What the installer actually does
curl -sf https://agenticcontrolplane.com/install.sh | bash is one line, but it’s not magic — and you should know exactly what runs on your machine before you pipe anything to bash. This page lists every file it touches, in plain language, and how to undo it.
The script is readable source — nothing is compiled or hidden. It only writes to your home directory, never uses sudo, and never sends your code anywhere. It detects which coding agents you have installed (Claude Code, Cursor, Codex, opencode, OpenClaw, DeepSeek Harness) and configures each one it finds.
Two modes: connected workspace (default) or fully on-device (--local)
There are two ways to run it, and they write different files:
# default: connect a workspace (browser OAuth) for team policy, cost X-ray, shared console.
curl -sf https://agenticcontrolplane.com/install.sh | bash
# --local: decisions run ON YOUR MACHINE. No account, no network, nothing leaves your box.
curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --local
Everything in the “optional extras” section below (the credential, the cost-X-ray wrapper, the PATH edit, the MCP registration) is cloud-only — --local skips all of it. Below, each row is tagged [both], [local], or [cloud] so you can see exactly what each mode writes.
The core
| Path | What it is | Mode |
|---|---|---|
~/.acp/govern.mjs |
The hook dispatcher — ~200 lines of Node, no dependencies. Your agent runs it before (and after) every tool call. In local mode it calls decide.mjs; in cloud mode it POSTs to the ACP API. Fails open by default — if the engine or API is unreachable, your tool still runs, loudly flagged as ungoverned. |
[both] |
~/.acp/decide.mjs |
The on-device decision engine — pure, self-contained, no network. Classifies each tool call and returns allow / ask / deny from your policy, plus an always-on safety floor (rm -rf /, mkfs, dd to a disk, fork bombs, force-push to main are blocked no matter how they’re spelled). |
[local] |
~/.acp/policy.json |
Your rules — allow / ask / deny per tool, one file, applied identically to every agent. Edit it by hand; the safety floor stands regardless. |
[local] |
~/.acp/audit.jsonl |
The on-device log — one line per call (tool, decision, reason, timestamp). tail -f ~/.acp/audit.jsonl to watch it. Nothing is sent anywhere. |
[local] |
~/.acp/credentials |
Your workspace API key (gsk_…), written after you authorize in the browser. How the hook proves which workspace it belongs to. A token, not a password. |
[cloud] |
~/.acp/failmode |
(optional) open or closed. Only if you opt into fail-closed. Absent = the safe default (fail-open). |
[both] |
~/.acp/.stale-notice |
A timestamp, rewritten on every install and acp-update run. Lets the hook stay quiet about its own version for a while right after a refresh, instead of nagging the same minute it was brought current. |
[both] |
In --local mode, that’s the whole install: govern.mjs + decide.mjs + policy.json, writing to audit.jsonl. No account, no credential, no network. Everything below is per-harness wiring or cloud-only convenience.
Per-agent wiring — only for the agents you have
The installer registers the hook with each detected agent by editing that agent’s own config file (an idempotent JSON/TOML merge that preserves your other settings):
| Agent | File edited | What’s added | --local? |
|---|---|---|---|
| Claude Code | ~/.claude/settings.json |
PreToolUse + PostToolUse hook entries pointing at govern.mjs |
✅ fully governed on-device |
| Cursor | ~/.cursor/hooks.json |
The same two hook entries (lowercase keys) | ✅ fully governed on-device |
| Codex | ~/.codex/config.toml, ~/.codex/hooks.json, ~/.codex/AGENTS.md |
Confirms the hooks feature flag (on by default since 0.145; codex_hooks on older builds), registers the hook, and adds a short directive telling Codex to check non-Bash tools |
⚠️ shell calls only — the non-Bash MCP connector + AGENTS.md directive are cloud-only |
| opencode | acp-opencode plugin + gate in ~/.config/opencode/opencode.json |
The npm plugin that checks each tool call (opencode uses in-process plugins, not shell hooks) | ❌ cloud-only — skipped in --local (plugin needs a workspace) |
| OpenClaw | openclaw plugins install |
The @agenticcontrolplane/openclaw plugin on OpenClaw’s plugin system |
✅ |
| DeepSeek Harness | your dsh profiles (dsh plugin add per profile) |
The @agenticcontrolplane/dsh native plugin on dsh’s tool pipeline |
❌ cloud-only — skipped in --local (plugin needs a workspace) |
The optional extras — cloud mode only
These don’t enforce anything; they’re conveniences, and they’re all cloud-only. Running with --local skips every row in this table — no wrapper, no PATH edit, no MCP registration, no shell-rc changes. They’re the part worth scrutinizing, which is exactly why --local exists.
| Path | What it is | Note |
|---|---|---|
~/.acp/bin/claude-acp |
A wrapper that launches Claude Code with model calls routed through the ACP proxy: policy on the model call and the declared tool surface. | Optional. Cost no longer needs it — the hook prices model turns from the session transcript on its own. |
~/.acp/transcript-offsets.json |
Where the hook is up to in each session transcript it has priced — a few byte offsets, nothing else. | [cloud] convenience; safe to delete (turns already reported are not re-priced). |
~/.zshrc / ~/.bashrc / ~/.profile |
One line appended: export PATH="$HOME/.acp/bin:$PATH" so claude-acp is on your PATH. |
This is the most invasive thing the installer does — it edits your shell startup file. Tagged # acp-installer so it’s easy to find and remove. |
~/.acp/bin/acp-session-summary |
A small helper that prints a session’s cost summary with a deep link to its cost X-ray. | Optional convenience. |
~/.acp/bin/acp-update |
Re-runs the installer in --update mode: refreshes govern.mjs, every launcher, and each harness’s hook registration and directive block, without touching ~/.acp/credentials or repeating the login flow. |
Optional convenience. The hook reports its own version, and points you at this command once a refresh is available — see cost tracking. |
~/.claude.json, ~/.cursor/mcp.json, ~/.config/opencode/opencode.json |
Registers the ACP introspection MCP so your agent can query its own usage, cost, and policy recommendations. | Optional. Read-only self-awareness tools; see the MCP tools. |
How to remove all of it
Nothing here is sticky. To fully uninstall:
rm -rf ~/.acp # hook, credentials, wrappers
# remove the PATH line the installer added:
sed -i '' '/# acp-installer/d' ~/.zshrc ~/.bashrc ~/.profile 2>/dev/null
Then delete the hook entries from whichever agent configs you use (~/.claude/settings.json, ~/.cursor/hooks.json, ~/.codex/hooks.json, ~/.config/opencode/plugin/acp-govern.ts). Your agents work exactly as before — the hook simply stops firing.
Our commitment
--localis genuinely local. The hook, the decision engine, your policy, your audit log — that’s the whole install, all on your machine. No account, no credential, no network call. You can read every decisiondecide.mjsmakes.- The cloud extras are opt-in by a flag. The cost-X-ray wrapper (and its PATH edit) and the MCP registration only exist when you connect a workspace. Add
--localand none of them are written. - Nothing is hidden. The script is plain text you can read top to bottom before running it, and the local engine ships in the same file — verify the safety floor yourself.