Three steps to leave it running.
No account and no network. Your agents keep working, and Memnox answers before anything runs.
1
Set it up once
One command finds every agent on your machine and what each one can reach, then puts Memnox where their work has to pass. It writes down where your secrets are, never what is in them, and nothing leaves the machine.
memnox setup2
Watch a day of real work
The first install refuses nothing. Every answer is written down, so after a day you can see what a rule would have stopped and what your agents never needed, before it costs you anything.
memnox timeline3
Let it run without you
Switch the machine to autonomous and walk away. Most actions never ask, a refusal tells the agent what to do instead, and only what a rule marks ask waits for a person, on their phone or in Slack, Discord or Teams.
memnox mode
One call, answered in order.
Which agent asked, the rule it meets, the answer, what runs, and the record it leaves. Pick a place below to watch another.
Claude Code hooks: The refusal that still finishes the work. Claude Code, mid task, filesystem.read · .env, attributed first (claude-code · fix the failing auth tests), is checked against the rule "secrets-not-required": A task that declared no credential need does not get to read one. The verdict is denied, .env.example named instead, and it is then applied at every surface the agent tried to reach. The result is appended to the record, which now holds 0 rules across 4 agents and which every later decision is measured against.
A task that declared no credential need does not get to read one.
One answer wherever agents act.
No agent stops to ask on its own. So Memnox stands where its work has to pass, and answers before anything runs.
- Claude Code
git push --force origin mainDeny - Cursor
github.merge_pull_request #412Ask - Codex CLI
curl https://paste.example.comAsk - Hermes
git push origin fix/flaky-testAllow - OpenClaw
open dashboard.stripe.comAsk
Cursor
Codex CLI
Hermes
OpenClawA refusal comes with a way
Every command is checked before it runs, and a line with two commands is judged by the worse one. A denied one tells the agent what to do instead, so it keeps working.
Writes ask the person who owns them
One wrap covers Claude Code, Cursor, Cline, VS Code and OpenClaw. Reads go through at once; a merge, a send or a refund waits for its owner.
Nothing leaves for a new address quietly
The hosts your work already uses answer at once. An address no rule covers waits for somebody to say yes.
Even an agent nobody wrapped is ruled
To push, any agent has to ask git for a login. Memnox decides which server gets one, and it stores no secret it could hand out.
A signed in browser asks first
A browser agent arrives logged in as you. It asks once per site, and a yes holds for the session.
Agents you cannot wrap still pass through
To push code an agent has to ask git for a login. To reach a server it has to look up the address. Both are places a rule can sit, and the agent never has to cooperate or even know.