Control your coding agent in one command — no signup, runs local
That recording is real — the live installer, the real CLIs, denies from the actual hook path. Sixty seconds, one story:
curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --local
No account. Nothing leaves the machine. Then a Claude Code session is asked to
squash the repo and force-push main — and the push dies at the hook with the
reason attached, before git ever runs. A curl to an external API has to ask
first. The tests run without a prompt, because normal work should never pay a
tax. And at the end, tail ~/.acp/audit.jsonl shows every call the agent
made, with the decision and the reason on each line. The same force-push dies
the same death in Codex, from the same policy file.
What the command actually installs
Three files in ~/.acp, plus a hook entry in each detected client:
decide.mjs— the decision engine. 268 lines, dependency-free, pure: no imports, no I/O, no network. It classifies a call (Bash.git.push,Bash.curl.api.stripe.com,Write), applies the floor, walks your rules most-specific-first. Read the whole thing before you let it near your shell: source.policy.json— your rules.allow/ask/deny, per tool, per git subcommand, per curl host."Bash.git.push": "ask"is the entire syntax.audit.jsonl— append-only log of every call: tool, classification, decision, source of the decision, reason.
The floor sits under all of it and always denies the catastrophic:
rm -rf on root or home, mkfs, dd to a disk device, fork bombs,
force-push to main. Token-based, so rm -r -f ~/ and
bash -c "rm -rf ~" hidden after && are the same command wearing hats —
the bypass write-up is why string
matching wasn’t enough.
What it is not
It’s not isolation. A prompt-injected agent inside this can still read what
it can read; a devcontainer is still the right call for untrusted input —
this controls actions, the container contains the process, and they stack.
And if you never touch --dangerously-skip-permissions, the built-in
prompts already carry a lot of the load; the ranked options are in
the comparison.
What it adds over any per-tool setting is the cross-vendor part: one file, one floor, one log — identical for Claude Code and Codex, instead of two config dialects that drift.
MIT, and every file the installer writes is documented.
Outgrown one machine? The same installer without --local connects a
workspace — shared policy, every session priced, one console across
everyone’s agents.
Does this need an account or send data anywhere?
No. In –local mode there is no signup, no token, and no network call in the decision path. The policy engine, the policy file, and the audit log are plain files in ~/.acp on your machine.
What does the safety floor block?
Recursive force-deletes aimed at root, home, or the working directory; mkfs; dd onto a raw disk device; fork bombs; chmod -R 777 /; and force-pushes to main or master. It’s token-based, so flag reordering and bash -c wrappers don’t slip past it, and it applies no matter what your policy file says.
Which agents does it cover?
Claude Code, OpenAI Codex CLI, and Cursor — the installer detects what you have and wires the same hook into each. One policy file governs all of them identically. Codex needs a one-time /hooks trust review inside Codex; the installer tells you.
Is this a sandbox?
No. It controls actions in the call path; a container contains the process. If your agent handles untrusted input, run a devcontainer too — they stack.
What's the difference between local mode and the cloud?
Local mode is the free individual runtime: on-device decisions, one policy file, one audit log. Re-running the installer without –local connects a workspace: shared policy across a team, every session priced, and one console across everyone’s agents.