Your agentproposes.Your phonedecides.

Leash puts a checkpoint for AI coding agents in your pocket. When an agent tries something risky, your phone buzzes, explains why in plain language, and waits for your answer.

Star us on GitHub See how it works

agent session

Leashconnected

Pick a scene, then tap Deny or Approve on the phone. Simulated demo: no real commands run.

of developers distrust the accuracy of AI tools. Only 33% trust it.

Source: Stack Overflow Developer Survey 2025

A day with Leash

Start

Run your agent through Leash and set what the task may touch.

Work

Safe actions pass in silence. Risky ones buzz your phone.

Commit

Secrets, hidden text and workflow files are checked first.

Finish

A receipt goes into your pull request. Rewind is one tap away.

🎮 How to Use Leash Before Coding to Get Alerts

Follow this step-by-step developer workflow to ensure your workstation is protected and your phone receives real-time approval alerts before your AI coding agent touches the terminal or files.

STEP 1 · LAPTOP CONTROL PLANE

Launch the Laptop Daemon

Open a terminal on your development workstation and start the background Leash daemon:

python -m daemon.cli server --port 8765

What happens:

The daemon launches the local control plane and opens the Leash Security Portal at http://localhost:8765.
A 6-digit single-use pairing PIN and cryptographic QR code appear on screen.

terminal: daemon server

$ python -m daemon.cli server --port 8765

● [DAEMON] Listening on http://127.0.0.1:8765

● [PORTAL] Leash Security Portal ready at http://localhost:8765

● [PAIRING] Single-use PIN generated: 482913

Awaiting mobile handshake over /ws/link...

Daemon running on port 8765 · Ready to pair

Connection Mode:

Forward Daemon Port via ADB

Plug in your Android phone with USB debugging enabled for instant zero-latency link:

adb reverse tcp:8765 tcp:8765

ACTIVE 6-DIGIT PAIRING PIN FROM LAPTOP SCREEN:

482913

Type 6-digit code from laptop screen:

Protect Agent:

Prefix Agent Launch with `daemon.cli run --`

Before letting an autonomous agent execute tasks, prefix the launch command to attach the Leash guard:

python -m daemon.cli run -- claude

What happens under the hood:

Isolated Git Worktree Creates leash/<session-id> so uncommitted host changes remain safe.

Secure PATH Shims Injects shims for bash, sh, git, curl, npm, pip.

Restricted Token Master HMAC pairing secret never leaves the daemon.

terminal: leash run

$ python -m daemon.cli run -- claude

leash: created isolated git worktree: .leash/worktrees/sess-9f82d1c4

leash: injected secure PATH shims for bash, sh, git, curl, npm, pip

leash: issued restricted session token [sess_tk_a7b4]

claude code ready. Workstation guarded.

🧠 ON-DEVICE GEMMA-2B AI GUARD

Code Naturally While Leash Guards in Real Time

Safe Commands (Auto-Allowed):
Commands like cat file.py, ls -la, git status, or npm test execute at native speed without interruption.

High-Risk & Critical Actions (Intercepted & Paused):
The moment the agent attempts dangerous actions:

🛑 Agent process instantly freezes on your laptop.
📳 Phone immediately wakes up & vibrates with distinct haptic pulse.
🧠 On-Device Gemma-2B AI analyzes the exact command and displays plain English risk summary.
⏳ 30-Second Fail-Closed Countdown begins on mobile screen.

terminal: process monitor

$ cat src/utils.py > Auto-allowed (native speed)

$ git status > Auto-allowed (clean working tree)

⚠ [INTERCEPT] Agent attempted: npm install evil-preinstall-pkg

🛑 [FREEZE] Process PID 4108 paused. Waiting for phone signature...

🧠 Gemma-2B Local AI Analysis

HIGH RISK INTERCEPT 30s Fail-Closed

npm install evil-preinstall-pkg

"Package executes arbitrary preinstall script upon installation, creating supply-chain compromise risk."

📱 THREE SIMPLE CHOICES ON YOUR PHONE

Authorize or Block from Your Phone

You have full control with cryptographic verification. Choose an action to simulate the real-time response:

1. Slide to Approve Phone transmits HMAC-SHA256 signed ALLOW. Laptop unpauses agent in isolated worktree.

2. Tap Deny Phone transmits signed DENY. Laptop halts execution (exit code 126) with structured feedback.

3. Walk Away / Ignore If 30s timer expires without approval, Leash enforces Fail-Closed default (blocked automatically).

decision execution stream

Simulate one of the 3 choices on the left to see the result...

Awaiting decision

📝 TAMPER-EVIDENT ZERO-TRUST PR RECEIPTS

Review & Export Zero-Trust PR Receipts

When your agent finishes its task, inspect the session audit trail or copy the tamper-evident PR receipt into GitHub:

python -m daemon.cli audit --tail 10

python -m daemon.cli report

### 🛡️ Leash Security Audit Receipt **Session**: `leash-sess-9f82d1c4` | **Agent**: `Claude Code` **Worktree**: `.leash/worktrees/sess-9f82d1c4` **HMAC Signature**: `SHA256:7f3a...c891` (Verified via Phone) | Timestamp | Action | Risk Level | Human Decision | |---|---|---|---| | `02:14:02` | `git status` | Low | Auto-allowed | | `02:14:18` | `cat package.json` | Low | Auto-allowed | | `02:15:01` | `npm install evil-pkg` | **Critical** | **DENIED** (Phone Tap) | | `02:15:33` | `npm test` | Low | Auto-allowed | **Policy Result**: `Zero unauthorized mutations · 100% Fail-Closed Enforced`

What it catches before it runs

A plain reason, every time

Each risky command becomes one sentence you can act on, not a wall of shell.

It remembers where an action came from

If the agent just read untrusted text, the next risky action is rated higher and shows the source line.

Secrets stay fenced

Reads of .env files, ssh keys and cloud credentials are blocked. Canary files raise an alarm if touched.

Packages are checked first

Look-alike names, brand-new versions and install scripts show up before anything installs.

One tap to rewind

Leash snapshots your repo before a risky approved action. Roll it back from your phone.

A receipt for your pull request

Every command, approval and block, written as Markdown.

It fails closed

If your phone cannot be reached, dangerous actions are denied.

What Leash is not

Leash is a checkpoint at the shell, not a sandbox. A determined attacker needs OS-level isolation too. We test bypass tricks against it and say what gets through.

On the roadmap

Egress allow-list
Policy file and learning mode
Agent-spawn guard
Pairing with an OS sandbox

Put your agent on a leash.

Star us on GitHub