The AI toolkit for forward deployed engineers.
One command scaffolds an agent you can hand a client today. Everything after that is a CLI command or a markdown file.
Apache-2.0
Send the link.
For the person you send it to
No account. Not even ours.
The chat is a web page. Their identity is created in their own browser and never sent to us.3
Log in once.
Forty of them
The browser is a shell command.
Forty operations, each an ordinary command — stdout is data, so it pipes. co browser do hands the same live tab to an LLM.2
No OAuth app. No review queue.
No Resend. No DNS records.
Your agent has its own email address.
It exists the moment you authenticate — no mail provider, no domain, no SPF.7
It redraws itself.
Day zero
You get a dashboard you did not write.
Generated for you, with the agent's skills wired to working buttons. Every press leaves a line in the chat.4
arrears-agent
Home
Quick actions
Every figure links to its source. First release 7 August 2025 — one every third day since.
Teaching it a new job
A new skill is a markdown file.
A job description in plain English. Drop it in, type /its-name.
Why it suits a coding agent
The docs ship inside your project.
co create copies our docs into .co/docs/ — Claude Code reads the framework from your own repo while it works.
Nothing to port
The skills you already wrote in Claude Code work here.
Read directly — same files, no porting. co skills discover finds the ones in Codex, Cursor and Kiro too.5
✓ read at runtime · → found by co skills discover
When the job is writing code
Your agent can hand the coding to Codex.
Your agent subcontracts the coding to Codex. Every diff still comes back to you for approval.6
When it wants to run something
Three ways to say no.
Dangerous tools stop and wait. Allow once, trust for the session — or refuse, three different ways.8
Scoped access
Extra access expires when the job does.
A skill can widen access while it runs. When the turn ends, it is taken back — no permanent allowlist.
The trick everyone tries
Allowing git does not allow the rest of the line.
Each command in the chain is checked on its own. One bad link refuses the whole line.
Nothing to log into
Your logs are files on your disk.
Plain text and YAML in your project — tokens, cost, every message. No dashboard to sign into.
Footnotes
1. New accounts get $5 of credit for managed models through the co/ prefix, so the generated project runs without an OpenAI, Anthropic or Google key. Those requests route through OpenOnion's proxy. Put your own key in .env and change the model string whenever you like — nine providers are supported. The agent runs on your machine and stops when you close it; co deploy packages the project and hands back a hosted address. There is no self-hosted deploy command — self-hosting means running host() yourself. ↩
2. co browser runs a persistent daemon that owns one real browser, so a login you complete by hand — including 2FA — stays valid for every later command. Exactly forty operations, listed by co browser help, and co browser do "…" puts an agent on the same live browser. Several agents can share that browser — each opens its own tab with co browser tab open and passes -t on every command. co browser tab ls is the board: every tab, who owns it, its last command. They find each other through it, and through the error — a bare command on a tab someone else is mid-task on fails with exit code 4 and names who has it. Set CO_WHO so the board shows a real name; Claude Code sessions are identified automatically. bash itself is Unix and macOS only. The terminal output shown on this page is simulated: the mechanism and the commands are real, the session and the row counts are invented. ↩
3. The chat is a web page, so the person you send it to installs nothing and signs up for nothing — their credential is generated in their own browser and never sent to us. Because it lives in that browser, a different browser is a different identity unless the recovery phrase is imported. Traffic reaches people who are not on your network through our relay, which terminates TLS and can read it. It is not end-to-end encrypted. ↩
4. The agent edits dashboard.html with ordinary file tools; the host notices the change and pushes a snapshot after that run; the pane re-renders. No polling, no fetch, no deploy. Capped at 2 MB with images inlined. The generated starter carries up to four skills as buttons, and agent-authored HTML runs under default-src 'none' in an opaque-origin frame — its own scripts never execute and it cannot call out. Any dashboard sequence shown on this page is simulated: the mechanism is real, the footage is not. ↩
5. .claude/skills/ and ~/.claude/skills/ are in the runtime load path. co skills discover additionally scans Codex, Cursor and Kiro. One difference worth knowing: we read the tools: key, not Claude Code's allowed-tools, so a skill's auto-approvals do not carry across — its instructions run unchanged, but it will ask for permission more often than it did there. ↩
6. Requires the codex binary (npm install -g @openai/codex). Sandbox levels are read-only, workspace-write and danger-full-access; per-action approvals route to you through the same approval card as everything else. There is no equivalent for Claude Code — Claude is available as a model provider, not as a subprocess. ↩
7. co auth google and co auth microsoft run through OpenOnion's OAuth app — that is why there is no cloud project, no consent screen and no review queue on your side. The handshake and token refresh pass through oo.openonion.ai; the resulting token is written to your local .env (chmod 600) and mail calls go straight from your machine to Google or Microsoft. Calendar is Python-only — there is no co calendar command. bash itself is Unix and macOS only. The agent's own mailbox (0xcbef…@mail.openonion.ai) is an OpenOnion-hosted service that activates after co auth, not a mail server on your machine — that is what buys the zero-DNS claim. ↩
8. A fixed set of tool names counts as dangerous — bash, shell, file writes, background tasks, email, delete. A custom tool you add is not in that set and runs without asking, so name it into your .co/host.yaml permissions if it should be. Approvals also require a frontend to be attached: with no chat UI connected, there is nothing to ask, and tools run. ↩
Apache-2.0. Works with OpenAI, Anthropic, Google, Groq, Grok, OpenRouter and Mistral, or managed keys through the co/ prefix.