Working with your agent

After setup you keep working in your agent. Memnox is inside the session with you, so you rarely need the terminal.

The agent knows the rules

When a session starts, the agent is given a short note: the mode, what is denied here, what needs a person, and the project folder it should stay in.

Memnox: Memnox is watching this session in observe mode: nothing is stopped.
Never run here: git.push-force (it rewrites published history)
A person is asked first: filesystem.delete
Project boundary: /Users/you/code/shop. A write outside it asks first.

You answer in the agent's own prompt

When a rule says ask, Claude Code shows its normal permission prompt. Say yes once, yes always, or no. A yes is remembered, so the same thing is not asked again.

Agents whose prompt cannot ask (Codex, Gemini CLI, Windsurf) get a refusal with the reason and what to use instead, so they take the other route.

Ask Memnox from the chat

Setup adds a memnox-session tool to each agent. Ask in plain words:

You say	The agent calls
Why was that stopped?	`why`
Where does this machine stand?	`status`
What did you do this session?	`replay`
Am I allowed to push to main?	`decisions`
Undo what you changed.	`rewind`, which you must approve

No tool can approve, change a rule or switch the mode. An agent that could would approve itself.

To turn the tools off, or back on:

bash

memnox mcp session off
memnox mcp session on

What each agent supports

Agent	Told the rules	Asks you in its prompt
Claude Code	yes	yes
Codex	yes	no, it refuses instead
Gemini CLI	yes	no, it refuses instead
Cursor	no	yes
Windsurf	no	no, it refuses instead

Every agent is still checked at the shell, the MCP proxy and git, whatever the table says.

Approvals

Answering when you are not at the keyboard.

Undo and check

Rewind your files, or test a plan first.