New bots start on Ask. On Full access, a bot stops before messaging anyone new, posting publicly, paying, or deleting outside its folder, unless you have allowed it for that task. On Hermes and other ACP engines, Ask and the stop line cover only what the engine asks Murage about: shell commands and file edits.
The stop line reads what each action touches, not which command spells it. A delete outside the bot’s folder stops, whether it’s rm, a Finder script, a force push, a dropped database table or a delete through a connected app. A payment stops whether it goes through a connected app or a shell call to a payment API.
A first message to someone new stops. A reply in a conversation you already have goes ahead on Auto and Full access. When it can’t tell where an action lands, it stops: a wrong stop costs you one card. A bot reading your keys or saved passwords stops on every level, No limits included.
It’s a classifier, not a sandbox, and it’s table-tested: more than 100 cases in server/stop-line.test.ts, plus tests for real misses we’ve found and fixed.
It judges the permission requests that reach Murage, so what it covers depends on the engine. On Claude Code and Codex, the stop line also covers tools from MCP servers you add. On Hermes and other ACP engines, Ask and the stop line cover only what the engine asks Murage about: Hermes asks before shell commands and file edits, but not before MCP or connected-app tools.
Read server/stop-line.tsSee the test casesHow we test the stop line
On your own
You do each step yourself, so nothing moves while you’re away from the desk.
A chatbot alone
Each app a chatbot can act in has its own permission settings, and you check each one.
With Murage
Requests from the team appear in one place. Read what the bot wants to do, choose Allow once, Allow for this task, Always allow or Deny, then get back to the work.
The brief
“Go through my inbox before I get in. Draft replies in my voice. Send nothing.”
What came back
Twelve emails came in. The team drafted eight replies, set four aside, and left two questions only the owner could answer. Nothing was sent.
Needs from you, in the team’s own report
The agent says done. You go check. The wrong 10% looks exactly like the right 90%. Murage doesn’t promise better answers than the engine underneath. It changes what reaches you: drafts you check instead of messages sent, a source next to each claim in a research page, and a reviewer bot on any team you want one on. New bots start on Ask.
Pick something you know well: the weekly report, a research brief, a set of follow-up drafts. Brief the Chief once and check what comes back against what you asked for. If it isn’t for you, the team’s memory and files are stored on your computer in files you can open, and the code is AGPL-3.0.
See one job from brief to resultWhat carries over when you switchRead the code on GitHub
Start here
A drafted follow-up for every lead that went quiet, ready by Friday.
See the job in detail“Everyone who asked for a demo last month and went quiet: draft a follow-up for each. Short, sound like me, and send nothing.”
Follow-ups, ready to review
Waiting for your approval
Send the first three?
Yes. New bots start on Ask, so on Claude Code and Codex every email waits for your yes. On Auto and Full access, replies in an existing conversation go ahead, and a first message to anyone new still stops. No limits turns the stop line off. On Hermes and other ACP engines, Ask and the stop line cover only what the engine asks Murage about: shell commands and file edits.
A check on every permission request. New bots start on Ask. On Full access, a bot stops before messaging anyone new, posting publicly, paying, or deleting outside its folder, unless you have allowed it for that task. On Hermes and other ACP engines, Ask and the stop line cover only what the engine asks Murage about: shell commands and file edits. It’s code you can read: server/stop-line.ts.
Yes. Ordinary requests can be approved from Telegram, the phone web app or the menu bar. Stop-line cards on Telegram add "Allow for this task".
Download the free app, connect the AI you already pay for, and tell your Chief of Staff what needs doing. Plan on about ten minutes from install to a working team.
No account needed · Runs on the AI plan you already pay for