The AI toolkit for forward deployed engineers.
One command scaffolds an agent that already runs — with a chat link you can hand a client today.
Everything you change after that is a command or a markdown file. Point Claude Code at it and go.
pip install connectonion · Apache-2.0
One command.
Send the link.
For the person you send it to
No account. Not even ours.
The chat is a web page. Their identity is generated in their own browser and never sent to us — nothing to sign up for, nothing to download, no seat to provision. Because it lives in that browser, a different browser is a different identity unless they import the recovery phrase.3
Log in once.
Forty of them
The browser is a shell command.
go_to, click, type, upload, wait for an element, extract a table, run a script, screenshot — forty operations, each one an ordinary command. stdout is data and stderr is errors, so it pipes into whatever you already use. When scripting it is more trouble than describing it, co browser do hands the same live tab to an LLM.2
Without writing Python
No project. No imports. Just co gmail.
Mail, Drive, Outlook, a logged-in browser and a NAS are each one command, with nothing to adopt first. Use one piece without taking the rest.7
It redraws itself.
Day zero
You get a dashboard you did not write.
Write no HTML and one is generated for you, with up to four of the agent's skills already wired to working buttons. Every press runs the real skill and leaves a line in the chat, so nothing happens off-screen.4
Every figure links to its source. First release 7 August 2025 — one every third day since.
Teaching it a new job
A new skill is a markdown file.
A skill is a SKILL.md — a description of a job in plain English. Drop it next to the agent and type /its-name.
Why it suits a coding agent
The docs ship inside your project.
co create writes our documentation into .co/docs/, so Claude Code or Codex reads the framework out of your own repo while it edits your prompt, adds a skill, and runs co ai to test it. Everything you would change is a command or a markdown file — the shape a coding agent is good at.
Nothing to port
The skills you already wrote in Claude Code work here.
ConnectOnion reads .claude/skills/ directly — the same files, no porting. They will ask permission more often than they did there, because we read the tools: key rather than Claude Code's auto-approvals. co skills discover also finds the ones in Codex, Cursor and Kiro.5
✓ read at runtime · → found by co skills discover
When the job is writing code
Your agent can hand the coding to Codex.
Give it a task it should not be writing itself and it subcontracts to Codex — you pick how much of the disk Codex may touch, and every diff still comes back to you for approval before it lands.6
When it wants to run something
Three ways to say no.
Shell commands and file writes stop and wait. Allow once, allow for the session — or refuse and make it come back with a different plan. Bash, file writes, email and delete are covered by default; name your own tools into .co/host.yaml to cover those too.8
Scoped access
Extra access expires when the job does.
A skill can widen what the agent may touch while it runs — then the moment it finishes replying, that access is taken back automatically. Nothing is added to a permanent list, so you never approve a command once and live with it forever.
The trick everyone tries
Allowing git does not allow the rest of the line.
A permission check that matched the start of the string would wave this through. Each command in the chain is checked on its own, and one that is not allowed refuses the whole line.
Nothing to log into
Your logs are files on your disk.
Every run writes plain text and YAML into your project, with tokens, cost, duration and the full message history. There is no dashboard to sign into before you can read your own run.
Footnotes
1. New accounts get $5 of credit for managed models through the co/ prefix, so the generated project runs without an OpenAI, Anthropic or Google key. Those requests route through OpenOnion's proxy. Put your own key in .env and change the model string whenever you like — nine providers are supported. The agent runs on your machine and stops when you close it; co deploy packages the project and hands back a hosted address. There is no self-hosted deploy command — self-hosting means running host() yourself. ↩
2. co browser runs a persistent daemon that owns one real browser, so a login you complete by hand — including 2FA — stays valid for every later command. Exactly forty operations, listed by co browser help, and co browser do "…" puts an agent on the same live browser. Several agents can share that browser — each opens its own tab with co browser tab open and passes -t on every command. co browser tab ls is the board: every tab, who owns it, its last command. They find each other through it, and through the error — a bare command on a tab someone else is mid-task on fails with exit code 4 and names who has it. Set CO_WHO so the board shows a real name; Claude Code sessions are identified automatically. bash itself is Unix and macOS only. The terminal output shown on this page is simulated: the mechanism and the commands are real, the session and the row counts are invented. ↩
3. The chat is a web page, so the person you send it to installs nothing and signs up for nothing — their credential is generated in their own browser and never sent to us. Because it lives in that browser, a different browser is a different identity unless the recovery phrase is imported. Traffic reaches people who are not on your network through our relay, which terminates TLS and can read it. It is not end-to-end encrypted. ↩
4. The agent edits dashboard.html with ordinary file tools; the host notices the change and pushes a snapshot after that run; the pane re-renders. No polling, no fetch, no deploy. Capped at 2 MB with images inlined. The generated starter carries up to four skills as buttons, and agent-authored HTML runs under default-src 'none' in an opaque-origin frame — its own scripts never execute and it cannot call out. Any dashboard sequence shown on this page is simulated: the mechanism is real, the footage is not. ↩
5. .claude/skills/ and ~/.claude/skills/ are in the runtime load path. co skills discover additionally scans Codex, Cursor and Kiro. One difference worth knowing: we read the tools: key, not Claude Code's allowed-tools, so a skill's auto-approvals do not carry across — its instructions run unchanged, but it will ask for permission more often than it did there. ↩
6. Requires the codex binary (npm install -g @openai/codex). Sandbox levels are read-only, workspace-write and danger-full-access; per-action approvals route to you through the same approval card as everything else. There is no equivalent for Claude Code — Claude is available as a model provider, not as a subprocess. ↩
7. Mail, Drive, Outlook and contacts need co auth google or co auth microsoft first. Calendar is Python-only — there is no co calendar command. bash itself is Unix and macOS only. The agent's own mailbox is an OpenOnion-hosted service that activates after co auth, not a mail server running on your machine. ↩
8. A fixed set of tool names counts as dangerous — bash, shell, file writes, background tasks, email, delete. A custom tool you add is not in that set and runs without asking, so name it into your .co/host.yaml permissions if it should be. Approvals also require a frontend to be attached: with no chat UI connected, there is nothing to ask, and tools run. ↩
Apache-2.0. Works with OpenAI, Anthropic, Google, Groq, Grok, OpenRouter and Mistral, or managed keys through the co/ prefix.