Skip to content
Agentic Control Plane

Control your coding agent in one command — no signup, runs local

David Crowe David Crowe · · Updated · 5 min read
claude-code codex cursor tool-policy local
Share X HN LinkedIn

That recording is real — the live installer, the real CLIs, denies from the actual hook path. Sixty seconds, one story:

curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --local

No account. Nothing leaves the machine. Then a Claude Code session is asked to squash the repo and force-push main — and the push dies at the hook with the reason attached, before git ever runs. A curl to an external API has to ask first. The tests run without a prompt, because normal work should never pay a tax. And at the end, tail ~/.acp/audit.jsonl shows every call the agent made, with the decision and the reason on each line. The same force-push dies the same death in Codex, from the same policy file.

What the command actually installs

Three files in ~/.acp, plus a hook entry in each detected client:

  • decide.mjs — the decision engine. 268 lines, dependency-free, pure: no imports, no I/O, no network. It classifies a call (Bash.git.push, Bash.curl.api.stripe.com, Write), applies the floor, walks your rules most-specific-first. Read the whole thing before you let it near your shell: source.
  • policy.json — your rules. allow / ask / deny, per tool, per git subcommand, per curl host. "Bash.git.push": "ask" is the entire syntax.
  • audit.jsonl — append-only log of every call: tool, classification, decision, source of the decision, reason.

The floor sits under all of it and always denies the catastrophic: rm -rf on root or home, mkfs, dd to a disk device, fork bombs, force-push to main. Token-based, so rm -r -f ~/ and bash -c "rm -rf ~" hidden after && are the same command wearing hats — the bypass write-up is why string matching wasn’t enough.

What it is not

It’s not isolation. A prompt-injected agent inside this can still read what it can read; a devcontainer is still the right call for untrusted input — this controls actions, the container contains the process, and they stack. And if you never touch --dangerously-skip-permissions, the built-in prompts already carry a lot of the load; the ranked options are in the comparison.

What it adds over any per-tool setting is the cross-vendor part: one file, one floor, one log — identical for Claude Code and Codex, instead of two config dialects that drift.

MIT, and every file the installer writes is documented. Outgrown one machine? The same installer without --local connects a workspace — shared policy, every session priced, one console across everyone’s agents.

Does this need an account or send data anywhere?

No. In –local mode there is no signup, no token, and no network call in the decision path. The policy engine, the policy file, and the audit log are plain files in ~/.acp on your machine.

What does the safety floor block?

Recursive force-deletes aimed at root, home, or the working directory; mkfs; dd onto a raw disk device; fork bombs; chmod -R 777 /; and force-pushes to main or master. It’s token-based, so flag reordering and bash -c wrappers don’t slip past it, and it applies no matter what your policy file says.

Which agents does it cover?

Claude Code, OpenAI Codex CLI, and Cursor — the installer detects what you have and wires the same hook into each. One policy file governs all of them identically. Codex needs a one-time /hooks trust review inside Codex; the installer tells you.

Is this a sandbox?

No. It controls actions in the call path; a container contains the process. If your agent handles untrusted input, run a devcontainer too — they stack.

What's the difference between local mode and the cloud?

Local mode is the free individual runtime: on-device decisions, one policy file, one audit log. Re-running the installer without –local connects a workspace: shared policy across a team, every session priced, and one console across everyone’s agents.

Share X HN LinkedIn
Get the next data drop
What agents actually cost, new tool-surface captures, and the occasional incident post-mortem — sent when we publish something worth your inbox, not on a schedule. Unsubscribe anytime.
Share: Twitter LinkedIn
Related posts

← back to blog