Quickstart: govern an agent

Ten minutes, one command, no account. At the end your editor's AI is running behind a gate that records every action it takes and can stop the dangerous ones.

Install

1. 1

   Run setup

   One command does everything: it scaffolds a policy file from what it detects in the repository, registers a local agent and stores its token, installs hooks for whichever editors you actually have, registers the Memnox MCP server, and starts the runtime.

   bash

   npx memnox setup

   Wrote starter policies to memnox.policies.yaml (project: acme-checkout)
   Detected: payments, database migrations, CI/CD, infrastructure as code
   Packs: production-safety, terminal-safety, payments, money-movement,
          data-privacy, supply-chain, infrastructure

   Detection is deterministic and offline, dependency names and file existence, no model and no network, so the same repository always scaffolds the same rules. It only ever adds packs. Pass --no-detect for the generic starter instead.

2. 2

   Restart your editor

   The hooks are read when the editor starts. Until you restart it, nothing is intercepted.

3. 3

   Check what is in force

   bash

   memnox status

   Runtime   : http://127.0.0.1:7466
   Policies  : 10 (version e852ac2d63d0)
   Project   : acme-checkout
   Credential: stored (config)
   Decisions : 214 recent
   Waiting   : 1 approval(s)
   Observed  : 9 would have been stopped if enforcing

   That last line is the number to watch. It is what --enforce would have blocked, and therefore whether enforcing is safe yet.

The first run does not block

Everything is switched on, and nothing is enforced. A guard that fires writes an audit line; it does not stop your editor.

That is deliberate: a rule you have not read yet must not wedge your editor on minute one.

memnox audit

2026-07-31T23:03:24Z  BLOCK  local-editor: shell.execute rm -rf / — Destructive
                             shell commands are blocked for AI agents.
2026-07-31T23:03:24Z  ALLOW  local-editor: shell.execute ls -la — no policy matched

Read a day of that. When the BLOCK lines all look like things you actually want stopped, turn it on:

memnox setup --enforce

The full path from observing to enforcing, including how to handle the rules that turn out to be wrong, is in From observing to enforcing.

What just got installed

Full detail in Protect your agents.

Ask before you act

A gate refuses an action after an agent has already committed to it. The cheaper move is to answer the question first:

memnox context file.write 'src/app/(auth)/login/page.tsx'

Memnox constraints for "file.write src/app/(auth)/login/page.tsx"
This action would need human approval before it proceeds (risk: medium).
Next: ask security-team to approve before this proceeds.
 
Rules that apply — these decide whether this proceeds:
  - auth-code-review — your policy, requires approval
      Auth and session code changes need a second pair of eyes.
      approvers: security-team

memnox setup already registered the MCP server, so your agent can ask this on its own before it writes. See Ask before you act and MCP tools.

Write your first rule

Open the memnox.policies.yaml that setup wrote and add one:

  - name: no-production-database-writes
    match:
      actions: ["database.delete", "database.drop"]
      environments: ["production"]
    decision:
      effect: block
      reason: No AI-initiated destructive database operations in production.

memnox validate          # is the file well formed
memnox reload            # re-read it without restarting

Policies stay in your repository on purpose: a rule set that can be changed over HTTP is one nobody can review in a diff. See Writing policies.

Working from a clone

npm install
npm run build     # the CLI runs from dist/, which is not committed
npx memnox setup