. The default is 24 hours, settable per tool from 30 seconds to 7 days. The row stays in the audit log, marked as expired.
Headless runs
claude -p and codex exec have no terminal to answer a prompt, so a call that would have asked is denied. For claude -p, ACP has a permission-prompt tool, acp_permission_prompt, in the acp-mcp-server package. It checks each prompt at the background tier and holds asks for a person. It is not on the hosted MCP server the installer registers yet. Until it is, an unattended agent can poll a held approval with acp_wait_approval. Details are in Claude Code headless approvals and Codex exec and MCP approvals.
If you won’t be around to answer, don’t leave ask rules on the unattended tier. Set those tools to allow or deny so the run never waits on someone who isn’t there.
When one answer should become a rule
If you approve the same call three nights in a row, it shouldn’t be an ask. On any row of the Activity page, choose Allow always, Ask next time or Deny next time, and that becomes the rule for that tool and tier. Agents can also propose a rule after a denial. Nothing they propose applies until you confirm it.
The reference for holds, grant windows and expiry is /docs/approvals. Running several agents across a team? Same permission rules for Claude Code, Codex and Cursor covers who can approve and how rules are shared.
Running Codex? One command adds a hook for shell, apply_patch and MCP calls. Each call is recorded, and a force-push, destructive SQL or curl | sh is blocked until you approve it on the console or from the email.
curl -fsSL https://agenticcontrolplane.com/install.sh | bashirm https://agenticcontrolplane.com/install.ps1 | iexWhat the installer writes · Codex guide · free up to 5 agents