@roxy-agent/agents

An MCP server that proxies all agent actions — bash, filesystem, network — through a sub-millisecond risk classifier and an audit log. Comes with a dashboard you can open in your terminal or in any browser at roxy-agent-web.vercel.app.

Quick start

Add this to your MCP config (~/.cursor/mcp.json for Cursor, ~/Library/Application Support/Claude/claude_desktop_config.json for Claude Desktop, the equivalent for Codex):

{
  "mcpServers": {
    "agent-proxy": {
      "command": "npx",
      "args": ["-y", "@roxy-agent/agents"]
    }
  }
}

Reload MCP servers (or restart the host). On first launch npx downloads the package and:

1. Creates an audit DB at ~/.agent-proxy/audit.db.

2. Starts a local dashboard at localhost:4242.

3. Begins streaming each tool call (metadata only, by default) to the hosted dashboard.

4. Prints a one-time pairing URL like:

   [agent-proxy] ──────────────────────────────────────────────
   [agent-proxy]  Sign in to view this proxy's audit log online:
   [agent-proxy]    https://roxy-agent-web.vercel.app/pair?code=W79M-5BVD
   [agent-proxy]  (Pairing code: W79M-5BVD — valid 10 minutes.)
   [agent-proxy] ──────────────────────────────────────────────

   Open it. The page asks you to sign in (or create an account), then "Link this device" attaches the running proxy to your account. The proxy detects the link within ~3 seconds and from then on uploads under your user id.

5. Visit roxy-agent-web.vercel.app/dashboard. Once signed in, it shows events from all devices you've paired — codex on your laptop, claude on your desktop, etc.

If you skip pairing, the proxy still uploads under an anonymous device id; you can view that device's data by clicking the local dashboard's "Open hosted view" link, which sets a per-device cookie.

Privacy / what gets uploaded

Cloud sync sends metadata only by default:

• Tool name + action type (e.g. bash.execute)
• Risk level, decision, reason
• A 240-character truncation of the command / path / URL the dashboard already shows
• Timestamps, durations, error strings (truncated)

It does not send full stdout/stderr, file contents, or response bodies unless you set AGENT_PROXY_CLOUD_PAYLOADS=full. To disable cloud sync entirely:

AGENT_PROXY_CLOUD_SYNC=0 npx -y @roxy-agent/agents

(or set it as an env value in your MCP config block).

Environment variables

Run from source (for local development)

git clone https://github.com/dwang88/agent-proxy
cd agent-proxy
npm install
npm run build
npm run dev   # tsx src/index.ts

Then point your MCP config at node /path/to/agent-proxy/dist/index.js instead of npx -y @roxy-agent/agents.

Self-hosting the dashboard

The hosted dashboard lives in web/ and is a vanilla Next.js app deployed to Vercel. To run your own:

cd web
npm install
npm run bundle      # copies dashboard JS/CSS from ../src/dashboard
DATABASE_URL=postgres://... npm run dev

Set AGENT_PROXY_CLOUD_URL on every machine running the local proxy to point at your deployment.