wrt / blog.writ.build
Writ 0.3.0 August 2026 · 5 min read

Use your agent. Record and limit its tool calls

Writ connects to Claude, Codex, Cursor, or OpenCode through the agent's native hook. You keep the agent and its interface. Writ adds a decision point and a record.

One command gives the first result

Run one command for the agent that you already use. You do not need a writ file, model key, or MCP configuration.

# choose one
writ connect claude
writ connect codex
writ connect cursor
writ connect opencode

Writ installs the agent's native user hook. The connection applies in every project for your user account. Start or restart the agent. Then use it as usual.

youyour agent → native hook → Writ decision + record
                                    └── agent runs tool

Install

The installer selects the release for the operating system and processor. It verifies the archive checksum before it installs Writ.

# macOS, Linux, or Windows Git Bash
curl -fsSL https://writ.build/install.sh | sh
# Windows PowerShell
irm https://writ.build/install.ps1 | iex

Three levels of use

basic
Record visible tool calls. Block nothing.
normal
Allow a small tool list. Stop other calls for approval.
advanced
Apply enforceable writ terms to one existing agent session.

Basic: review one run

The default connection records events that the agent sends to its hook. It blocks nothing.

$ writ connect codex
Connected Codex to Writ.
  Built-in tools: limited
  MCP tools: watching
  Remote MCP tools: watching
  Hosted tools: not visible
Scope: global.
Writ now records visible tool calls.
Nothing is blocked.
After a tool call, review what happened:
  writ review

The four coverage lines matter. Claude, Codex, Cursor, and OpenCode expose different hook events. Writ states the boundary instead of claiming calls that the agent did not report.

Normal: add one tool limit

After the record shows what the project uses, allow normalized read and search tools:

writ connect codex --read-only

Or allow exact agent tool names or normalized names:

writ connect codex \
  --allow read \
  --allow search \
  --allow mcp__github__get_issue

A call outside the list stops before execution and creates an approval request.

writ approvals
writ approve <request-id>
# ask the agent to retry

The approval matches the tool name and argument digest. A changed argument needs another decision.

The default limit applies to every project for your user account. Add --project when a connection must apply only to the current project. If both connections exist, the tool call must pass both limits.

writ connect codex --read-only --project
writ connect status codex --project
Connected results come from the agent. Writ can check a reported request before execution. It does not independently prove the effect of the tool.

State stays outside the project

Writ stores its configuration, connections, reusable writs, and project records under ~/.writ. It does not create a project .writ directory. Set WRIT_HOME when the state must use another directory.

~/.writ/
  connections/
  writs/
  projects/<project-id>/record.db

Advanced: apply a writ to one session

Use a writ file when one session needs more exact authority than a tool list. This task lets the agent read source and test files. It also allows one visible web-search tool.

writ: source-review
mandate: "Find the code that controls retry behavior."
grants:
  - read: { paths: ["src/**", "tests/**"] }
  - web_search: {}

Make one complete tool call in the intended session. Then check the file, select that session, and start the writ.

writ check source-review.yaml --explain
writ plan source-review.yaml --agent claude
writ sessions --agent claude
writ start source-review.yaml --agent claude --session <session-id>
writ finish --agent claude
writ review source-review

Writ applies the file only to the selected session. Other sessions keep their normal connection policy. It refuses the activation when the hook cannot enforce an authored clause. writ finish records human satisfaction. writ finish --cancel does not attest satisfaction.

Use writ issue when the task needs the managed model loop. An omitted bound is authored-unbounded. Managed issue adds operational defaults of 25 iterations, $1.00, and 15 minutes.

Do not put secrets in a writ document or placeholder value. Attached activation state stores the bound document.

For teams and record reviewers

A signed organization policy can set a maximum tool list, approval rules, budget ceilings, and redaction fields. Project rules can narrow it. They cannot widen it.

Each stored entry is redacted, linked to the previous entry by a hash, and covered by a signed checkpoint. Normal tool-call entries omit exact provider arguments and store a digest. Exact provider arguments can appear only in an explicit approval request, after redaction. A reviewer can export the record and verify it without the project database. An independent witness can add its own signed observation of the checkpoint root.

Writ also serves an MCP boundary

writ proxy can govern a local MCP command or a remote MCP Streamable HTTP endpoint. Use it when Writ must be the MCP endpoint. writ connect remains the shorter path for the four supported agents.

Remove the connection

writ disconnect codex removes only the Writ-owned user hook. It preserves other hooks and existing records. Add --project to remove a project connection.

Connect first. Review the run. Add only the limit that the project needs.
Connect Claude, Codex, Cursor, or OpenCode
The first connection records visible calls and blocks nothing.
install and connect →