On-call for coding agents

Your agent hit a question.
Answer it from anywhere.

You are on the road and the agent is mid-task when it needs a decision only you can make. ony.ai calls your phone, reads out the ask, and you answer in one keypress. Risk classification keeps the calls rare: routine work never rings, and the actions you would never want on autopilot always do.

Start free, self-host Join the Cloud waitlist

/ony away for full remote control Self-host in minutes AGPL-3.0 open core

$curl -fsSL https://ony.ai/install.sh | sh

Works with

Claude CodeOpenAI CodexOpenCodeSignalWireTwilioTelnyx (beta)Plivo (beta)

Incoming call

Ony

risk: high

ony

This is Ony, match code 42.

ony

An agent is asking to run a database migration.

ony

Press 1 to approve. Press 2 to deny.

123

you pressed 1

ony

Approve recorded. Sending your decision now.

signed verdict delivered to agent

hmac verified

A real ony.ai approval call, start to finish.

keypress to decide

approve, deny, or pick an option

secrets read aloud

you hear the action, not the command

agents supported

Claude Code, Codex, and OpenCode

AGPL

open core

self-host the whole stack, free

The shift

Agents run for hours. Questions can't wait for you.

Coding agents work in parallel, overnight, and headless. Then one hits a decision it cannot settle alone: which environment, apply the migration or hold it, is this deploy really intended. It sits blocked until you get back, or it guesses.

ony.ai closes that gap: the agent asks, your phone rings, you answer from wherever you are. Risk classification keeps autonomy the default and the calls rare.

How it works

One loop, from tool call to signed verdict.

The whole product is this loop. Low-risk work never leaves the fast path; everything else comes to your keypad and returns as a verdict your device can verify.

Your agent needs you

A PreToolUse hook watches every tool call. Reads and safe edits pass instantly. A question the agent cannot settle, a deploy, a destructive command, or a secret access becomes a handoff.

ony.ai calls your phone

The server re-derives the real risk (the agent's own hint is never trusted) and places a call. You hear the question and its risk, never the raw command or your secrets.

You answer, the agent continues

Press 1 to approve or 2 to deny. When the agent asks a real multiple-choice question, the call reads out the options and you pick one on keys 1 through 7. High-risk actions add a spoken read-back confirmation. The verdict is signed, verified on your device, and delivered back in seconds.

Set the mode per session:/ony ongates high-risk steps,/ony awaycalls you for every step,/ony offsteps aside.

In your terminal

A familiar permission prompt, delivered to your phone.

Your agent pauses on the risky step exactly like a normal approval prompt. The difference is that the approval reaches you wherever you are.

One hook install, no agent fork or patched binary.
Decisions delivered as a signed, per-call verdict the hook polls for, or a headless session resume, never keystroke injection.
Works headless, in CI, and across parallel sessions.

claude-code, prod-api

# agent is ready to run:
$ git push --force origin main

[ony] high-risk action detected: force-push (high)
[ony] match code 42, calling +1 (***) ***-4821 ...
[ony] waiting for your decision _

[ony] approved by you, signature verified
+ 3f8a1c0...9d2e0b1 main -> main (forced update)

The dashboard

Every decision, on the record.

Live handoffs, the devices that can approve them, and a tamper-evident audit trail. Self-hosted or on ony.ai Cloud, it's the same dashboard.

app.ony.ai/handoffs

audit verified

Handoffs

Approvals routed to your phone

live

Pending

Decided today

Audit chain

Force-push to mainmatch 42

prod-api · now

high

Drop table payments

billing · 2m

criticalDenied

Run DB migration

web · 14m

highApproved

Rotate API secret

infra · 1h

mediumApproved

Edit README.md

docs · 1h

lowAuto-allowed

Hash-chained, append-only audit log chain verified

What it gates

The actions you'd never want on autopilot.

Reads, searches, and ordinary edits run ungated. Anything that ships, deletes, or touches production is classified server-side and routed to you.

terraform apply

Production deploy

git push --force origin main

Force-push

rm -rf ...

Destructive command

alembic upgrade head

Database migration

kubectl apply -f prod/

Infra change

DROP TABLE ...

Prod DB change

read .env / rotate secret

Secret access

stripe / payment settings

Payment change

How it compares

Three ways to run an agent. One keeps both.

Staying at the keyboard keeps judgment and loses autonomy. Blanket auto-approve keeps autonomy and loses judgment. This table is the honest version of that trade.

Swipe the table sideways.

	Stay at the keyboard	Blanket auto-approve	With ony.ai
You can leave the desk	No, the agent stalls at every prompt	Yes	Yes, the call finds you
Risky actions get a human decision	Yes, while you are watching	No	Yes, by phone, every time
Safe work runs at full speed	Yes	Yes	Yes, reads and edits are never gated
Works overnight and headless	No	Yes	Yes
Worst case when nobody answers	Agent waits indefinitely	The action already ran	Fails closed, nothing runs
Record of who approved what	Terminal scrollback	None	Signed, hash-chained audit log

Built for real workflows

Enough control to trust autonomy.

The kill switch, the audit trail, and the ergonomics that make running agents unattended practical.

Three modes, per session

/ony on gates only high-risk steps. /ony away calls you for every actionable step (remote control). /ony off steps out of the way.

Many agents at once

Run Claude Code and Codex in parallel across repos. Each handoff binds to a stable agent session, so approvals never cross wires.

Multiple devices

Enroll more than one phone. Decisions are attributed to whoever approved, and every device verifies signatures independently.

Fast by default

Safe tool calls are never delayed. Only gated actions wait, and only until you press a key. Timeouts fail closed, never silently open.

Signed end to end

Every verdict is HMAC-signed per device and bound to the exact request. Forged or replayed approvals are rejected by the connector.

Tamper-evident audit

Every decision lands in a keyed, hash-chained, append-only log. Rewrite one event and the chain breaks. The dashboard shows it verified.

Built in the open

Read the code. Audit the claims.

A kill switch you cannot inspect is a promise, not a guarantee. The whole ony.ai core is public under AGPL-3.0: the risk taxonomy, the signing scheme, the audit chain. Self-host every part of it, or hold the hosted product to the same source.

Self-host guide Read the trust model

Server-authoritative risk: the agent's own hint is discarded, and unknown actions fail closed to critical.
HMAC-signed verdicts, bound to the exact request and verified on your device before anything runs.
A keyed, hash-chained, append-only audit log. Rewrite one event and the chain breaks in plain view.
Fail-closed defaults: no reachable server, no verified signature, no deadline met means no action.

Open core

Run it yourself, or let us run it.

Same product, two ways to get it. The open-source edition is fully featured. ony.ai Cloud just removes the ops.

Open source

AGPL-3.0

Self-host the whole stack. Own your data and your phone line.

Every feature included, no paywalled core
pip install ony plus a one-command Docker stack
Bring your own telephony and keys
Runs entirely on your infrastructure

View on GitHub Self-host guide

ony.ai Cloud

Hosted

The managed path. Zero ops, dedicated numbers, ready in minutes.

Fully managed, no servers to run or patch
Dedicated phone numbers per organization
Team seats, roles, and on-call escalation
Multi-tenant isolation and managed key storage

Join the Cloud waitlist See pricing

FAQ

Frequently asked questions

Does ony.ai slow my agent down?

No. Only gated actions wait, and only until you respond. Reads, searches, and ordinary edits run at full speed, ungated.

Can the agent bypass the gate?

No. The agent's own risk hint is ignored. Risk is classified server-side, and the verdict is signed and verified on your device. Unknown actions fail closed.

What does ony.ai hear and store?

The call carries only the server-derived action type and risk, never your raw commands, file contents, or secrets. Call audio and transcripts are not stored. What is stored: handoff metadata, decisions, and the tamper-evident audit chain. Any payload an agent attaches is visible only in the authenticated dashboard and is scrubbed on a retention schedule. Self-host and none of it ever reaches us.

What is the match code?

Every handoff gets a short code shown in your terminal and dashboard, and the call reads the same code out loud. If the code on the phone matches the code on your screen, you know the call you answered is the ask you expected, not a spoofed one.

What if I miss the call?

Nothing is silently allowed. The handoff stays pending and fails closed on its deadline. You can also configure fallback channels: an SMS you reply to or a Telegram message with buttons, and every pending decision can be decided from the dashboard too.

Can someone else take the call?

Yes. On-call escalation rings an org backup number when the primary does not answer, self-hosted or hosted, and every decision is attributed to the device and person who made it.

Which agents are supported?

Claude Code via a PreToolUse hook, OpenAI Codex as a deny-only guardrail in beta over its app-server, and OpenCode over its native permission API. The event model is agent-agnostic, so adding a connector means mapping its events, not rewriting the core.

Open source or hosted?

Both. The open-source edition is fully featured and self-hostable under AGPL-3.0. ony.ai Cloud is the same product, managed, with dedicated numbers and team features. The Cloud is a waitlist today.

How does the phone call actually happen?

Through your choice of carrier: SignalWire, Twilio, Telnyx, or Plivo (SignalWire is the most battle-tested path today). Self-host with your own number and keys, or let ony.ai Cloud manage the line.

What does it cost?

Self-hosting is free under AGPL-3.0, with every feature included. The hosted plans are per seat with a pool of approval calls included, and on any paid plan you can bring your own carrier and pay telephony at cost.

Get started

Give your agents autonomy.
Keep the kill switch.

Install the connector, wire your agent, and get your first call in minutes.