Let your agents run. The dangerous calls wait for you.
ACP is a hook that checks each tool call from Claude Code, Codex, Cursor and eleven more before it runs. On the shell, a force-push, destructive SQL or curl | sh waits for you. Everything else runs and lands in one log. Free for individuals.
Paste it in a terminal. It finds the coding agents on this machine, asks which to cover, adds a hook to each, and opens a browser tab to set up a free workspace. Every file it writes · What is stored · No account: add --local.
The built-in holds (the safety floor) are on from the first call. Rules you add yourself are only recorded until you turn them on. Protected in 3 steps
More than 1.75 million policy decisions so far
Policy decisions ACP has made on agents' tool calls, checked before each call runs and again on its result.
One set of rules for every agent you run
Claude Code in one terminal, Codex in another, an agent running overnight. ACP sees the tool calls from all of them. Two layers decide what happens. The safety floor is on by default, with no rule written: a force-push, destructive SQL through a database client, curl | sh, or a recursive delete outside the project waits for a person, and rm -rf of your home or root never runs. Your own rules sit on top: allow, ask first, or never, by tool, written once for every agent. They start in audit mode, recorded until you turn enforcement on.
Every blocked call is a row: the tool, the reason, and the agent that tried it. Shown: denials on our own agents. Tap to enlarge.
Decide what each MCP tool may do
Your agents connect to MCP servers you didn't write: GitHub, Supabase, Stripe, a browser. Most of those servers offer a few launch flags, and almost none keep a record of what was called. ACP sees each MCP tool call your harness passes to its hook, writes it to the same log as the shell, and applies your rule for that tool: allow, ask first (ask), or never (deny).
"mcp__github__merge_pull_request": "ask", "mcp__github__delete_file": "deny", "mcp__supabase__execute_sql": "ask"
A rule names the exact tool as your harness reports it; here the servers are registered as github and supabase. The safety floor does not read MCP arguments, so an MCP tool waits for a person only once you write its rule. Which harnesses pass MCP calls to the hook is in the coverage table.
Use it for your own work, for free
One command on your machine and every run gets a record: each tool call and model call in order, what it touched, what it cost, and the decision that let it through. When a run does something you didn't expect, or costs $50 you didn't expect, you can see why. On Claude Code the hook prices model calls from the session transcript, at API list rates. On the other harnesses they are priced when you start the agent through the launcher the installer adds (codex-acp, ...). Free up to 5 agents (an agent is one install: your Claude Code, a CI bot; whatever it spawns is free). Add --local and there is no account at all.
One run, call by call: the model call, the shell command, the decision, the milliseconds, and the cents. Tap to enlarge.
Use it with your team, with shared controls
Everyone who installs runs under the same rules. Once enforcement is on, risky calls wait for a person to approve them, and every agent's activity lands in one log. You don't hand-write the rules: when an agent hits a block on something legitimate, it proposes the rule with its reasoning, and a person confirms or rejects it in one click.
How a team sets it up, step by step
An agent asked to run something risky. A person allowed it once, and the record shows who and when. Tap to enlarge.
Four questions before you install
You already run auto mode, a sandbox and an allowlist. Here is what changes, and what does not.
Why not auto mode and a sandbox?
Keep both. A sandbox bounds where the agent's code can run. Auto mode and allowlists are settings inside one harness. Neither looks at an action the agent takes with your own credentials: a push with your git login, a DROP TABLE against a database it can reach, a curl that sends a file out.
ACP sits at the tool call itself. One set of rules covers every harness you run, the same call gets the same answer in each, and there is one log to read afterwards. For runs with nobody watching, set the background and subagent tiers to Never on rm, git push, curl and your database clients, keep interactive sessions on Ask first, and keep production credentials out of the agent's environment. The overnight recipe →
Does it cover my other harness?
Fourteen harnesses install with the one command (thirteen on native Windows). What differs is where you approve. Only Claude Code shows a held call in the terminal. On the other harnesses the call is blocked, you approve it on the console or from the email, then ask the agent to retry. One exception today: DeepSeek Harness reports the block to the agent but does not enforce it yet.
The safety floor reads shell commands (Bash and PowerShell). File edits and MCP tools do not reach the floor; they are recorded and take your rules by tool name. What each harness lets ACP intercept is in the coverage table.
What leaves my machine?
In a connected install the hook sends each call to ACP to decide and record. The stored record is the metadata: tool, who ran it, the decision and the reason, latency, tokens and cost. By default the command's text and output are not stored; a workspace admin can turn on short previews. A held call keeps up to 500 characters of its arguments so the approver can read what they are approving. A credential that appears in a command's arguments is redacted before the record is written.
With --local nothing leaves. Rules live in ~/.acp/policy.json and the log in ~/.acp/audit.jsonl. Everything that is stored
What if ACP is down?
On Claude Code, an interactive session keeps running and shows a loud UNGOVERNED notice. Subagents, background runs and API sessions stay blocked until ACP answers. Set rules for those tiers accordingly.
Other harnesses use the shared hook, which lets calls through when ACP is unreachable unless you set ACP_FAIL_MODE=closed or ~/.acp/failmode on that machine. --local has no server to lose.
Free up to 5 agents. An agent is one install that starts work, such as your Claude Code or a CI bot; its subagents are free. Teams $100 a month for 25. Pricing →
Already installed? Open your console →