# Agent Autoloop: A Self-Hosted Hub That Lets Claude Code and Codex Work in the Background > Source: > Published: 2026-11-04 00:00:00+00:00 Agent Autoloop is a self-hosted hub that starts command-line coding agents from events and only interrupts you when a decision is needed. The GitHub project, [KKKKhazix/agent-autoloop](https://github.com/KKKKhazix/agent-autoloop?ref=explainx), showed about 2,300 stars, 462 forks and an MIT license when we read it on November 4, 2026. It was trending as a new AI repository, with the stars arriving since November 3. The pitch in its README is that agents should "take on work in the background and follow it through to the end." That sentence is our translation of the Chinese original, and the project documentation is mostly in Chinese. It sits in a growing group of tools that wrap [Claude Code](https://explainx.ai/blog/claude-code-desktop-parallel-sessions-sidebar-worktrees-nested-sessions-guide-2026) and Codex in a scheduler, an inbox and a permission layer, instead of leaving you to babysit a terminal. ## TL;DR: what you need to know | Question | Answer | |---|---| | What does it do? | Starts an agent from a cron job, a GitHub issue or an HTTP call, runs one round, and sends an approval card when it needs you | | Who is it for? | People who already use Claude Code or Codex and want recurring or event-driven work | | License | MIT | | Cost | Free hub. Agent runs use your own subscription or API usage | | Platforms | macOS and Linux. Windows is not supported yet | | Requirements | Node 24, Git, curl, and a logged-in agent CLI | | Agents tested by the author | Claude Code, Codex, and an ACP adapter | | Main risk | Unattended agents run with your local permissions, and rules decide how far they can go | Agents that act on your behalf need rules. [See how explainx helps secure your agents →](https://explainx.ai/agentbeam?src=blog_note) ## How does Agent Autoloop work? The README describes a five-step loop. An event arrives. A rules file at `~/.agent-autoloop/rules.json` decides which agent runs and in which directory. The agent finishes one round, writes its result into its final reply, and exits. If a risky action needs a human, the agent asks through a card. After you answer, the hub resumes the original session. The design choice that matters is the exit. The agent does not sit in a process waiting for you. According to the README, waiting costs no process and no tokens, because the session is simply resumed later. That is different from a long-running agent that holds a terminal open for hours. The README also states the core has zero external dependencies, which keeps the install small and the audit surface short. ### The commands you will use These come straight from the README: ``` curl -fsSL https://raw.githubusercontent.com/KKKKhazix/agent-autoloop/main/install.sh | sh agent-autoloop try agent-autoloop status agent-autoloop check agent-autoloop why 1 agent-autoloop answer 1 ``` `try` runs a demo. `status` shows the hub. `check` validates your rules file. `why 1` traces what happened in run 1. `answer 1 ` replies to card 1 with an option number from your terminal. Piping a script from the internet into `sh` is a trust decision. Open the script first, and run it on a machine or account you can afford to reset. ## What can trigger an agent? A box passing from one tray to another, picturing events handed to a background coding agent The README lists three kinds of events: scheduled cron jobs, new GitHub issues, and HTTP calls. It ships example recipes for a morning brief, GitHub issue follow-up, operations alerts, website monitoring and a pull-request delivery pipeline. Plugin templates let you add your own sources. The delivery pipeline is the most powerful and the most sensitive recipe. The README says it can review, merge and deploy pull requests. Its security page says delivery accepts only branches from the repository named in the rule into `main`, and that pull-request code, tests, configs and hooks are never checked out or run on the worker machine. Project settings, review requirements and review commands are read from `main`, not from the branch under review. That is a sensible boundary. It still means an agent can approve and ship code on your behalf, so test it on a throwaway repository first. ## Which agents and channels does it support? The author tested Claude Code, Codex and an Agent Client Protocol adapter. The [Agent Client Protocol](https://agentclientprotocol.com/?ref=explainx) is an open standard for connecting editors and tools to coding agents. The README also lists other CLIs, among them DeepSeek Harness, pi, OpenClaw, Hermes, Cursor and CodeBuddy, but says the authors have not run those one by one. Read that as "a command template exists," not "supported." For notifications, desktop alerts are the default. Feishu is the main chat channel. DingTalk, WeCom, Slack and Discord work through webhook templates, which the README says were tested only against a local mock service. In other words, the approval card works on your desktop first, and the chat integrations deserve your own testing. ## What are the security boundaries? A mechanical gripper handing a bead to a human hand, showing how Agent Autoloop asks for approval before risky actions The project publishes a [SECURITY.md](https://github.com/KKKKhazix/agent-autoloop/blob/main/SECURITY.md?ref=explainx). These are the points worth knowing before you run anything unattended. - **Rules decide everything.** Only`rules.json` chooses the assignee, the working directory, the skills and the permissions. Events cannot pick plugins, repositories, commands or permissions. - **The default permission is `edit`.** The page says granting` full` means thinking about everything the agent can reach, and that side-effecting actions should use`askFirst` . - **Prompt injection is not solved.** Titles and bodies written by other people, such as a GitHub issue, are placed in files labeled as data instead of in the prompt. The page says plainly that this does not block all prompt injection. - **Read access still reads secrets.** The page warns that a`read` permission does not stop an agent from reading secrets on the machine. It suggests a separate system account or a container. - **The hub listens on localhost.** For outside access, put an HTTPS reverse proxy in front. - **Approval links are bearer links.** Card links last seven days, and anyone holding one can answer that card. Do not post them publicly. - **Credentials stay with the agent CLI.** The hub launches your already logged-in tools and says it does not handle or store their credentials. Access keys are stored as SHA-256 hashes. - **Webhook authentication is not described.** The security page does not describe signature checks for incoming webhooks, so put your own authentication in front of any public endpoint. The same page lists known limits: crash-safety tests cover process kills and a finite set of scenarios, not a power-loss proof, and it is not a full security audit. ACP authorization depends on the agent honoring the protocol. We have tracked what goes wrong when agents get broad access. A [Railway engineer reported AI agents port-scanning and requesting secrets](https://explainx.ai/blog/railway-engineer-ai-agents-primcloud-port-scan-secrets-request-claimed-vs-verified-2026), and [GitBook disclosed an incident where attackers used AI agents and stolen API tokens](https://explainx.ai/blog/gitbook-security-incident-ai-agents-attacker-api-tokens-revoked-rotate-secrets-2026). Another case is [Postman Desktop auto-installing coding-agent plugins](https://explainx.ai/blog/postman-desktop-auto-installs-codex-claude-code-plugins-self-approved-hook-issue-14370-2026). An unattended hub is exactly the setting where such mistakes happen without anyone watching. ## What is still unverified? The README is unusually honest about its test coverage, and that is the most useful part for deciding whether to adopt it. - GitLab webhooks were tested against documented formats, not a real GitLab instance. - The Feishu recipe was tested with a fake CLI. - Slack, Discord, DingTalk and WeCom were tested against a local mock. - Text channels need `hub.publicUrl` set to an address your phone or computer can actually reach. - Windows has no support yet. The author promises a version after November 7 and 8. - The repository showed only a handful of open issues and pull requests at capture, so the issue tracker has little history yet. The star count tells you about interest, not reliability. A repository that gained thousands of stars in a day has not yet been through weeks of real use. ## How does it compare with other agent tools? Agent Autoloop is a trigger-and-approval layer. It does not manage branches, and it is not a sandbox. That puts it next to, not against, several tools we have covered: - [Worktrunk](https://explainx.ai/blog/worktrunk-git-worktree-cli-parallel-ai-agents-claude-code-2026) gives each parallel agent its own Git worktree. You could point an Autoloop rule at a worktree directory. - [Orca](https://explainx.ai/blog/orca-stablyai-open-source-agent-orchestrator-worktrees-mobile-guide-2026) is an orchestrator with a GUI and mobile view for many agents. - [Agentplane](https://explainx.ai/blog/agentplane-local-control-plane-claude-code-codex-cursor-side-by-side-2026) is a local control plane for running Claude Code, Codex and Cursor side by side. - [Octomind](https://explainx.ai/blog/octomind-open-source-rust-coding-agent-runtime-guardrails-toml-octobench-24-of-25-claimed-vs-verified-2026) is a Rust agent runtime with guardrails defined in TOML. If you want agents that run on a schedule and reply to issues, Autoloop is the closest to that job. If you want isolation, pair it with a container or a separate account, as its own security page suggests. ## How to try it safely 1. Read `install.sh` before running it. 2. Create a separate system account, or use a container, with no access to your personal secrets. 3. Run `agent-autoloop try` , then`agent-autoloop check` against a minimal`rules.json` . 4. Start with one cron rule that only reads and summarizes, such as the morning brief recipe. 5. Keep the permission at the default `edit` or lower, and use`askFirst` for anything that sends, merges, deploys or deletes. 6. Do not expose the hub to the internet until you have an HTTPS proxy with its own authentication. 7. Use API keys for frequent runs. The README says personal subscription quotas are a poor fit for high-frequency automation, and the project is not affiliated with Anthropic or OpenAI. For teams, a policy layer that watches what agents actually do is the next step. [AgentBeam](https://agentbeam.com/?ref=explainx) is the agent security platform from the explainx.ai team, built to stop AI agents before they take dangerous actions. ## What this means for what you build or pay For builders, the lesson is the architecture. One round per event, then exit, then resume after approval, avoids paying for idle waiting and makes each run easy to trace with `why`. You can copy that pattern even if you never install this repository. On cost, remember that each background run is a real agent session. A cron job that runs every ten minutes can drain a subscription quota. Set a schedule you can defend, and watch usage for the first week. On risk, treat every event source as untrusted input. A public GitHub issue is text written by a stranger that your agent will read. The project's own warning about prompt injection applies to every rule you write. ## What to watch next Three things will show whether this project lasts: a Windows build, real-world reports for the chat channels that are currently mock-tested, and a security review beyond the author's own page. Check the repository's issues and releases before you depend on it. ## Related reading *Details are accurate as of November 4, 2026. Star counts, issue counts and README claims come from the repository on that date and can change.*