Question 1

How does Agent Approve work?

Accepted Answer

Agent Approve uses the native hook and extension systems built into AI coding tools like Antigravity, Antigravity CLI, Claude Code, Cursor, Gemini CLI, GitHub Copilot CLI, Hermes, OpenAI Codex, OpenClaw, OpenCode, OpenHands, Pi, VS Code GitHub Copilot, and Windsurf. There are two types of events, each with their own encryption path. Approval requests — when an agent wants to execute a command or tool — are sent with their parameters through an encrypted channel to the server so your centralized policy can be evaluated automatically. This is the only path that touches the server, and the content is never persisted. Everything else — command output, prompts, responses, thinking, and other non-approval events — is end-to-end encrypted directly from your device to you. We cannot see any of this content. When a command requires manual approval, you receive a push notification on your iPhone or Apple Watch, review the command, and approve or deny it in real time. Agent Approve is especially useful for autonomous agents like Antigravity, Hermes, Pi, OpenClaw, OpenCode, and OpenHands.

Question 2

Which AI coding agents are supported?

Accepted Answer

We currently support Antigravity, Antigravity CLI, Claude Code, Cursor, Gemini CLI, GitHub Copilot CLI, Hermes, OpenAI Codex, OpenClaw, OpenCode, OpenHands, Pi, VS Code GitHub Copilot, and Windsurf. Antigravity is our most recent integration. Agent Approve works with any tool that provides a hook or extension system for command approval. If you use a tool that supports hooks and you'd like us to add support for it, let us know at hello@agentapprove.com.

Question 3

Do I need to switch to a different coding tool?

Accepted Answer

No. You keep using your existing AI coding tools exactly as you do today. The only change is that hooks are configured in your tool to send approval requests to Agent Approve. You can set this up with our installer in under a minute, or configure it manually.

Question 4

Does it work on Apple Watch?

Accepted Answer

Yes. You can review and approve commands directly from your Apple Watch with one tap. The watch app shows the command context and lets you approve or deny without pulling out your phone.

Question 5

How much does it cost?

Accepted Answer

Agent Approve is $14.99/month with a 7-day free trial. The subscription is managed through the Apple App Store.

Question 6

Where can I get Agent Approve?

Accepted Answer

Agent Approve is available now on the App Store for iPhone and Apple Watch. Download the app, then run `npx agentapprove` on your computer to install hooks and pair your device. You can also try Demo Mode from the welcome screen — no account required.

Question 7

Is destructive AI agent behavior really a problem?

Accepted Answer

Yes, and the list is growing. We track real incidents from real teams where agents like Claude Code, Cursor, Gemini CLI, OpenAI Codex, GitHub Copilot, and OpenClaw deleted production databases, force-pushed over weeks of work, dropped Git-tracked files, deleted user emails, or pushed code to public repos before anyone could intervene. The pattern is consistent: a single agent can run dozens of shell commands in a few seconds, and one misread instruction can wipe out work that took weeks to build. Closer to home, Agent Approve's founder watched his entire home directory be wiped in real time after an agent ran `rm -rf ~` to remove a subdirectory that was literally named `~`. Shell tilde expansion took over and started deleting everything under his home directory. He had to force quit the agent halfway through to stop it. That experience is the reason this product exists, and the reason every approval happens on a separate device the agent cannot click on its own.

Question 8

How many destructive commands does Agent Approve block by default?

Accepted Answer

The Restrictive policy ships with over 270 destructive command patterns enabled out of the box, covering filesystem wipes, Git history rewrites, database drops and migrations, cloud and Kubernetes deletes, secret-leaking commands, and risky package publishes. The full taxonomy and example patterns are listed on the destructive actions page. You can switch policies or customize the lists from the iOS app at any time.

Question 9

Can I set up auto-approve rules?

Accepted Answer

Yes. Agent Approve supports allowlists and denylists that let you auto-approve safe commands (like reading files) and auto-deny dangerous ones (like deleting directories). Policy evaluation sees the command and parameters within the encrypted context so it can make decisions automatically. You manage these rules from a centralized policy that applies across all your agents.

Question 10

How does Agent Approve handle compound or chained shell commands?

Accepted Answer

Every shell command is parsed before policy evaluation. The parser splits on the common shell separators — `&&`, `||`, `|`, `;`, and newlines — while respecting single and double quotes and backslash line continuations, then evaluates each subcommand against your allowlist and denylist independently. That means a destructive command buried at the end of a long chain (or hidden behind a quoted argument) is still checked on its own. Today the lists support exact, prefix, and contains matching, with full regex matching and structured AND/OR/NOT rules on the roadmap, plus a future tier that uses an AI model to evaluate commands that do not match any literal pattern.

Question 11

What happens if I lose internet or my phone is off?

Accepted Answer

Approval requests wait up to your configured timeout, which is 5 minutes by default. If the request reaches Agent Approve but you do not answer in time, the current behavior is to deny that approval. That is different from the offline mode you choose during install: if the hook cannot get a usable response from Agent Approve at all, it follows your selected fallback instead. Ask falls back to the agent's own approval flow when available, Deny blocks the action, and Allow lets it continue. Stop and follow-up prompts are separate: if those time out, no follow-up message is sent and the agent simply continues.

Question 12

Is my data secure?

Accepted Answer

Yes. Agent Approve has two layers of encryption at rest: organization-level keys and user-managed keys that we never have access to. You control key rotation and data retention. Approval requests are sent through an encrypted channel to the server for centralized policy evaluation — this content is never persisted. All other events (command output, prompts, responses, thinking) are end-to-end encrypted directly to your device, meaning we have no ability to see them.

Question 13

Does Agent Approve see my source code?

Accepted Answer

No, not directly. Agent Approve relays the hook payloads emitted by your agent so you can see useful context in the iPhone and Apple Watch apps. That often includes commands that read or write source files. Depending on your privacy tier, we send tool names only, short summaries, or the full command and tool input. When end-to-end encryption is enabled, that content is encrypted with keys you control, so we cannot read it.

Question 14

Doesn't Claude Code already have remote control?

Accepted Answer

Yes. Claude Code now offers Remote Control through claude.ai/code and the Claude mobile app, so you can continue a local Claude session from another device while it still runs on your machine. That is a good fit if you only need remote access to Claude. Agent Approve solves a different problem: centralized approvals, shared policy, Apple Watch alerts, and one control layer across Claude Code plus other agents like Cursor, Codex, OpenClaw, Hermes, OpenCode, and Pi.

Question 15

Why use Agent Approve with OpenClaw if OpenClaw already works through Slack, WhatsApp, or Telegram?

Accepted Answer

Slack, WhatsApp, and Telegram are ways to talk to OpenClaw, not ways to govern it. Agent Approve adds a policy layer on top: you see every tool call, prompt, and response, and you can allow, deny, or require approval for each action. That applies no matter how OpenClaw was triggered — chat, cron, webhooks, or another automation surface.

Question 16

Why use Agent Approve with Hermes if Hermes already works through Telegram, Discord, or Slack?

Accepted Answer

Telegram, Discord, and Slack are ways to talk to Hermes, not ways to govern it. Agent Approve adds supervision for prompts, tool calls, responses, and approvals so you can see what happened and decide which actions should run automatically versus which ones should require approval — no matter whether the turn was triggered from chat, cron, a gateway webhook, or a subagent delegation.

Frequently asked questions

Getting started

Policy & protection

Security & privacy

How we compare

Go out and grab a coffee