AgentOpsSec
HomeProjectsDocsContribute
GitHub Install stack
~projectsstack
orchestrate

AgentOpsSec Stack

Think of it as: One CLI that runs the whole AgentOpsSec stack

Run the AgentOpsSec stack from one CLI.

The orchestrator. One entry point for setup, scanning, monitoring, and wrapped agent runs. Discovers each standalone tool, runs it as a command, and connects them through local JSON reports — the stack CLI never imports another tool’s code.

stableMITlocal-onlyno telemetry
Install github.com/AgentOpsSec/stackDocs
quickstart · stack
1# 1. install the orchestrator
2npm install -g agentopssec
3 
4# 2. set up a project (asks before installing missing sub-tools)
5agentopssec init
6agentopssec check
7 
8# 3. run an agent through the strongest available chain
9agentopssec start -- codex "work on this repo"
01

Why this exists

AgentOpsSec is a stack of small standalone tools. The stack CLI is the one entry point for setup, scanning, monitoring, and wrapped agent runs — without coupling the tools to each other.

It does not import code from the other projects. It detects which tools are installed, runs them as commands, and connects them through local JSON reports and log files. Every project still works on its own.

One install, one config (.agentopssec/config.json), and a strongest-available wrapper chain when you start an agent.

  • Which AgentOpsSec tools are installed on this machine?
  • Which profile fits this project — minimal, security, observe, or full?
  • How do I run an agent with all of my safety tools chained together?
  • How do I wire a single CI step to gate on risk + budget + review?
  • How do I wrap codex / claude / gemini transparently from my shell?
  • What files are the integration boundary between tools?
02

Quickstart

One command. No account. No telemetry.

quickstart · stack
1# 1. install the orchestrator
2npm install -g agentopssec
3 
4# 2. set up a project (asks before installing missing sub-tools)
5agentopssec init
6agentopssec check
7 
8# 3. run an agent through the strongest available chain
9agentopssec start -- codex "work on this repo"
03

Stack profiles

Pick a profile during init — it sets which tools are enabled out of the box.

--profile minimalsafe
MCP Doctor only.
--profile securityrisk
MCP Doctor, MCP Firewall, Agent Review.
--profile observeinfo
Agent Flight Recorder, Agent Cost Lens.
--profile fullsafe
All seven sub-tools.
--profile customwarn
Prompt for each tool individually.
04

agentopssec start

Stack picks the strongest available wrapper chain for the agent you launch.

default chain
agent-cost-lens
meter the run
agent-flight-recorder
record events
mcp-firewall
apply policy
codex / claude / gemini
the agent
--sandbox chain
agent-cost-lens
meter the run
agent-sandbox
isolated workspace
mcp-firewall
apply policy
codex / claude / gemini
the agent
After the run, AgentOpsSec runs available review and cost summaries.
05

Data contract

Stack does not import other tools — it talks to them through these local files. Run `agentopssec contract` for the active layout.

.agentopssec/ (data contract)
1.agentopssec/config.json
2.agentopssec/mcp-doctor-scan.json
3.agentopssec/mcp-radar-doctor.json
4.mcp-firewall/logs.jsonl
5.agent-flight/runs/*.json
6.agent-sandbox/runs/*.json
7.agent-cost/records.jsonl
06

Shell integration

Route normal agent commands through agentopssec start, transparently.

shell
1eval "$(agentopssec init-shell)"
2 
3codex "fix tests"
4claude "review this repo"
5gemini "summarize the diff"
6opencode "refactor this file"
7 
8# or default to running through Agent Sandbox
9eval "$(agentopssec init-shell --sandbox)"
07

CLI reference

init [--profile <p>]Set up a project. Profiles: minimal, security, observe, full, custom.
status / toolsWhat is installed and what is enabled.
scanRun the available scan steps (Doctor → Firewall → Radar).
checkLocal audit snapshot.
ciCI-gate variant — exits non-zero on risk or budget breach.
monitorPassive snapshot of stack signals in this repo.
start -- <agent> <prompt>Wrap an agent with the strongest available chain.
start --sandbox -- …Use Agent Sandbox in the chain instead of running in-place.
init-shellPrint a shell snippet that routes codex / claude / gemini through start.
review latest|firewall|sandboxRun Agent Review over the relevant artifacts.
cost monthPass-through to Agent Cost Lens.
contractPrint the active project data contract.
repairRe-check tools, recreate folders, validate JSON/JSONL artifacts.
update [--yes]Update the stack and every installed sub-tool.