hcom
Hook coding agents together: message, watch, and spawn each other across terminals without changing your workflow.
- Source repo
- aannoo/hcom
- Stars
- ★ 601
- Last updated
- 4d ago
- License
- MIT
- Primary language
- Rust
- FA score
- 69/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformCodex · Claude Code
- Cost
- Free software; you pay for model usage
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- A developer running mixed-agent setups who wants Claude Code to review what Codex did and send it fixes
- Not a fit if
- Teams needing scoped, revocable relay tokens
- Users unwilling to let hooks edit config dirs under their home
- Environments requiring forward secrecy for captured traffic
- Source review
- 69/100 · Some gaps
What does this agent do, and when should you use it?
hcom is a CLI that lets coding agents — Claude Code, Codex, OpenCode, Kilo Code, Pi, Oh My Pi, Antigravity, Cursor CLI, Kimi, Gemini, and Copilot CLI — message, observe, and spawn each other across terminals in any combination. It records agent activity via hooks into a local SQLite database and delivers messages from it, either injected mid-turn or waking idle agents. Each agent gets a queryable identity: name, status, inbox, live terminal screen, transcript, and an event log. It ships as a single Rust binary with no background services, plus a TUI dashboard, MQTT cross-device relay, and bundled workflow scripts like debate and confess. Licensed under MIT and available for macOS, Linux, Termux, WSL, and Windows.
Launch agents in any terminal emulator with hcom claude, hcom codex, etc.; hooks are installed into config dirs under ~/ (or HCOM_DIR) on first run. Activity such as file edits and tool calls is written to SQLite, and other agents receive messages mid-turn or as wake-ups. Commands include hcom send -b @luna -- hey for direct messaging, hcom f for forking sessions, hcom term to view/inject into an agent's PTY, and hcom events --wait for scripted subscriptions. Collision detection is on by default: agents editing the same file within 30 seconds are notified. hcom relay new / connect <token> links agents across machines via an MQTT relay encrypted with XChaCha20-Poly1305. Workflow scripts like hcom run debate are bundled, and ~/.hcom/scripts/ accepts custom scripts. Tools without hooks can join via hcom start or hcom listen.
- A developer running mixed-agent setups who wants Claude Code to review what Codex did and send it fixes
- A pipeline builder who spawns 3x OpenCode agents, splits work, and collects results
- A remote worker connecting agents on home and laptop machines via an encrypted MQTT relay
- A debugger asking an agent to fork itself to investigate a bug and report back
- An automation tinkerer subscribing to events like 'when codex goes idle, send it the next task'
How do you install or deploy this agent?
Recommended: brew install aannoo/hcom/hcom. Python: uv tool install hcom or pip install hcom. macOS/Linux/Termux/WSL: curl -fsSL https://github.com/aannoo/hcom/releases/latest/download/hcom-installer.sh | sh. Windows: irm https://github.com/aannoo/hcom/releases/latest/download/hcom-installer.ps1 | iex. Building from source requires Rust 1.88+: git clone https://github.com/aannoo/hcom.git && cd hcom && cargo build. Update existing installs with hcom update.
How do you use this agent?
Terminal 1: hcom claude. Terminal 2: hcom codex. Then prompt normally, e.g. review what claude did and send it fixes or spawn 3x opencode, split work, collect results. Run hcom for the TUI dashboard. Cross-device: run hcom relay new for a token, then hcom relay connect <token> on each device. Configuration lives in ~/.hcom/config.toml; use hcom config <key> <value> or HCOM_DIR for per-project isolation. Run hcom hooks remove before uninstalling.
What are this agent's strengths and limitations?
- Tool-agnostic: one messaging fabric connects 11 coding agent CLIs in any combination without changing how you use them
- Single Rust binary with no background services; unused hooks do nothing
- Transparent and auditable: messages flow through a local SQLite DB, with live terminal screens and event logs per agent
- End-to-end encrypted MQTT relay with a thoroughly documented security model and limits
- Hooks modify config dirs under your home directory on first run, changing your local environment
- Relay tokens have no expiry, scope, or revocation; a leaked token is treated as shell access and rotation requires rebuilding the relay
- Message delivery depends on per-tool hooks; unsupported AI tools need manual integration via
hcom listen/hcom start - No forward secrecy — a leaked PSK can decrypt old captured traffic — and no per-device permissions within a relay
How does this agent compare with similar options?
Compared to using a single vendor's built-in subagents (e.g., Claude Code's task tool), hcom lets any agent CLI act as another's subagent across terminals without vendor lock-in.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| hcom This agent | 69 · Some gaps | CLIFree + model costs | ★ 601 | 4d ago | Rust | Codex · Claude Code |
| Oh My OpenAgent | 49 · Major gaps | Agent plugin / skillFree + model costs | ★ 70k | today | TypeScript | Claude Code |
| GraphCode | 48 · Major gaps | Desktop appFree + model costs | ★ 145 | today | Swift | ChatGPT · Codex · Claude Code |
| AgentsMesh | 45 · Major gaps | Self-hosted serviceFreemium | ★ 2.4k | 1mo ago | Go | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Security model is well documented: PSK stored with mode 0600, remote RPC refuses relay_psk/token, only a fingerprint is shown; but hooks are written into user config dirs on first run with no explicit consent flow shown, auto_approve can auto-approve hcom commands, and relay membership is all-or-nothing trust (remote spawn/kill is shell-equivalent), so least_privilege, user_confirmation and external_effects are docked.
README, Cargo.toml and pyproject agree on version and license; CI runs with --locked plus a real-tool test matrix. However vt100 is patched to an unpublished rev on a personal fork of an upstream issue still open — a supply-chain and availability risk, so dependency_availability and self_consistency miss full marks.
Broad tool/terminal/OS coverage, per-project isolation via HCOM_DIR; the relay security model's limits (no forward secrecy, no per-device permissions, single trust domain) are exceptionally explicit, earning capability_boundaries a 3; but trigger precision (hook injection, 30s collision window) is only descriptively stated without parameterized evidence.
README is well structured (install, quickstart, security model, troubleshooting, uninstall, CLI/config reference, build); the known-limitations section is unusually thorough and MIT is consistent across three files; but no CHANGELOG file is present in the repo and maintainer identity is just 'aannoo' (unverified), docking versioning_changelog and maintenance_responsibility by 1 each.
Single Rust binary, no background services, ~700-token agent primer — cost discipline is evidenced; output usability is supported by TUI dashboard, hcom status diagnostics and hcom reset; but marginal value versus each CLI's own multi-session features lies mainly in cross-tool interop, and only the claim, not the realized benefit, is evidenced.
Most claims map to concrete commands, config keys or CI steps (real-tool matrix, typecheck, dist-check) and the four manifest files corroborate each other; but CI badge pass status cannot be statically verified, and security claims (encryption, replay guard) lack code-level evidence paths in the provided files, so fact_inference_separation is not full marks.
- A relay join token grants full control of every enrolled device (remote spawn/kill, message injection) and is irrevocable with no expiry — after a leak you must abandon and recreate the relay.
- Hooks are installed into user config dirs on first run; even though they allegedly no-op when unused, inspect the hook contents and keep the hcom hooks remove / hcom reset all rollback paths ready.
- The vt100 dependency is pinned to a fixed rev on a personal fork rather than a published release, with the upstream issue still open — a supply-chain and regression risk.
- With auto_approve enabled, hcom commands skip per-action confirmation; on public brokers, relay metadata (topic names, timing) is visible to network observers.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
v0.7.31 0.7.31
Release notes excerpt
Release Notes Breaking changes - Dropped ephemeral uvx hcom support. Run uv tool install hcom and restart affected sessions; hooks and agents need a persistent hcom on PATH. Legacy hooks can still be removed with uvx hcom hooks remove. Added - Added hcom events --follow to stream matching events as JSON Lines, with --last N to replay recent matches first and --after-id ID to resume from a saved cursor. - Added --json output to launch, hcom r, hcom f, and hcom kill, so scripts no longer have to parse names out of the text output. …View on GitHub ↗ -
v0.7.30 0.7.30
Release notes excerpt
Release Notes Added - Added Hermes Agent, hcom hermes: messaging, status, resume, and transcripts. - Added Hermes gateway chats as hcom agents: after hcom hooks add hermes, run /hcom start in a chat (Telegram, Discord, IRC, ...) to join and /hcom stop to leave. - Added token usage to hcom list <name> and hcom transcript --detailed, and context usage for the selected agent in the TUI. Changed - Changed hcom transcript search to match exchanges instead of raw transcript lines, with the command to open each hit. …View on GitHub ↗ -
v0.7.29 0.7.29
Release notes excerpt
Release Notes Breaking changes - Made relay settings read-only in hcom config. Use hcom relay new, connect, on, or off instead. - Changed hcom config <key> "" to set an empty value instead of resetting the key. Reset with --unset, which now works for every non-relay key. Added - Added experimental native delivery for Claude (claude_delivery native): a bundled Claude mod submits messages when the agent is idle, instead of hcom typing into the terminal. …View on GitHub ↗
FAQ
What does it cost?
How does it access my agents?
~/ that record activity and deliver messages; hcom reset all clears the database, hooks, and config.What if my relay token leaks?
hcom relay off --all to ask all devices to disable the relay; the PSK cannot be revoked, so rebuild with hcom relay new and migrate devices.Which terminal emulators are supported?
hcom kill.Can I isolate state per project?
HCOM_DIR="$PWD/.hcom" to keep state and hooks inside the project folder.