Run a fleet of coding agents. Approve what ships.
o8 is an open-source control room for one person running several AI coding agents across their repositories, the governance layer above them. Claude Code, Codex, Grok Build, DeepSeek Harness, OpenCode, Gemini, and twelve more do the work in isolated git worktrees; o8 brings the work, the reviews, and the decisions into one place so you can direct the agents without following every terminal.
Download for macOS · Build from source
The download page identifies the current Mac installer. A universal DMG runs natively on Apple Silicon and Intel; an Intel-only DMG needs Rosetta on Apple Silicon.
macOS today. Linux compiles in CI, but nobody has yet installed it, launched it, and merged a packet on a mainstream distro. Windows is help wanted. Both are on the roadmap.
The aim is that you can hand out several pieces of work, look away, and come back to a readable account of what finished, what is blocked, and what needs your decision. The roadmap says how far along that is.
- You, or the orchestrator model you chose, create a mission. It becomes packets.
- Each packet runs on the runtime you picked, in its own git worktree, and reports as it goes. Workers never merge their own work.
- The work lands for review: the diff, the receipts, and the cost when the runtime reports it.
- You approve, reject, steer, or rerun. You can delegate the review to an orchestrator. By default its approved merges go through, and the approval setting can make every merge wait for you.
- The merge writes the audit trail and records the outcome. Project rules and recorded outcomes are what the Brain and the next packet retrieve. Learning from your rejections and steers is still an open arc.
A merge that fails climbs a five-step ladder that ends at a human card. The lifecycle gaps that remain are on the roadmap. The same verbs work from the app, the o8 CLI, any MCP client, your phone, and your voice. The long version is How o8 works.
| Orchestrate or work | Workers (dispatchable) |
|---|---|
| Claude Code · Codex · OpenCode 2 | Gemini · Cursor · Grok Build · Pi · GitHub Copilot CLI · Crush |
| Aider · Goose · Kimi Code · OpenHands · Qwen Code · Qoder | |
| 3code · Prime Agent · DeepSeek Harness |
o8 finds the coding-agent CLIs you already have installed and runs them behind one adapter contract. The table lists every runtime o8 can detect today, and a test keeps it equal to the registry. Readiness differs by CLI version and platform, so the first-run picker shows what is installed and working on your machine. Adding a runtime is a small documented patch: runtime adapter contract. Claude Code can also keep its tools and session behavior while another model supplies inference: model carriers.
Easiest: the latest signed build from Releases. It auto-updates.
From source needs Node 22.x (native modules are built against the Node 22 ABI), Rust stable, and Xcode Command Line Tools.
Install nvm before using the commands below. If Node 22.x is already installed another way, verify it with node --version and skip the two nvm commands.
git clone https://github.com/hurttlocker/o8.git
cd o8
nvm install && nvm use # .nvmrc pins Node 22
npm install
npm run dev # web loop: Next.js :47120 + WS :47125The source web loop does not install the global o8 command. Build the source CLI once, then use node cli/dist/o8.mjs wherever AGENTS.md shows o8:
npm run build:cli
node cli/dist/o8.mjs repo add /absolute/path/to/repo
node cli/dist/o8.mjs mission create --title "First packet" --body "Add one README line" --repo /absolute/path/to/repo --runtime codexUse the returned mission and packet IDs with mission dispatch, mission wait, packet diff, and packet review --approve --packet <id>. If review creates an operator card, finish it with inbox list and inbox approve <id>. The native app installs the global o8 command after it runs once.
Managed source builds register generated output before the compiler runs. The generated-output lifecycle describes preservation, recovery and journaled retirement.
npm run tauri:dev builds the native shell (a much longer first build). After a hard kill, node scripts/dev.mjs cleanup recovers the ports. Bring at least one agent CLI you already use (claude, codex, grok, opencode, gemini); no API keys are needed to start, and .env.example documents every optional one.
- Phone: pair by QR. The mobile web surface ships in this repo and works from any phone on your network; the iPhone app is below.
- Headless:
o8 serveruns the control plane on a machine with no screen, same gates. Pair a phone or attach the desktop later. - MCP: Settings → MCP → Install exposes the operator tools (
create_mission,submit_review,approve_and_merge,cortex_ask, and the webview controls) to Claude Desktop, Claude Code, or any MCP client.
The iPhone app is a remote control for the desktop: approve work, steer an agent, watch the fleet, and talk to Symon. It is in open beta on TestFlight. Install it, then pair it from the desktop: the phone button in the status bar opens a QR code, and the app scans it.
o8 runs on your machine against your own subscriptions and keys; it is not in the path between your agents and their providers. Worktree isolation covers repository changes: today workers run under your user account and can read what you can read. Telemetry, crash reports, and error transmission are off by default and opt-in. SECURITY.md covers what dispatched workers can reach and what the sandbox does and does not do today.
Usage analytics, crash reports, and error transmission remain off by default and opt-in. Each desktop update check sends a random device identifier, app version, target, chip architecture, macOS version (on macOS), and release channel to o8's update service, as described on the privacy page. The identifier is saved locally at first launch and is separate from sign-in and hosted-model identifiers. The ping is always on as part of checking for updates, independent of the usage-analytics toggle. It sends no code, paths, repository names, prompts, or account details. The service contract prohibits storing IP addresses or linking the identifier to an account. GitHub remains the fallback, and update signature verification stays the same.
The update service and active-install counts are tracked separately. This change implements the desktop client only.
Everything that runs on your machine is free and open source: the app, every runtime it detects, governance, memory, the Brain, mobile, and voice with your own keys. Pro is the optional managed edition for the things that run on our servers: higher daily managed-inference limits, early access to experimental features, and remote access to up to 10 Macs from a browser. Convenience, never capability. Pro · Lifetime is the one-time purchase that keeps its included benefits for life. The future monthly plan is called Pro: o8.run/pro.
Symon is the voice layer. Ask "what needs me?" without turning around, approve the one thing that is blocking, and dictate anywhere on the Mac. Anything with a side effect goes through a spoken confirm card, so voice never becomes a way around governance. Controls, setup, and tiers: Voice.
o8 is building toward an operating system for delegated work: models and agents can change while your project's rules, decisions, and history stay with you. The goal is to let you delegate more work without supervising every step, while keeping authority over what happens and evidence of the result. Coding is where we're proving that approach first.
ROADMAP.md: seven pillars, what is open, what is missing on each, and what to claim.
Start with CONTRIBUTING.md and the issues labeled claimable or help wanted. UI changes read docs/design first. The full documentation index is docs/README.md; the detailed agent and o8 CLI reference is AGENT_REFERENCE.md.
Community: Discord · Built in public by @marquisehurtt
MIT © Rainwater. The o8 name and logo are trademarks of Rainwater. Third-party code and adapted works are credited in NOTICE.md.