What can already act on this machine

Before any rules, any account and any network call, there is one question worth answering: what on this machine is already able to act, and what can it reach?

That is the only aggregate that is true at minute zero. Everything else, what your agents actually do, what they never needed, how much of it is governed, has to be earned over a day of real work. This is read off your own disk, so it is true immediately.

npx memnox

AI AGENTS               claude-code, claude-desktop, cursor, codex-cli
MCP CLIENTS             claude-code, cursor
 
REACHABLE FROM AN AGENT RIGHT NOW
 
  !  /Users/you/.ssh/id_ed25519      3 agents
  !  /Users/you/.docker/config.json  3 agents
  !  /var/run/docker.sock            3 agents
 
11 execution surfaces.
 
  memnox explain <name>     where any of these comes from
  memnox protect            put the dangerous ones behind ask or deny

On a machine nobody has set up, the bare command is this scan. Once memnox setup has run, bare memnox shows where the machine stands instead, and memnox scan is still the scan.

What it looked at

Agent config, MCP manifests, editor settings, shell profiles, CI workflow files, container sockets, credential chains. It identifies the kind, not the instance. Claude Code on four machines is one agent kind, or the roster is noise by week two.

When one of them runs the others

Hermes, OpenClaw and Ruflo are harnesses: they run other agents rather than being one. Each is one row on the roster and several principals at the seam, so the readout counts them, names the roles, and says which runtimes each drives:

HARNESSES               hermes, ruflo  9 principals
  hermes: 3 roles
  ruflo: 5 roles · runs claude-code, codex-cli · 2 hook files · federated across machines

Those products enforce their own tool policies and Memnox reads them rather than counting past them: a tool a harness filtered out is not reported as reachable through it. When something runs other agents has the whole story, including the paths a set of individually permitted tools opens together.

Reachability is transitive

An agent that can run a shell reaches everything the shell reaches. Stating that plainly is most of the value of the map. A report listing only the surface an agent was configured with would understate every coding agent on the machine.

Counts and names, never percentages. Forty two thousand files and two SSH keys is a fact; eighty seven percent network is a feeling with no denominator.

What is risky, and why

memnox doctor

Each finding names the agent, the resource, the evidence, and the one change that closes it.

  CRITICAL  /Users/you/.ssh/id_ed25519 is readable by 3 agent(s)
            /Users/you/.ssh/id_ed25519
            fix: deny reads of /Users/you/.ssh/id_ed25519
 
3 critical, 1 high, 3 medium, 0 low. Nothing here compares this machine to another.

Close it, reversibly

$memnox protect

$memnox protect --apply

$memnox protect --revert

PROPOSED
 
  1. deny reads of /Users/you/.ssh/id_ed25519
     undo: memnox protect --revert hs_66674bcd
 
Nothing was changed. Run memnox protect --apply to write these.

Changes land under ~/.memnox, never in a file your team reviews, and never in your agent's settings without your say-so. Anything ambiguous defaults to advising rather than refusing: one over-eager default breaking a build at midnight is the failure this product does not recover from.

Where a readable substitute exists, the rule it writes names it, so an agent refused .env is told to read .env.example instead. Where none exists, and a container socket has no example beside it, the rule refuses and says nothing more. Sending an agent at a path that is not there is worse than telling it no.

Where this machine stands

memnox status

One screen, read off this machine. --json gives the same facts in the form a script can read.

┌ memnox status
│
◇ This machine ╭──────────────────────────────────────────
│   mode        observe, watching rather than stopping
│   daemon      running, and keeping new agents and servers under Memnox
│   agents      3 agents, hooked: Claude Code, Codex, Cursor
│   mcp         2 of 2 servers through Memnox
│   rules       5 rules
│   today       40 actions, 2 would have been asked, 1 would have been denied
│   waiting     nothing
│   team        not connected, so nothing leaves this machine
│ ╰─────────────────────────────────────────────────────────
│
└ Memnox is keeping this machine.
  "memnox login" connects this machine to your team.

The counts are this example's; yours come from your own ledger.

On a machine setup has not reached, memnox status says so and names memnox setup as the way there.

The daemon keeps the boundary

Setup draws a boundary once, and the daemon keeps it drawn, whether or not the machine is logged in to a workspace. It looks again whenever an agent's configuration changes, and every five minutes regardless, and does three things:

Each one is a desktop notice, a macOS notification or notify-send on Linux, and a line in ~/.memnox/daemon.log, so nothing changes on the machine without somebody being told. What the daemon is keeping is recorded in ~/.memnox/kept.json: the agents that were hooked, the ones somebody took out on purpose, and whether new MCP servers are wrapped. It only ever acts on a machine where setup ran, so a daemon on a machine nobody set up rewires nothing. It reads the same rule files every seam reads, rather than whatever directory it was started in.

A new agent or MCP server the daemon adopts starts on seven days of probation, and the notice says so. The daemon also notices drift on its own and keeps every config change in the ledger, and it runs the egress proxy memnox run points an agent at. What changed under you has the drift, and Untrusted repositories and new agents the rest.

No fixtures, anywhere

There is no sample workspace, no seeded assistant, no simulated tool call, and no staged attack. The agents are the ones you already run and the credentials are the ones sitting in your home directory right now.

A machine with one agent and no findings reads as a real answer rather than a broken page, because there is no pretty default state to fall back to.

Next