Foreman is a local-first, open-source guardian for your AI agents. It mediates every MCP call your agents make, scores each request for risk, and asks for your approval in the terminal before anything dangerous happens.

Does Foreman send data to the cloud?

No. Foreman runs entirely on your machine and stores its audit log locally on your disk. Nothing leaves your machine.

Which platforms does Foreman support?

macOS, Linux, and Windows via WSL2.

Yes. Foreman is open source under the MIT license and free to use.

Which AI agents does Foreman work with?

Any MCP client, including Claude Code and Codex. Because Foreman speaks the Model Context Protocol, it works with the agents, LLM providers, and services you already run.

How is Foreman different from LangSmith or Helicone?

Those are cloud tracing dashboards that show what already happened. Foreman runs locally and acts as a gatekeeper that can stop a risky call before it executes, and it mediates agent-to-agent traffic.

Foreman — A guardian for your local AI agents

What it does

Four jobs. One foreman.

Every tool call your agents make passes through Foreman. Here's the loop it runs, hundreds of times a day, so you don't have to.

01

Mediate

Every MCP call between your agents and their tools flows through Foreman first.

02

Score

Heuristic rules flag secret files, outbound network, shell exec, and cross-agent calls.

03

Ask

Past a threshold, you decide right in the terminal: allow, deny, or remember.

04

Log

Every request lands in a local SQLite store with FTS5 full-text search, on your disk.

See it in action

From one message to shipped — and guarded.

You message hermes, your project-manager agent on Telegram. It scopes the work, opens a GitHub issue, and hands it to codex, the coder. codex writes the code and tests; hermes reviews and approves the diff. The agents run the whole loop on their own.

→hermes turns your Telegram instruction into a GitHub issue and tasks codex with the implementation.
→codex writes the middleware and tests; hermes reviews the diff and approves it for release.
⚠Before it ships, Foreman gates the production deploy — you approve, it goes live, and every step is logged to your local audit trail.

A live, looping simulation of how the agents actually work.

Foreman · agent channel2 agents · mediated

you · via Telegram

Add rate-limiting to the login API and ship it.

hermes · project manager

On it — opening GitHub issue #142 and scoping the work for codex.

hermes · project manager

codex: add 5 req/min per IP on POST /login, with tests. Branch feat/login-ratelimit.

codex · coder

Done — wrote the middleware and tests, all green. Requesting deploy.

hermes · project manager

Reviewed the diff — clean and covered. Approved for release.

FOREMAN · APPROVAL REQUIREDrisk 65/100

agentcodex (coder)

tooldeploy.production

args{ target: "production", branch: "feat/login-ratelimit" }

▸ writes to production environment +40

▸ uses deploy secret PROD_DEPLOY_KEY +25

[a]llow[d]eny[r]emember[i]nspect

Allowed · shipped to production · logged #5012

Every agent-to-agent call passes through Foreman first.

The moment that matters

A phishing email just told your assistant to leak your .env.

Foreman sees the request before it leaves your machine, scores it 80/100, and stops everything to ask you. One keypress and it's dead.

Two approval treatments — pick the density you'd ship.

APPROVAL REQUIREDrisk 80/100

agenthermes (telegram assistant)

toolfilesystem.read_file

args{ path: "~/.env" }

▸ secret file pattern .env +50

▸ triggered by inbound message (possible injection) +30

sessions_91a2 · turn 3

[a]llow[d]eny[r]emember[i]nspect⏱ 52s

How it's different

Not a dashboard. A bouncer.

Tracing tools tell you what happened. Foreman decides what's allowed to happen — locally, before the call lands.

	Foreman	LangSmith / Helicone	Vanilla MCP
Runs on your machine	✓ local-first	cloud SaaS	✓ local
Mediates agent-to-agent	✓	tracing only	direct, no mediator
Asks before risky calls	✓ in terminal	post-hoc dashboard	no approval layer
Audit log under your control	✓ SQLite + FTS5	their cloud	no audit
Identity per agent	✓ Ed25519	n/a	n/a
Open source	✓ MIT	proprietary	spec

Works with your stack

Wire it up in one line.

Foreman speaks MCP, so it sits in front of the agents, models, and services you already run.

Agents

Claude CodeCodexHermesOpenClawZeroClawGeneric MCP

LLM providers

AnthropicOpenAIGoogle GeminiOllamaOpenAI-compatible

Services

TelegramDiscordSlackGitHubJira / ConfluenceNotion

Put a foreman on the job.

One command. No account. Nothing leaves your machine.

$curl -fsSL https://raw.githubusercontent.com/tuzlu07x/foreman/main/install.sh | bash

Get started in 5 minutes View on GitHub