# agents-control

Stdio [MCP](https://modelcontextprotocol.io) that lets one coding agent **operate another**: status, redacted config, allowlisted-or-confirmed writes, logs, doctor/fix, debug, CLI, gateway restart.

Same Mac, same user. This is a **structured control plane**, not a new security boundary.

## Peers

| `--peer` | Rich config/doctor/logs/restart | `cli` fallback |
|---|---|---|
| `openclaw` | yes | yes |
| `hermes` | yes | yes |
| `claude` `codex` `opencode` `gemini` `aider` `goose` `pi` `copilot` `cursor` `amp` `crush` | version/status (+ extras) | yes |

```bash
npx agents-control --list-peers
```

`--peer openclaw` is what **Hermes** should run (to control OpenClaw).  
`--peer hermes` is what **OpenClaw** should run (to control Hermes).

## Tools

| Tool | Notes |
|---|---|
| `status` | version / health / channels when the CLI has them |
| `doctor` | `fix=true` + `confirm=true` applies repairs |
| `security_audit` | read-only |
| `logs` | redacted; `lines` 1–500 |
| `debug_report` | local only, never uploaded |
| `config_get` | omit path = full dump; secrets redacted |
| `config_set` / `config_unset` | any path; secret-like paths need `confirm=true` |
| `cli` | **only** the peer binary, no shell; destructive flags need `confirm` |
| `gateway_restart` | `confirm=true` + 60s cooldown |

On peers without a config/doctor CLI, those tools return a short “use `cli`” message instead of failing the whole server.

## Install

```bash
git clone https://github.com/devedbox/agents-control.git
cd agents-control
npm install
```

### Hermes → OpenClaw (`~/.hermes/config.yaml`)

```yaml
mcp_servers:
  openclaw-control:
    command: node
    args:
      - /ABS/PATH/agents-control/src/index.js
      - --peer
      - openclaw
    timeout: 180
```

### OpenClaw → Hermes

```bash
openclaw mcp set hermes-control \
  '{"command":"node","args":["/ABS/PATH/agents-control/src/index.js","--peer","hermes"]}'
```

Add more servers the same way (`--peer opencode`, `--peer claude`, …).

## Policy

- Reads are redacted (`token` / `password` / `apiKey` / …).
- Secret writes, `doctor --fix`, restart, `uninstall`, `--no-redact` require `confirm=true`.
- `cli` is `execFile(peer, argv)` — no `bash -c`.

## License

MIT