One command gives the first result
Run one command for the agent that you already use. You do not need a writ file, model key, or MCP configuration.
Writ installs the agent's native user hook. The connection applies in every project for your user account. Start or restart the agent. Then use it as usual.
Install
The installer selects the release for the operating system and processor. It verifies the archive checksum before it installs Writ.
Three levels of use
Basic: review one run
The default connection records events that the agent sends to its hook. It blocks nothing.
The four coverage lines matter. Claude, Codex, Cursor, and OpenCode expose different hook events. Writ states the boundary instead of claiming calls that the agent did not report.
Normal: add one tool limit
After the record shows what the project uses, allow normalized read and search tools:
Or allow exact agent tool names or normalized names:
A call outside the list stops before execution and creates an approval request.
The approval matches the tool name and argument digest. A changed argument needs another decision.
The default limit applies to every project for your user account. Add --project when a connection must apply only to the current project. If both connections exist, the tool call must pass both limits.
State stays outside the project
Writ stores its configuration, connections, reusable writs, and project records under ~/.writ. It does not create a project .writ directory. Set WRIT_HOME when the state must use another directory.
Advanced: apply a writ to one session
Use a writ file when one session needs more exact authority than a tool list. This task lets the agent read source and test files. It also allows one visible web-search tool.
Make one complete tool call in the intended session. Then check the file, select that session, and start the writ.
Writ applies the file only to the selected session. Other sessions keep their normal connection policy. It refuses the activation when the hook cannot enforce an authored clause. writ finish records human satisfaction. writ finish --cancel does not attest satisfaction.
Use writ issue when the task needs the managed model loop. An omitted bound is authored-unbounded. Managed issue adds operational defaults of 25 iterations, $1.00, and 15 minutes.
Do not put secrets in a writ document or placeholder value. Attached activation state stores the bound document.
For teams and record reviewers
A signed organization policy can set a maximum tool list, approval rules, budget ceilings, and redaction fields. Project rules can narrow it. They cannot widen it.
Each stored entry is redacted, linked to the previous entry by a hash, and covered by a signed checkpoint. Normal tool-call entries omit exact provider arguments and store a digest. Exact provider arguments can appear only in an explicit approval request, after redaction. A reviewer can export the record and verify it without the project database. An independent witness can add its own signed observation of the checkpoint root.
Writ also serves an MCP boundary
writ proxy can govern a local MCP command or a remote MCP Streamable HTTP endpoint. Use it when Writ must be the MCP endpoint. writ connect remains the shorter path for the four supported agents.
Remove the connection
writ disconnect codex removes only the Writ-owned user hook. It preserves other hooks and existing records. Add --project to remove a project connection.