hcom
Hook coding agents together: message, watch, and spawn each other across terminals without changing your workflow.
Security model is well documented: PSK stored with mode 0600, remote RPC refuses relay_psk/token, only a fingerprint is shown; but hooks are written into user config dirs on first run with no explicit consent flow shown, auto_approve can auto-approve hcom commands, and relay membership is all-or-nothing trust (remote spawn/kill is shell-equivalent), so least_privilege, user_confirmation and external_effects are docked.
README, Cargo.toml and pyproject agree on version and license; CI runs with --locked plus a real-tool test matrix. However vt100 is patched to an unpublished rev on a personal fork of an upstream issue still open — a supply-chain and availability risk, so dependency_availability and self_consistency miss full marks.
Broad tool/terminal/OS coverage, per-project isolation via HCOM_DIR; the relay security model's limits (no forward secrecy, no per-device permissions, single trust domain) are exceptionally explicit, earning capability_boundaries a 3; but trigger precision (hook injection, 30s collision window) is only descriptively stated without parameterized evidence.
README is well structured (install, quickstart, security model, troubleshooting, uninstall, CLI/config reference, build); the known-limitations section is unusually thorough and MIT is consistent across three files; but no CHANGELOG file is present in the repo and maintainer identity is just 'aannoo' (unverified), docking versioning_changelog and maintenance_responsibility by 1 each.
Single Rust binary, no background services, ~700-token agent primer — cost discipline is evidenced; output usability is supported by TUI dashboard, hcom status diagnostics and hcom reset; but marginal value versus each CLI's own multi-session features lies mainly in cross-tool interop, and only the claim, not the realized benefit, is evidenced.
Most claims map to concrete commands, config keys or CI steps (real-tool matrix, typecheck, dist-check) and the four manifest files corroborate each other; but CI badge pass status cannot be statically verified, and security claims (encryption, replay guard) lack code-level evidence paths in the provided files, so fact_inference_separation is not full marks.
- A relay join token grants full control of every enrolled device (remote spawn/kill, message injection) and is irrevocable with no expiry — after a leak you must abandon and recreate the relay.
- Hooks are installed into user config dirs on first run; even though they allegedly no-op when unused, inspect the hook contents and keep the hcom hooks remove / hcom reset all rollback paths ready.
- The vt100 dependency is pinned to a fixed rev on a personal fork rather than a published release, with the upstream issue still open — a supply-chain and regression risk.
- With auto_approve enabled, hcom commands skip per-action confirmation; on public brokers, relay metadata (topic names, timing) is visible to network observers.
What does this agent do, and when should you use it?
hcom is a CLI that lets coding agents — Claude Code, Codex, OpenCode, Kilo Code, Pi, Oh My Pi, Antigravity, Cursor CLI, Kimi, Gemini, and Copilot CLI — message, observe, and spawn each other across terminals in any combination. It records agent activity via hooks into a local SQLite database and delivers messages from it, either injected mid-turn or waking idle agents. Each agent gets a queryable identity: name, status, inbox, live terminal screen, transcript, and an event log. It ships as a single Rust binary with no background services, plus a TUI dashboard, MQTT cross-device relay, and bundled workflow scripts like debate and confess. Licensed under MIT and available for macOS, Linux, Termux, WSL, and Windows.
Launch agents in any terminal emulator with hcom claude, hcom codex, etc.; hooks are installed into config dirs under ~/ (or HCOM_DIR) on first run. Activity such as file edits and tool calls is written to SQLite, and other agents receive messages mid-turn or as wake-ups. Commands include hcom send -b @luna -- hey for direct messaging, hcom f for forking sessions, hcom term to view/inject into an agent's PTY, and hcom events --wait for scripted subscriptions. Collision detection is on by default: agents editing the same file within 30 seconds are notified. hcom relay new / connect <token> links agents across machines via an MQTT relay encrypted with XChaCha20-Poly1305. Workflow scripts like hcom run debate are bundled, and ~/.hcom/scripts/ accepts custom scripts. Tools without hooks can join via hcom start or hcom listen.
- A developer running mixed-agent setups who wants Claude Code to review what Codex did and send it fixes
- A pipeline builder who spawns 3x OpenCode agents, splits work, and collects results
- A remote worker connecting agents on home and laptop machines via an encrypted MQTT relay
- A debugger asking an agent to fork itself to investigate a bug and report back
- An automation tinkerer subscribing to events like 'when codex goes idle, send it the next task'
What are this agent's strengths and limitations?
- Tool-agnostic: one messaging fabric connects 11 coding agent CLIs in any combination without changing how you use them
- Single Rust binary with no background services; unused hooks do nothing
- Transparent and auditable: messages flow through a local SQLite DB, with live terminal screens and event logs per agent
- End-to-end encrypted MQTT relay with a thoroughly documented security model and limits
- Hooks modify config dirs under your home directory on first run, changing your local environment
- Relay tokens have no expiry, scope, or revocation; a leaked token is treated as shell access and rotation requires rebuilding the relay
- Message delivery depends on per-tool hooks; unsupported AI tools need manual integration via
hcom listen/hcom start - No forward secrecy — a leaked PSK can decrypt old captured traffic — and no per-device permissions within a relay
How do you install or deploy this agent?
Recommended: brew install aannoo/hcom/hcom. Python: uv tool install hcom or pip install hcom. macOS/Linux/Termux/WSL: curl -fsSL https://github.com/aannoo/hcom/releases/latest/download/hcom-installer.sh | sh. Windows: irm https://github.com/aannoo/hcom/releases/latest/download/hcom-installer.ps1 | iex. Building from source requires Rust 1.88+: git clone https://github.com/aannoo/hcom.git && cd hcom && cargo build. Update existing installs with hcom update.
How do you use this agent?
Terminal 1: hcom claude. Terminal 2: hcom codex. Then prompt normally, e.g. review what claude did and send it fixes or spawn 3x opencode, split work, collect results. Run hcom for the TUI dashboard. Cross-device: run hcom relay new for a token, then hcom relay connect <token> on each device. Configuration lives in ~/.hcom/config.toml; use hcom config <key> <value> or HCOM_DIR for per-project isolation. Run hcom hooks remove before uninstalling.
How does this agent compare with similar options?
Compared to using a single vendor's built-in subagents (e.g., Claude Code's task tool), hcom lets any agent CLI act as another's subagent across terminals without vendor lock-in.
FAQ
What does it cost?
How does it access my agents?
~/ that record activity and deliver messages; hcom reset all clears the database, hooks, and config.What if my relay token leaks?
hcom relay off --all to ask all devices to disable the relay; the PSK cannot be revoked, so rebuild with hcom relay new and migrate devices.Which terminal emulators are supported?
hcom kill.Can I isolate state per project?
HCOM_DIR="$PWD/.hcom" to keep state and hooks inside the project folder.