Marlow
Writes the source
Before you leave an agent running
Your agents can already do the work. Memnox makes it safe to let them do it without you.
Claude Code. Codex. Cursor. Hermes. OpenClaw. Ruflo.
They read your files, run commands, call MCP tools, reach your credentials, change repositories, send requests and start other agents. Each sees only its own world.
Memnox puts one boundary around all of them, and there are three answers behind it.
Run it locally. Nothing leaves your machine.
Point it at your agent
- what can happen on its ownAllow
- when a person needs to decideAsk
- what should never happenDeny
npx memnoxAI AGENTSClaude Code, Codex CLI, Cursor, Hermes, Ruflo
HARNESSESHermes, Ruflo · 9 principals
MCP6 servers · 60 tools · 11 destructive
REACHABLE~/.aws/credentials, ~/.ssh, .env, docker.sock
18 capabilities can change something outside this laptop.
None of them is governed by a policy.
Read off your own disk, in about twenty seconds. Nothing is transmitted, and nothing is refused on the first run.
claude-code
GitHub
Slack
Linear
Jira
Notion
Google Drive
Gmail
Figma
PostgreSQL
MongoDB
Snowflake
Sentry
Datadog
Stripe
Salesforce
AWS
Kubernetes
Terraform
Docker
Cloudflare
And on the machine itself, granted once
You found them. One command puts them to work.
Not a dashboard to fill in and not an agent to install. It finds what is already on the machine, asks what to call each one and whether to put it under Memnox, then wires the machine: the seams, a baseline rule set and the daemon. You answer one agent at a time.
Every agent on the machine, by the config file that proves it rather than by a process list. Claude Code, Cursor, Codex, Hermes and the rest, including the three that do not keep their servers in JSON.
The name you choose is the identity the workspace uses from then on. Pressing Enter keeps the one it detected, so naming costs a keystroke to skip and never blocks the run.
What that agent can already reach is on screen before the question, because whether to onboard something that can read your cloud credentials is a different decision from something that can only read this checkout.
It changes where an agent asks, never what it may do
Onboarding adds one MCP entry to the agent's own config and backs that file up first. Comments and indentation survive, and every rewrite is read back before it is written. Offboarding restores the file byte for byte and revokes the credential.
$ memnox setup
◇ Enrolled
workspace acme
◇ Found 3 agents
Claude Code, Cursor, Codex CLI
Claude Code claude-code
id agt_claude-code
config ~/.claude.json
mcp github, next-devtools
can use shell, filesystem, git, network, mcp
can reach ~/.aws/credentials, docker.sock, network
This is the name acme will show for it.
Call it something acme will recognise > Backend Coder
Put Backend Coder under Memnox now? [Y/n] y
onboarded Backend Coder
config updated: ~/.claude.json
backup saved: ~/.memnox/agents/backups/…
◇ Wired this machine
16 interceptors, 7 rules, daemon installed
Authority is unchanged: what it may do is still
decided on this machine.
One agent, or six
You think you are running one agent. Ruflo started four, and briefed each one differently.
A harness delegates the work. Each agent it starts got different instructions and reaches your files, your shell and your credentials on its own, and your laptop has no single answer to what the whole swarm may do.
OpenClawruns other agentsHermesruns other agentsRufloruns other agents
Wren
Reads the diff before a person does
Osprey
Runs the suite on every branch
Halden
Ships to staging, never production
Two of them reached for the same file, thirty eight seconds apart.
Marlow was rewriting src/auth.ts and Wren opened it to review. Neither could see the other, because every runtime knows only itself. Memnox stands outside both, so it can hold Wren until Marlow is done and say why.
OpenClaw read the inbox, then the account, then asked to send.
Every step was in scope on its own. The fourth is a request leaving the machine with the first three inside it. Memnox rules on what they add up to, so the answer is ask rather than a refusal that stops the work.
You do not govern Ruflo. You govern what Ruflo is allowed to start. Each agent under it is a principal: counted on its own, held at its own seam, answered for on its own.
Every agent on your machine leaves four questions unanswered.
One command each, and no account, no key and no network call. Every readout below is your own disk and your own ledger.
Your agent has access. Do you know what it can do?
You gave it access to your machine. Memnox turns that into effective capability, one agent and one path at a time, off your own disk.
$ memnox explain "can cursor read ~/.ssh/id_ed25519?"
can cursor read ~/.ssh/id_ed25519?
Technically yes — ~/.ssh/id_ed25519 is reachable by cursor
Runtime a shell is present, so the runtime restricts
nothing by itself
Policy no rules at memnox.policies.toml — nothing
here would stop it
What the organization intended is not on this disk, so it
is not answered here.
No agent will ask your permission. These are the five places it has to pass through anyway.
No agent has to remember to ask Memnox, which is the point. Each seam says what it cannot see too, because a governed agent with an unwatched side channel is worse than an ungoverned one.
01·mcp.*
MCP proxy
Sees every tool call before the server runs it, and every result coming back.
blind towhat the model is thinking, and anything it does without calling a tool
Every step was permitted. Nobody approved what they add up to.
A permission prompt answers one call at a time. These are the two things that only read as a problem from above all of them.
Three permitted steps are still one consequence.
Read a secret, write it somewhere else, push that. Nothing looked destructive. A prompt answers one call; Memnox reads effective reach.
Nobody remembers who gave it this.
Maybe it was you. Maybe a setup script, six months ago. Memnox never reads the secret: it names the path, counts what reaches it, and says nothing governs it.
Where decisions actually get madeMost of the rules you run on were never written as rules.
Most of the rules you run on were never written as rules.
They were settled in a thread and everybody moved on.
The rule an agent needs was agreed in a channel four months ago and lives in whoever was in the room. Memnox turns what was settled there into something the evaluator can match on.
A thread arrives as evidence
Every message lands with a link back to itself. Nothing that cannot point back is stored.
#platform · 12 May · 4 replies
"we are not letting an agent take a production
migration on its own. someone reviews it."A model proposes, and only proposes
It drafts a candidate carrying the exact messages it came from. The one place in the product a model runs.
candidate · drawn from 4 source events
"Production migrations are never taken by an
agent alone."A named person approves it
Somebody reads the evidence and accepts or rejects. No plan or flag gets a decision past this step.
approved by S. Okoro, platform lead
supersedes decision:staging-deploys-need-no-approvalThe evaluator matches on it
From then on it is state a rule can name, and a refusal quotes the decision and who made it.
state = [ "decision:no-solo-prod-migrations" ]
effect = "ask"A model can propose a rule. Only a person can put it in force.
It drafts, a named person accepts or rejects. A decision whose evidence is stale or whose owner has left is surfaced for review rather than trusted forever.