Product
From tool call to phone call, automatically.
Ony.ai sits between your coding agent and the decisions it cannot make alone. It detects the moment, re-derives the real risk on the server, calls your phone, and delivers a signed verdict back to the agent. No terminal scraping, no keystroke injection.
End to end
Every step, accounted for.
Six automatic stages. The trust boundary stays on the server and your device the whole way through. You show up only for the decision.
Detect
The permission gate fires exactly when Claude itself would stop and ask. Reads and ordinary edits pass straight through. A deploy, a force-push, a schema change, or a secret access gets held for classification.
Classify
The server re-derives the real risk from its own action taxonomy. The agent's own hint is never trusted. Anything the taxonomy does not recognize fails closed to critical.
Call
Ony.ai places a real phone call through your carrier and reads the match code first. You hear the action and its risk, never the raw command or your secrets.
Decide
Press 1 to approve, 2 to deny. High and medium-risk actions add a spoken read-back confirmation. Critical actions cannot be approved by voice at all; they need the authenticated dashboard.
Sign
The verdict is HMAC-signed per device and bound to the exact request. The local connector verifies the signature before honoring it. Forged or replayed approvals are rejected.
Deliver and audit
The decision reaches the agent as a signed verdict the blocking hook is polling for, or a headless session resume, never keystroke injection, and lands in a keyed, hash-chained, append-only log the dashboard can verify.
Integrations
Wired into the agents you already run.
Real event surfaces, not a wrapper. Ony.ai binds to the hook and app-server interfaces the agents already expose, then normalizes every event into one model.
Claude Code
hooks + pause-resume delivery
- Interactive sessions gate via Claude Code's
PermissionRequesthook, firing exactly when Claude itself would ask. - The full
PreToolUsepre-execution gate is a headless opt-in. -
Notification(permission_prompt / idle_prompt) flags a blockage. -
StopandSubagentStoptrack lifecycle. - Delivery by a signed verdict the hook polls for, or
claude -p --resume.
# stdin to: ony hooks claude
{
"hook_event_name": "PermissionRequest",
"tool_name": "Bash",
"tool_input": { "command": "git push --force origin main" }
}
[ony] gated: force-push (high)
[ony] decision pending, calling you _OpenAI Codex
app-server bridge, deny-only beta
- Connects to the Codex app-server, not a forked binary.
- Newline-delimited (ndjson) JSON-RPC, not Content-Length framing.
- A phone denial blocks the tool with a signed, verified verdict.
- Same risk taxonomy, same audit chain as every agent.
- Today Codex is a deny-only guardrail in beta: a phone denial blocks the tool, and an approval stands aside for Codex's own approval flow. A bidirectional app-server bridge is available as experimental.
# request from the app-server
{"method":"item/commandExecution/requestApproval",
"params":{"command":"rm -rf build"}}
# signed response from ony
{"result":{"decision":"denied",
"sig":"hmac:4c1f8a6e..."}}
[ony] signature verified, tool blockedOpenCode
native permission API, no hook files
Attaches to your running opencode serve over its native permission API, with no hook files to install. Each permission.askedis answered by phone, allow once, never a standing grant.
Control
Three modes, set per session.
The /ony command is a Claude Code skill. Type it in the session to change how much Ony.ai gates, right now, without restarting the agent.
/ony onThe default. Safe tool calls run ungated at full speed. Only high-risk, irreversible actions ring your phone.
/ony awayCall me for every actionable step. Drive the agent from your keypad while you are away from the terminal.
/ony offHand control back to the agent's normal approval flow. Ony.ai stays out of the way until you turn it on again.
/ony herepoint decisions at this device,/ony statusshow the current mode and bound session.Decision delivery
Pause then resume, never keystroke injection.
Claude Code has no official mid-turn input channel, so Ony.ai does not pretend one exists. A decision becomes the next turn, two ways.
Per-call signed verdict
The gating hook holds the permission ask open and polls the server for your decision. Each verdict is signed and bound to that exact handoff, session, tool, and expiry, so an approval never carries over to a different command.
Resume as a new turn
For headless flows, claude -p --resume SESSION_IDstarts a fresh turn with the decision as the next prompt. It is an ordinary continuation, not a hijacked terminal, so it works in CI and across parallel sessions.
Never the terminal, never the PTY.
Ony.ai does not scrape terminal output or inject PTY keystrokes. Handoffs bind to the stable agent_session_id, not the per-resume session id, so a decision always lands on the work it was made for, even after a resume.
Dashboard
See every decision, prove every one.
A single console for the devices that approve, the decisions they made, and the tamper-evident record that proves nothing was rewritten after the fact.
Devices
Enroll a phone with a decision_key, see what is active, and revoke instantly. Each device verifies signatures independently.
Decisions
Full history with approver attribution. See which device approved, when, and against which exact request.
Audit
One-click hash-chain verification. Rewrite a single event and the chain breaks, end to end, in plain view.
Enrollment
A decision_key binds a phone to your org. Per-device HMAC keys never leave the trust boundary.
Audit chain
prod-api, last 4 decisions
git push --force origin main
approved, read-back confirmed
9f3c…a1terraform destroy
denied
2b7e…c4DROP TABLE sessions
denied
5d10…7falembic upgrade head
approved
e8a2…3dChain intact, no event rewritten
4 / 4Get started
Wire it to your agent.
Get your first call in minutes.
Install the connector, point it at Claude Code or Codex, and enroll your phone. Open source and self-hostable, or fully managed on Ony.ai Cloud.