How it works

Before an agent runs a command, edits a file or calls a tool, Memnox checks it against your rules, on your machine. No model decides, so the same action always gets the same answer.

Every action walks the same five stages, on your own machine, whichever agent asked. The verdict is settled by the first stage with something to say about it, and a withheld call never reaches the ones after it.

Three answers

Answer	What happens
`allow`	It runs.
`ask`	It waits until a person says yes or no.
`deny`	It does not run, and the agent is told what to do instead.

There is no fourth. When several rules match, the strictest one wins: deny beats ask, and ask beats allow.

What gets checked

Setup puts Memnox in the paths your agents already use. Each is called a seam.

Seam	Catches
Agent hooks	Tool calls in Claude Code, Codex, Cursor, Gemini CLI and Windsurf
Shell	Commands like `git`, `gh`, `aws`, `kubectl`, `terraform`, `vercel`
MCP proxy	Every call to an MCP server
Git credentials	Any push or fetch that needs your login
Network	Requests to hosts no rule names

Each command becomes one action name, which is what a rule matches on:

git push --force origin main   →  git.push-force
gh pr merge 12                 →  gh.pr-merge
terraform destroy              →  terraform.destroy

To see the name for any command:

bash

memnox policy test "git push --force"

Watching or enforcing

One setting decides whether an answer is applied:

bash

memnox config set mode observe   # record every answer, block nothing
memnox config set mode enforce   # apply every answer

A new machine starts in observe. Two more values exist: advise tells the agent the answer but lets it through, and off checks nothing.

A quick preset for the whole machine

If you do not want to write rules yet, pick how much freedom agents get:

bash

memnox mode investigate   # read anything, change nothing outside this machine
memnox mode autonomous    # do the work, stop at money, deploys, deletes and production
memnox mode off           # back to your own rules only

Everything is recorded

Every answer is one line in a local log under ~/.memnox. Arguments are stored as a fingerprint, never in full, because that is where a secret would be.

bash

memnox timeline              # what happened, in order
memnox timeline --only deny  # only what was stopped
memnox why                   # why the last thing was stopped
memnox trace <id>            # one action, end to end

Rules

Write your own allow, ask and deny.

Working with your agent

What your agent sees, and how you answer it.