Fire the mission. Come back to done.
Fire work at an agent under an envelope you wrote. Detach. It interrupts you only when the envelope says so. Or run it headless over a task list, one line at a time, each item in a clean context.
Installs contenox. Run contenox init to scaffold a workspace.
The mission, live
Thirty seconds, end to end.
One command fires a declared agent at a task, bounded by a policy you wrote. What happens after you walk away is the point.
No babysitting a terminal, no timed-out approvals, no silent changes. The envelope decided what could run unattended, the chain decided where a human gets the final word, and one answer resumed the run exactly once.
The part you can’t download
You’ve already used this engine. You’ve just never held the controls.
When an assistant shows you its "thinking steps," you’re watching an orchestration loop: plan, call a tool, check the result, check the budget, decide again. Every major AI product runs on one — event-driven agent choreography under governance. That layer decides what the model may do, when it pauses, and what it costs. The vendor configures it. You never see it, and you can’t change it.
Contenox is that layer, shipped as the product — with the control panel handed to the operator. The loop is a chain file you author. The boundaries are an envelope you wrote. The state is on your disk. The differentiator isn’t inventing the machine; it’s who holds the controls.
You write the rules
How much agency? You decide — in writing.
Every run is bounded by an envelope: a JSON policy naming what passes silently, what pauses for a human, and what is denied outright — plus hard ceilings on tool calls and tokens, and a pin on which models and backends the unit may use. No hidden prompt decides for you. The file lives in your repo and gets reviewed like any other change.
{
"default_action": "approve",
"compute": { "maxToolCalls": 300, "maxTokens": 2000000, "onExhausted": "finish_stuck" },
"rules": [
{ "tools": "local_fs", "tool": "*", "action": "deny",
"when": [{ "key": "path", "op": "glob",
"value": "**/{.ssh,.aws,.kube,.config/gcloud}/**" }] },
{ "tools": "local_fs", "tool": "read_file", "action": "allow" },
{ "tools": "local_fs", "tool": "write_file", "action": "approve" },
{ "tools": "local_shell", "tool": "local_shell", "action": "allow",
"when": [{ "key": "command", "op": "command_prefix_allowlist",
"value": "go test,go vet,ls,cat,grep,npm test,pytest" }] },
{ "tools": "local_shell", "tool": "local_shell", "action": "approve" }
],
"attention": { "allowAgentAnswers": false }
} Trimmed from the shipped default preset. Anything no rule matches fails closed — it asks a human. Six presets ship with contenox init, and contenox vet checks your policy before anything runs under it.
Agentic engineering
Vibecoding finds the loop. Loop engineering keeps it.
Vibecoding is real discovery — improvising with an agent until the loop works. We’ve shipped features that way and written honestly about what it cost. But a loop that has to run tomorrow, in CI, unattended, isn’t a vibe anymore. It’s an artifact.
That’s agentic engineering: the loop itself is authored, reviewed, versioned, and bounded. The staged loop in every contenox chain came from named failure modes — classify, inspect, patch, verify, audit — under one discipline: never let confusion default into unattended mutation.
One harness, everywhere
Author once. Run it where the work is.
The same agentic workflow, the same envelope, the same session state behind every surface — what you approved in the editor is what runs from cron.
Your terminal
contenox new is one persistent session for chat, plan, and shell. Stateful tools keep their state across turns, and an approval is a one-keypress card in the transcript.
Your editor
The full agent inside Zed, JetBrains, AionUi, or OpenClaw — approvals route through the editor’s own UI, and the workflow stays in the chain file, not the plugin.
Your scripts and pipelines
contenox run executes a chain non-interactively — from cron, CI, or a shell script. Tool-heavy jobs are the home ground: release evidence packs, request-processing chains, narrow API wrappers with approval on every mutating call.
Untrusted drivers
A headless acpx session gets the hardened profile: shell, writes, and network are denied outright rather than offered for approval.
- → Editors talk to the full agent over stdio — no plugin lock-in. Agent Client Protocol
- → Any MCP server — stdio, SSE, or HTTP — registers once; its tools become policy-scoped chain tools. Model Context Protocol
- → Any HTTP service with a spec becomes a callable, allowlistable tool. OpenAPI tools guide
The same seat, contested
Copilot helps you type. Contenox does the shift while you’re gone.
The AI that does work for you at work is one seat, and there are two ways to fill it. The vendor’s agent runs on your work: behavior decided in Redmond, rules you can’t read, tenant-admin-controlled, your usage flowing into their telemetry.
Contenox is the other way to fill it: your agent under your envelope — rules you wrote, state on your disk, models you chose. Not two categories. One category, contested from opposite ends.
Yours by default
Your machine, your state, your models.
- →Sessions, config, run logs, and captured execution state live in SQLite on your machine. No hosted service, no account — telemetry is opt-in and off by default.
- →Inference is configuration: local Ollama or vLLM when nothing may leave your network, or OpenAI, Anthropic, Gemini, Bedrock, and Vertex on your own keys, pinned to a region you choose. Swapping later is a config change, not a rewrite.
- →Secrets resolve from your environment at request time and never land in config on disk; agent-reachable shells get a scrubbed environment with only what the task needs.
Also in the box
It reads Go like the compiler
Definition, references, implementations, symbols, diagnostics — answered in-process by the real type-checker, warm in microseconds. No language server to install or babysit.
Ask the repo, get cited lines
contenox index builds a hybrid full-text and embedding index in local SQLite; contenox search answers with file:line citations and marks a hit stale the moment its file changes.
Get started
Fire your first mission.
Questions? hello@contenox.com · Issues and PRs on GitHub
Built on
Local models connect through Ollama or vLLM over their local APIs; hosted providers over their public APIs. No bundled inference runtime, no GPU drivers to ship.
