Claude asks before starting too many sub-agents.
AgentGuard is free on one machine. No account or key.
Measured testOur Claude Code run, Sep 23, 2026
15sub-agents launched in 36.6 seconds.
Recorded before AgentGuard asked first, so it shows launch speed, not today's prompt.
Install on the computer where you use Claude Code or Codex.
Run the commands in your computer's terminal, then start a new session.
At the limit, interactive Claude Code waits for your yes. Where no prompt can appear, including Codex, the launch is refused.
Install on your computer
Pick Claude Code or Codex. Run the commands one at a time in your terminal.
AgentGuard installs on your computer. Send yourself the link and open it where you use Claude Code or Codex.
claude plugin marketplace add agentguard-run/agentguard-codex-pluginclaude plugin install agentguard@agentguard
That is the whole install: Claude Code installs the plugin's dependencies by itself. Then start a new session.
Claude Code may warn that one option is not set. That option is the license key for paid plans. Free needs no key, so skip it. To check the install, run claude plugin list: agentguard@agentguard shows as enabled.
Accept Claude Code's usual install and folder trust prompts. Its read-only /hooks menu shows the plugin's hooks.
codex plugin marketplace add agentguard-run/agentguard-codex-plugincodex plugin add agentguard@agentguardcd ~/.codex/plugins/cache/agentguard/agentguard/*/ && npm ci
Codex doesn't install the plugin's dependencies. The third command runs npm ci in the plugin's version folder under ~/.codex/plugins/cache/agentguard/agentguard/. Then start a session and trust the plugin's hooks in /hooks.
Read the hook commands before you trust them. For Codex 0.154, this marketplace installs a compatible copy of the plugin.
In Codex and ChatGPT, AgentGuard runs on your computer in the Codex CLI and in local tasks in the ChatGPT desktop app. It does not run in Cloud Work, on the web or mobile, in Codex cloud or in the Codex IDE extension.
Use Node.js 22 on macOS or Linux. Windows is not verified. Setup help · Installation details
What happens at the limit
In interactive Claude Code, the 16th sub-agent Claude tries to start within 15 minutes of work waits for your yes in Claude Code's own prompt, which the agent cannot answer. In print mode, with bypass permissions, and in Codex, that launch is refused.
Completed decisions are signed and kept on your computer. An error or timeout can let a call through without a record.
AgentGuard checks the tool calls Claude Code and Codex send through their hooks against your rules: which tools the agent may use and at what level (read, write or payment), which tools it must never touch, and how much it may spend per project or per agent. A record stores names, fingerprints and sizes, never what a tool read or wrote.
The docs explain policy files and how to verify a record. A recent record and its public key are on the security page.
What it covers and what it does not
AgentGuard sees the tool calls Claude Code and Codex pass to their hooks, including MCP tools. In Claude Code, WebSearch and WebFetch are covered. In Codex and ChatGPT desktop local tasks, tools that run on OpenAI's side, such as WebSearch, are not. In Codex, typing more into a shell you already approved is not checked again, and some special tools can skip the check.
If AgentGuard hits an error or runs out of time, it lets the call through and warns you when it can. Hooks that are turned off or not trusted check nothing. AgentGuard adds a check on your computer; the service that holds your documents or payments still decides who can reach them.
Runtime and durability details · Enterprise installation guide · Public repository
See it work
What comes with it
What you see in Claude Code
In Claude Code 2.1.287 and later, AgentGuard Live puts a band above the prompt with sub-agents, tokens and plan use. Each sub-agent launch gets a stamp under it. An /agentguard pane lists the signed decisions. After the token figure, the band counts down to Claude Code's auto-compaction point: 28% to auto-compact, yellow at 30% of context left, red at 10%. Past the token limit it reads tokens 24B, past the 5B limit: sub-agents wait for your yes.
Burn comes with it
In one long Claude Code session of ours, on Oct 3, 2026, 10 of 154 sub-agents ended without finishing yet still used 194.7 million tokens.
Need more than one machine?
AgentGuard is free on one machine. You pay when you need it on more than one.
- Free
- One machine. Full enforcement, local signed receipts and Burn. No account or key.
- Solo
- $19 per month or $190 per year. A license key for up to three machines, with the policy synced across them, the dashboard and receipts export.
- Team
- $19.90 per seat per month or $199 per seat per year. Starts at three seats.
To add a key, ask the agentguard-policy skill to activate license <KEY>.
Setup help
Claude Code and Codex
If AgentGuard ever says its dependencies are missing, run npm ci in the folder it names, then start a new session.
Use Node.js 22 on macOS or Linux.
Codex and ChatGPT
In Codex and ChatGPT, AgentGuard runs on your computer in the Codex CLI and in local tasks in the ChatGPT desktop app. It does not run in Cloud Work, on the web or mobile, in Codex cloud or in the Codex IDE extension.
If you set $CODEX_HOME, the plugin folder is under it instead of ~/.codex.