What the installer actually does

curl -sf https://agenticcontrolplane.com/install.sh | bash is one line, but it’s not magic — and you should know exactly what runs on your machine before you pipe anything to bash. This page lists every file it touches, in plain language, and how to undo it.

The script is readable source — nothing is compiled or hidden. It only writes to your home directory, never uses sudo, and never sends your code anywhere. It detects which coding agents you have installed (Claude Code, Cursor, Codex, opencode, OpenClaw, DeepSeek Harness) and configures each one it finds.

Two modes: connected workspace (default) or fully on-device (`--local`)

There are two ways to run it, and they write different files:

# default: connect a workspace (browser OAuth) for team policy, cost X-ray, shared console.
curl -sf https://agenticcontrolplane.com/install.sh | bash

# --local: decisions run ON YOUR MACHINE. No account, no network, nothing leaves your box.
curl -sf https://agenticcontrolplane.com/install.sh | bash -s -- --local

Everything in the “optional extras” section below (the credential, the cost-X-ray wrapper, the PATH edit, the MCP registration) is cloud-only — --local skips all of it. Below, each row is tagged [both], [local], or [cloud] so you can see exactly what each mode writes.

The core

Path	What it is	Mode
`~/.acp/govern.mjs`	The hook dispatcher — ~200 lines of Node, no dependencies. Your agent runs it before (and after) every tool call. In local mode it calls `decide.mjs`; in cloud mode it POSTs to the ACP API. Fails open by default — if the engine or API is unreachable, your tool still runs, loudly flagged as ungoverned.	[both]
`~/.acp/decide.mjs`	The on-device decision engine — pure, self-contained, no network. Classifies each tool call and returns allow / ask / deny from your policy, plus an always-on safety floor (`rm -rf /`, `mkfs`, `dd` to a disk, fork bombs, force-push to `main` are blocked no matter how they’re spelled).	[local]
`~/.acp/policy.json`	Your rules — `allow` / `ask` / `deny` per tool, one file, applied identically to every agent. Edit it by hand; the safety floor stands regardless.	[local]
`~/.acp/audit.jsonl`	The on-device log — one line per call (tool, decision, reason, timestamp). `tail -f ~/.acp/audit.jsonl` to watch it. Nothing is sent anywhere.	[local]
`~/.acp/credentials`	Your workspace API key (`gsk_…`), written after you authorize in the browser. How the hook proves which workspace it belongs to. A token, not a password.	[cloud]
`~/.acp/failmode`	(optional) `open` or `closed`. Only if you opt into fail-closed. Absent = the safe default (fail-open).	[both]

In --local mode, that’s the whole install: govern.mjs + decide.mjs + policy.json, writing to audit.jsonl. No account, no credential, no network. Everything below is per-harness wiring or cloud-only convenience.

Per-agent wiring — only for the agents you have

The installer registers the hook with each detected agent by editing that agent’s own config file (an idempotent JSON/TOML merge that preserves your other settings):

Agent	File edited	What’s added	`--local`?
Claude Code	`~/.claude/settings.json`	`PreToolUse` + `PostToolUse` hook entries pointing at `govern.mjs`	✅ fully governed on-device
Cursor	`~/.cursor/hooks.json`	The same two hook entries (lowercase keys)	✅ fully governed on-device
Codex	`~/.codex/config.toml`, `~/.codex/hooks.json`, `~/.codex/AGENTS.md`	Enables `codex_hooks`, registers the hook, and adds a short directive telling Codex to check non-Bash tools	⚠️ shell calls only — the non-Bash MCP connector + `AGENTS.md` directive are cloud-only
opencode	`acp-opencode` plugin + gate in `~/.config/opencode/opencode.json`	The npm governance plugin (opencode uses in-process plugins, not shell hooks)	❌ cloud-only — skipped in `--local` (plugin needs a workspace)
OpenClaw	(plugin install command)	`@gatewaystack/acp-governance`	✅
DeepSeek Harness	your dsh profiles (`dsh plugin add` per profile)	The `dsh-plugin-acp` native plugin on dsh’s tool pipeline	❌ cloud-only — skipped in `--local` (plugin needs a workspace)

The optional extras — cloud mode only

These aren’t governance; they’re conveniences, and they’re all cloud-only. Running with --local skips every row in this table — no wrapper, no PATH edit, no MCP registration, no shell-rc changes. They’re the part worth scrutinizing, which is exactly why --local exists.

Path	What it is	Note
`~/.acp/bin/claude-acp`	A wrapper that launches Claude Code with model calls routed through the ACP proxy, so you get the cost X-ray (spend, cache-hit rate, loop-vs-leaf).	Optional. Only useful if you want cost metering, not just governance.
`~/.zshrc` / `~/.bashrc` / `~/.profile`	One line appended: `export PATH="$HOME/.acp/bin:$PATH"` so `claude-acp` is on your PATH.	This is the most invasive thing the installer does — it edits your shell startup file. Tagged `# acp-installer` so it’s easy to find and remove.
`~/.acp/bin/acp-session-summary`	A small helper that prints a session’s cost/governance summary.	Optional convenience.
`~/.claude.json`, `~/.cursor/mcp.json`, `~/.config/opencode/opencode.json`	Registers the ACP introspection MCP so your agent can query its own usage, cost, and policy recommendations.	Optional. Read-only self-awareness tools; see the MCP tools.

How to remove all of it

Nothing here is sticky. To fully uninstall:

rm -rf ~/.acp                                   # hook, credentials, wrappers
# remove the PATH line the installer added:
sed -i '' '/# acp-installer/d' ~/.zshrc ~/.bashrc ~/.profile 2>/dev/null

Then delete the hook entries from whichever agent configs you use (~/.claude/settings.json, ~/.cursor/hooks.json, ~/.codex/hooks.json, ~/.config/opencode/plugin/acp-govern.ts). Your agents work exactly as before — the hook simply stops firing.

Our commitment

--local is genuinely local. The hook, the decision engine, your policy, your audit log — that’s the whole install, all on your machine. No account, no credential, no network call. You can read every decision decide.mjs makes.
The cloud extras are opt-in by a flag. The cost-X-ray wrapper (and its PATH edit) and the MCP registration only exist when you connect a workspace. Add --local and none of them are written.
Nothing is hidden. The script is plain text you can read top to bottom before running it, and the local engine ships in the same file — verify the safety floor yourself.