Quickstart

Five minutes, no account. At the end every agent on this machine is checked before it acts, and anything it breaks can be put back.

1. Install and set up

npm i -g memnox
memnox setup

Setup shows what your agents can reach today, then asks once:

◇ Found 3 agents
│ Claude Code, Cursor, Codex
◇ What they can reach today
│   can reach   ~/.ssh/id_ed25519, ~/.aws/credentials
│
│   Put them under Memnox?  [Y/n] y
└ This machine is under Memnox.

That wires your agents, writes a starting memnox.policies.toml and starts a background service. Everything it changes is backed up first.

2. Check it worked

memnox status

You see the mode, which agents are covered, the rules in force and what happened today. To prove the wiring actually holds:

memnox doctor --wiring

3. Work as usual

Open Claude Code, Cursor or Codex the way you always do. Nothing else to run. If you want one run to be fully covered, start the agent through Memnox:

memnox run -- claude

4. Read what it would have stopped

A new machine starts in observe: nothing is blocked, every verdict is recorded.

memnox timeline

claude-code  ses_9f21  2026-09-05
  14:03:24  deny   git.push-force origin main   rewriting published history is never automated
  14:03:19  allow  git.status

5. Turn it on

When the deny lines are things you really want stopped:

memnox config set mode enforce

From now on a deny is refused and an ask waits for you.

When something is stopped

memnox why        # the rule, the reason and what to do instead

Or just ask your agent why was that stopped? It asks Memnox for you.

When something goes wrong

memnox rewind                  # put your files back
memnox stop --for 30m          # turn protection off for a while
memnox start                   # turn it back on
memnox uninstall               # remove everything setup added