Caprock

One terminal workspace for Claude Code, Codex, OpenCode and friends — with every session, dollar, permission prompt and PR visible in one place.

Source repo
dspv/caprock
Stars
★ 23
Last updated
today
License
Apache-2.0
Primary language
Go

At a glance

How it runs
Desktop appCLISelf-hosted service
Works with
Universal · cross-platformCodex · Claude Code · OpenAI API · Claude API
Cost
Free tier plus a paid hosted plan
Setup effort
Low · running in minutes
You'll need
Claude Code, Codex, OpenCode, Gemini CLI or Hermes Agent CLI (optional, to be launched and observed)Go toolchain (only for go install path)Homebrew, Scoop or a prebuilt binary from ReleasesShell / CLINetwork accessLocal filesystemMCP Server
Typical use
A developer running Claude Code and Codex in parallel who wants both agents' sessions and spend visible in one window instead of scattered terminals.
Not a fit if
  • Compliance teams that require signed and notarized installers; the app is not yet notarized or code-signed
  • Users who want a pure browser dashboard without running a local daemon
  • Users needing complete Codex/Gemini cost and approval alerts, which are not fully covered
Source review
62/100 · Some gaps

What does this agent do, and when should you use it?

Caprock is a local-first desktop app (Tauri, macOS/Windows/Linux) wrapped around a Go daemon that also serves a browser dashboard. It puts Claude Code, Codex, OpenCode, Gemini CLI, DeepSeek Harness and Hermes Agent sessions into terminal tabs and split panes, organized by project and git worktree, with a plain shell alongside. It reads what each agent already writes — transcripts, per-agent databases, OpenTelemetry — prices every turn at API list rates, and breaks spend down by repository, model, service and tool call, side by side with Claude's 5-hour and weekly plan windows. It also shows the repository's pull requests with a per-job, per-OS CI check matrix and can hand a red run, conflict or stale branch back to an agent. All state lives in one local SQLite file on loopback with no account or telemetry; a phone can pair through an end-to-end encrypted relay or the LAN, and caprock mcp exposes a read-only query surface to your agents.

Caprock runs a local daemon (caprock up, default localhost:22776) under a Tauri shell. It observes Claude Code through hooks plus transcripts — the hook and status-line entries in ~/.claude/settings.json are offered on first run, backed up, and skippable — and collects other agents from their own stores: OpenCode's database opened read-only (v1 and v2, deduplicated after migration), Codex's per-session transcripts under $CODEX_HOME or ~/.codex including archived ones, DeepSeek Harness transcripts, Gemini's OpenTelemetry file, and Hermes Agent's ~/.hermes/state.db. Each turn is priced from vendor list-price tables (OpenCode and Hermes pass through their own figures), feeding the Home activity pulse, Cost and Lifetime reports, a context-tax readout of what the next call costs, and per-tool-call groupings. It launches, types into and stops sessions it started, summarizes the repository's pull requests with CI checks per job and OS, and offers a Changes view to stage, commit and push. CLI surfaces include caprock report, caprock export, caprock doctor, caprock sessions rm and caprock license. The opt-in task runner (caprock up --hive … --repo …) runs each task in its own git worktree and only marks it done when the done_criteria shell commands exit 0.

  1. A developer running Claude Code and Codex in parallel who wants both agents' sessions and spend visible in one window instead of scattered terminals.
  2. Someone on a Claude Max/Pro plan doing heavy agent work who needs to see list-price usage against the 5-hour and weekly windows before hitting a limit.
  3. Teams maintaining several services in a monorepo who want per-repository and per-service cost attribution for agent sessions.
  4. Maintainers who want PR checks as a job-by-OS grid, with failed jobs sent straight back to an agent via 'Fix CI with agent'.
  5. Remote workers who want to approve permission prompts, check spend and continue sessions from a phone on mobile data or the home Wi-Fi.
  6. Teams that want their coding agents to look up past decisions, repository cost and CI status themselves through the read-only caprock mcp server.

How do you install or deploy this agent?

Install the desktop app on macOS with the Homebrew cask:

brew install --cask dspv/tap/caprock-app

Or download directly from Releases: macOS .dmg, the Windows setup .exe, Linux .AppImage/.deb/.rpm. The app is not notarized or code-signed yet, so the first .dmg open needs the one-time 'Open Anyway' step and Windows needs SmartScreen's 'Run anyway' — see docs/install-app.md.

For the daemon and browser dashboard alone:

# macOS / Linux
brew install dspv/tap/caprock

# Windows
scoop bucket add dspv https://github.com/dspv/scoop-bucket
scoop install caprock

# with a Go toolchain
go install github.com/dspv/caprock/cmd/caprock@latest

Then run caprock up, which opens localhost:22776 and asks before adding its hook and status-line entries. First run reads the transcripts Claude Code already wrote, so history appears without migration; if the older PyPI Python caprock is installed, remove it first so the two commands do not shadow each other.

How do you use this agent?

Start the daemon and open the UI:

caprock up

In the app, ⌘T opens a shell, ⇧⌘N an agent, ⌘O adds, creates or clones a project; each project expands to its worktrees and the sessions inside, with whatever waits on you pinned to the top. To start at login:

caprock service install
caprock service status

Produce a publishable report and export the raw record:

caprock report --markdown
caprock export --since 30d > events.tsv
caprock export sessions --format csv --out s.csv

Wire Caprock into your agent as a read-only MCP server:

claude mcp add caprock -- caprock mcp
codex mcp add caprock -- caprock mcp

Optionally, the unattended task runner (off by default; workers run with permission prompts skipped, so set a budget per task):

caprock up --hive ~/caprock-tasks --repo ~/dev/myproject
caprock task create --title "Add a /healthz endpoint" \
  --done-criteria "go test ./..." --done-criteria "go vet ./..." --budget 3

For a phone, press Connect a phone under Settings → Use on your phone and scan the QR code, or from SSH run caprock remote on then caprock pair (view-only). Activate Premium features with caprock license set YOUR-KEY.

What are this agent's strengths and limitations?

Pros
  • Multi-agent in one window: Claude Code, Codex, OpenCode, Gemini CLI, DeepSeek Harness and Hermes Agent share the same cost, history and project views, with a per-agent filter on Home.
  • Cost accounting down to the individual call: context tax, cache-hit share, breakdowns by repository, model and tool call, and Claude/Codex plan windows — measured from transcripts rather than modelled.
  • A concrete local-first boundary: data stays in one local SQLite file, loopback only, and each outbound feature (release check, GitHub, Telegram, Gemini chat) is off until switched on.
  • Pull requests and CI sit beside the agent: a per-job, per-OS check grid with durations, plus in-row 'Fix CI with agent' and a Changes view that stages, commits and pushes.
  • A read-only MCP server (caprock mcp) lets the agent you are working with look up past sessions, repository cost and CI status itself.
  • Launching and watching Gemini, Codex, OpenCode and Hermes sessions is free, like every other agent.
Limitations
  • The desktop app is not code-signed or notarized yet: macOS needs a manual 'Open Anyway', Windows needs a SmartScreen bypass, which complicates managed enterprise rollout.
  • Codex cost has documented gaps: turns that do not name a model show no cost, about half of token reports cannot be split by kind so the figure is an upper bound, and unreported gpt-6 cache writes can make it low.
  • Telegram alerts cover Claude Code only; Codex and OpenCode approval/finish events cannot be read. DeepSeek Harness is read-only and the task runner works with Claude Code alone.
  • On Linux and Windows the app builds and its tests pass, but the author states it has not been run on either platform.
  • The task runner uses --dangerously-skip-permissions, does not merge branches or detect two workers editing the same file, and needs per-task budgets and manual landing.
  • Phone control is as powerful as a shell in your home directory, so only grant it to your own device; plain-HTTP LAN access loses push notifications and offline caching.

How does this agent compare with similar options?

The README explicitly distinguishes this project from an earlier, unrelated Python caprock on PyPI (a CLI stats tool that read usage from a proxy): this one is a Go binary with a dashboard, different data and a different install, and the old package must be uninstalled first. It also frames the opt-in task runner as roughly 'a git worktree plus a shell loop' with a test gate, and explains that it keeps history because Claude Code deletes transcripts after 30 days. No other multi-agent management tool is named for comparison.

Key facts side by side with the most closely related agents.

Agent Source review Form / cost Stars Updated Language Full support on
Caprock This agent 62 · Some gaps Desktop appFreemium ★ 23 today Go Codex · Claude Code · OpenAI API · Claude API
AOCI-CODE — a Git-versioned cognition index for coding agents 52 · Major gaps CLIFree + model costs ★ 1.6k 5d ago Go Codex · Claude Code
Yardsort 70 · Some gaps Desktop appFree ★ 11 9d ago Rust Codex · Claude Code
Helmor Local Agent Workbench 52 · Major gaps Desktop appFree + model costs ★ 1.3k 2mo ago TypeScript Codex · Claude Code

How does FollowAgents rate this agent?

FollowAgents source review · FARS-2.1
Some gaps
62/ 100 5-point scale 3.1 / 5
Trust 17/29
Reliability 8/14
Adaptability 12/18
Convention 13/18
Effectiveness 7/13
Verifiability 5/8
Why each dimension lost points
Trust17 / 29 · 2.9/5

SECURITY.md openly states the local API has no login and relies on loopback plus Origin/Host checks, and admits any visited page can send requests to 127.0.0.1 — a broad permission surface, so least_privilege is 1. User confirmation is decent (first-run prompt before hook edits, Approve only when the full request is shown), scored 2. Data-flow transparency is thorough (per-host outbound list, stored data, file modes), scored 3. Sensitive data handling admits cleartext storage with no redaction, relying on 0600 and deletion guidance, scored 2. Dependencies are listed but no vulnerability audit or lock evidence, scored 1. External effects are reversible and recorded, scored 2. Rollback exists via hooks uninstall/restore and backups, but deleting the DB loses everything, scored 2. Source attribution is only a copyright line in LICENSE with an unverified publisher, scored 1.

Reliability8 / 14 · 2.9/5

README, SECURITY and install docs are broadly consistent on port, data dir and outbound behavior, scored 2. Dependencies are public Go modules so availability is judgeable, but no checksums or vendoring, scored 2. Failure messages appear only sporadically (Gemini/Mail unconfigured), no systematic error-handling description, scored 1.

Adaptability12 / 18 · 3.3/5

Audience and multi-agent desktop scenarios are clearly described, scored 2. Capability boundaries are detailed (which agents are read-only, which accept input, Codex cost upper bounds), scored 3. Trigger precision is thin: hooks, notifications and auto-trusted folders are mentioned without exact trigger conditions or conflict handling, scored 1. Environment fit covers three platforms but explicitly verified only on macOS, scored 2.

Convention13 / 18 · 3.6/5

Information architecture is workable but the README is very long and truncated, scored 2. Install notes are excellent (brew, dmg, deb, rpm, scripts, uninstall), scored 3. Naming stability is weakened by a same-named legacy PyPI tool, scored 2. Examples and FAQ exist but are scattered, scored 2. Known limitations are well documented, scored 3. Apache-2.0 full text present, scored 3. Versioning/changelog relies only on a Releases badge, no CHANGELOG, scored 1. Maintenance responsibility is unclear (unverified publisher, no maintainer statement), scored 1.

Effectiveness7 / 13 · 2.7/5

Output usability has concrete forms (report/export/mcp), scored 2. Marginal value for multi-agent cost and PR tracking is real, scored 2. Cost-benefit is hurt by unsigned/not-notarized builds requiring OS warning bypass and by the audit's documented performance issues, scored 1.

Verifiability5 / 8 · 3.1/5

Most claims trace to specific docs and code paths (tailer.go, ADR numbers), scored 2. README, SECURITY and the audit corroborate each other, scored 2. The audit explicitly separates measurement from inference and states what was not executed, scored 2.

Risks and how to mitigate them
  • The local API has no login and relies on loopback plus Origin/Host checks; any visited web page can send requests to 127.0.0.1, creating a cross-site trigger risk.
  • The database stores prompts, replies and tool output in cleartext, possibly including secrets, with no redaction; treat it as sensitive as shell history.
  • Desktop builds are unsigned and not notarized, requiring Gatekeeper and SmartScreen bypasses, which carries supply-chain and integrity risk.
  • Publisher identity is unverified by the FollowAgents registry; maintenance responsibility and update path are unclear.
  • The resource audit documents performance and allocation issues (history refresh, session summaries, full Codex re-parse) that may slow large histories.
  • Verified only on macOS; Linux and Windows build and pass tests but have not been run.
Evidence confidence: Low Reviewed Oct 20, 2026 Reviewed revision e7ed9895ac96
See the full review method →

FAQ

Is it free, and what exactly does Premium lock?
Reading every visible provider and pricing all sessions, launching and watching agents, the browser dashboard, PR/CI views, the MCP server, exports and reports are free and Apache-2.0. Premium ($30/year or $100 once) adds the daily spend cap, plan-limit auto-pause and resume, Ask Gemini, two-way Telegram replies, failure-rate and trend figures on Lifetime, and more than three Claude Code/Codex sign-ins.
Does it modify my Claude Code configuration?
caprock up asks before adding its hook and status-line entries to ~/.claude/settings.json, backs the file up, and leaves your other settings untouched; declining still reads your history from transcripts. The login service runs with --no-hooks, so it never edits settings at login.
What sensitive content ends up in the database?
Everything Claude Code read and wrote: your prompts, its replies, and the full output of every tool call — which is where an API key printed by a command or a token in a .env file can land. The file is 0600 and nothing sends it anywhere, but it is inside your backups; caprock down plus deleting the data directory removes it.
How trustworthy are the Codex cost figures?
Codex reports tokens but never cost, so turns are priced from Caprock's OpenAI list-price table. Turns whose transcript does not name a model keep their tokens but show no cost; about half of reports give only a total, counted as input, so the figure is an upper bound; unreported gpt-6 cache writes can make it low by up to a quarter of that share.
Do I need to host anything for phone access?
No. Your computer dials out to an encrypted relay (default wss://relay.caprock.dev, or your own via caprock remote relay, also a Cloudflare Worker), end-to-end encrypted with Noise NK, X25519 and AES-GCM; the relay sees connection metadata only and stores nothing. caprock up --lan offers a same-network-only alternative over Wi-Fi or Tailscale.
View on GitHub ↗ Install ↓

Compare agents like this one

The same FARS review applied across the shortlist this agent qualifies for.

Related agents