Let your agent work unattended.

Memnox knows this session. Memnox Cloud knows everything around it. Run memnox setup once, then work in your agent as you always do: it is told the boundary when a session starts, reminded of a decision already taken where it meets one, and can ask Memnox why something was stopped. The first run needs no account, no key and no network, and the team half is added later with one login.

Start here: memnox setup Then work in your agent What Memnox is The runtime and its seams

memnox runtimeenforcing

allowmcp.* github.create_issue

askgit.credential github.com

denyshell.execute git push --force

no model in the decision path · same input, same verdict

Every action an agent takes is decided before it runs: allow, ask a named person, or deny. There are no other effects. The verdict is reproducible, and a denial names the command to run instead, so the work still finishes.

What you get

Everything a team needs to run agents without losing track of what they can reach.

What your team already settled.

The rule an agent needs was agreed in a thread months ago and lives in whoever was in the room. Memnox reads the rooms your team already runs and turns what was settled into something the evaluator can match on, without ever inventing one.

team graph

personDana Okoro

owns · billing-service

projectacme-checkout

serves · Q3 revenue goal

decisionNo PII in logs

binds · 4 repositories

A seam on every agent.

Claude Code, Cursor, Codex CLI and Cline are found by name. Hermes, OpenClaw and Ruflo are not, and are ruled anyway at the seam they pass through, which is the point: the seam never has to know what it is holding.

liveingesting

slackmessage.channels2s

githubpull_request.merged9s

linearissue.updated14s

meetingtranscript.ready1m

Proof, not promises.

Every decision appends one hash-chained audit event: who, what, which rule, which version. Editing the log breaks the chain.

audit chainintact

evt_40118 allow mcp.* github.create_issue

evt_40119 ask git.credential github.com

evt_40120 deny shell.execute terraform destroy

each event carries the hash of the one before it

Humans decide the things that matter.

Memnox suggests; a named person approves. Nothing an LLM extracted becomes a rule, and nothing risky runs, until someone accountable says so.

ask · shell.execute · git push --force

waiting on a named approver

Instead: push a branch and open a PR

What you can do with it

Six things, and each one is a single command.

Enrol one agent at a time

Its configuration is copied before anything is written, and a person approves the enrolment. What the agent may do is unchanged: that is still decided on the machine it runs on.

$ memnox agents onboard <agent>

Take it back out

The backup goes back byte for byte and the credential is revoked. Restoring the file and leaving live reach would be the wrong half, so both are reported as what actually happened.

$ memnox agents offboard <agent>

Say something to one while it works

An audited operator turn, collected on the machine's own move. It is not a system prompt and not permission: what the agent does next is decided against the rules already on that disk.

$ memnox agents control

Hold a path while you write

A second agent waits rather than writing over you, and every lease can be listed, waited on or taken over. A register nobody trusts is worse than none.

$ memnox lock src/checkout.ts

Cap what a loop can spend

What an agent may do and how much of it in a day are two questions. This is the one that catches a loop every individual call was entitled to make, counted from the ledger so a restart does not reset it.

$ memnox budget set deploys --limit 20

Be asked less, on evidence

The ledger read backwards: what you have approved so often that being asked again is the tool wasting your attention. No model reads it, and one refusal disqualifies rather than averaging away.

$ memnox next

For everyone

Three ways to use Memnox.

Engineers

Stand at the seam your agents already act through

Almost no agent will ask a policy engine anything, so Memnox goes where it acts instead: the MCP proxy, the shell, the egress proxy, the git credential helper and the browser driver. Your editor keeps working exactly as it did, until it reaches for something it was never meant to.

Claude CodeCursorCodex CLIClineHermesOpenClawRufloAny MCP client

Everyone else

Count every agent the team runs

The console answers how many there are, who each acts for, and which of them nobody owns, with the evidence behind every count. No YAML and no terminal.

CLI

Set it up once, then keep the shell for the rest

One command puts this machine under Memnox with no account. After that the work happens in your agent session, and the terminal is for the few things a person does on purpose: see where the machine stands, rewind, check the wiring, stop and start protection, and update.

$ npx memnox setup

Keep exploring

Reach for the rest.

Enrolling an agent

Put one under Memnox, and take it back out.

From watching to letting it run

Supervising less, one step at a time.

Runtime seams

How something talks to the gate, all of it local.

Integrations

Connect the tools you already run.

Policies

The TOML that decides everything.

Is this actually working

Whether anything is intercepting at all.