Before you leave an agent running
What it stops, what it asks you, and what your agents can do on their own.
Your agents can already do the work. Memnox is what lets you leave them to it. Before an agent runs a command, edits a file or calls a tool, Memnox gives one of three answers by your rules: allow, ask a person, or deny.
What may happen on its own just happens. What needs a person comes to you. What you ruled out is refused with a way forward, so the agent still finishes the task. Memnox never does the work itself.
Claude Code, Codex, Cursor, Gemini CLI and Windsurf, through their own hooks. Claude Desktop, Cline and any other MCP client, through the MCP proxy. Hermes, OpenClaw and Ruflo, underneath: the shell, the credentials and the MCP servers they all share.
On Pro, agents you run on your own servers with the Claude or OpenAI agent SDK follow the same rules.
The runtime works on macOS and Linux, and on Windows through WSL. It needs Node 22 or newer.
The desktop app is Mac only for now, and Linux and Windows are coming. You do not need it: questions also reach you on the iPhone app, in the browser, or in Slack, Discord or Teams.
No. Every answer comes from rules you can read. A prompt cannot talk them around, and the same action gets the same answer every time.
No. Setup puts a hook in each agent's own config, so the agent asks Memnox before every tool call without choosing to. A refusal comes back in the agent's own words, with what to use instead.
Underneath the hooks, Memnox also sits where every agent acts: MCP servers, the shell, git and outbound connections. An agent that ignores its instructions still passes through one of them.
It cannot approve itself or switch Memnox off. An agent that tries memnox allow, turns protection off or edits a rule file is refused before any rule is read.
Some things Memnox cannot see, and we publish them rather than let you find them: the model's own reasoning, what an agent runs on its provider's servers, what a vendor does inside a product you bought, and a program called by its full path, which skips the shell layer. The git hooks and the MCP proxy close part of that last gap, not all of it.
Keep it. CLAUDE.md, AGENTS.md and Cursor rules are advice, and nothing happens when an agent ignores them. Memnox reads how your repository is actually built and holds every agent to it: a write that breaks an enforced check is refused before it lands.
Each check is tested against your code before it is kept, so what is enforced is what your code already does.
No. It reads what they already enforce and counts it. What none of them can see is the other harness on the same computer, the credentials underneath it, and the shell they all share. They decide what their agent may call. Memnox decides what the machine underneath lets through.
Wherever you are. In the terminal at your desk, on the iPhone app's lock screen, in the Mac app, in the browser, or as a message in Slack, Discord or Teams that you answer in place.
In a team, each question goes to the person in charge of that thing rather than to everyone. Every yes is signed and recorded with who gave it.
No. It starts by watching: it records what it would have asked or refused and stops nothing, until you turn the rules on.
Then memnox next shows what you could safely let each agent do without being asked, read from what you already approved. One command hands it over. An agent earns more room by how it behaves, and a single refusal is enough to hold it back.
Connect Slack, Linear, Notion or GitHub and Memnox reads where your team settles things. "Never deploy on Fridays" in #eng becomes a proposed rule, and it only takes effect once a person approves it. Agents are handed what is in force, with where each piece came from.
Connecting a source for your team memory only ever reads it. Memnox never posts, merges or changes anything there. Your own apps are different: you connect them as yourself, and Memnox acts in them only once you approve with Touch ID or Face ID.
A stuck loop stops itself before it burns money, and says why. memnox freeze stops outward actions for a set time, and memnox rewind puts back the files an agent changed.
Then ask why, in plain words: memnox why names the rule that decided it. Change that rule and the same action goes differently next time.
Not on your machine alone: no account, no telemetry by default and no network call. Your code and your secrets stay where they are.
Memnox never keeps a secret's value. It records a path, a kind and a fingerprint. With a team workspace, what is sent is an itemised list in the docs, and a secret is never on it.
Each person and each agent sees what their role already allows. Connecting a system does not widen access to it, and access is checked on every request, so a document locked down this morning is treated that way this afternoon.
No. It is used to answer your questions and govern your agents, never to train a model, ours or a model provider's.
Yes. Every answer is recorded with the agent, the action, the rule that decided it and who approved it. memnox timeline shows a session in order, and the record is always yours to export.
Run npm i -g memnox && memnox setup. It finds the agents on your computer, shows what each can reach and asks before putting it under Memnox. No account, no network.
It starts by watching. When its answers look right, memnox protect --enforce turns the rules on. When your agents keep working after you step away, or other people depend on them, memnox login connects a team workspace and nothing is rebuilt.
Memnox on your machine is free and open source, always, with no account. The cloud plans add to it: Free for one person, Pro at $19 a month, and Team at $18 per person a month from 5 people. Every price is on the pricing page, and there is no plan sold by quote.
Allow, ask and deny, approvals and the record are never behind a price.
Connecting the tools you use is never behind a price either: any tool, on every plan including Free, and in any role on a team. Say "connect my Notion", or add it from Your apps in the console, the Tools panel on your computer or the Tools page on your phone. No admin approves it, your own apps never count toward a plan, and anything Memnox sends or changes there as you still waits for your Touch ID or Face ID. What a plan counts is the sources your shared team memory is built from, which an admin connects for everyone.
Pro and Team come with 14 days free, and no card is asked for. When it ends you go back to Free unless you choose to pay, and your agents stay under your rules the whole time.
Yes, in one command. memnox uninstall removes the hooks and everything Memnox wrapped. memnox uninstall --purge deletes the history and your rules too.
Still have a question?
Try it on your own computer in a minute, or ask us and a person answers.