Skip to content
Pagr

Start

Introduction

Pagr is a control plane for coding agents you already run. This page describes the shape of the system, where the trust boundary is drawn, and the things Pagr deliberately does not do.

What Pagr is#

Claude Code and Codex do useful work, and then they stop and wait for you. Usually you are not at the desk. Pagr closes that gap: it connects the agent sessions on your Mac to an iMessage thread, so you can start work, steer it, answer a permission prompt, and hear about the result from wherever you are.

The agents keep running locally, on your machine, under your own Claude and OpenAI accounts. Pagr does not host them, resell them, or proxy their traffic. It coordinates them.

The two halves#

Pagr is deliberately split into two pieces that trust each other as little as possible.

The two halves of Pagr
PieceRunsResponsible for
The bridgeOn your Mac, as a launchd background daemonStarting and steering Claude Code and Codex, holding the project registry, relaying permission prompts, and keeping one outbound connection open
The control planeHosted by PagrReading your messages, deciding which typed command to send, storing sessions and approvals, and texting you back

The bridge — the daemon and the pagr CLI — is open source under Apache-2.0. The half that runs on your computer is the half you can audit.

The trust boundary#

The design assumption is blunt: the network is hostile, and the Pagr cloud could be compromised or coerced. The goal is that even a fully compromised control plane cannot turn the bridge into a remote shell.

That is enforced structurally, not by policy:

  • A closed command set. The cloud can send exactly nine command types, defined as zod schemas in the public repository. There is no shell.exec, no file read, no file write, and no process spawn. See the protocol reference.
  • No paths cross the boundary. Projects are opaque proj_… identifiers that only resolve against ~/.pagr/projects.json on your machine. A command carrying a filesystem path fails schema validation before anything runs.
  • Every command is signed. Ed25519 over a canonical JSON encoding of the command body, bound to your user and this specific device, with an issue time, an expiry, a nonce and an idempotency key.
  • Nothing listens. The bridge never opens a TCP port. It makes one outbound WebSocket over TLS. Its only local endpoint is a Unix socket at ~/.pagr/run/daemon.sock, mode 0600 inside a 0700 directory.
  • Your agent credentials stay put. Pagr drives the unmodified claude and codex binaries. It never sees, stores or transmits your Anthropic or OpenAI credentials.

What Pagr is not#

It is not a remote shell#

You cannot text a command line and have it run. Every action goes through a typed capability and, where it matters, through the agent's own permission prompt and Pagr's risk tiering.

It is not a hosted agent#

Nothing runs in Pagr's cloud on your behalf. If your Mac is asleep, nothing happens until it wakes — commands queue for up to 12 hours and you are told so. See when your Mac is offline.

It is not a Claude or OpenAI reseller#

You bring your own Claude Code and Codex subscriptions. Pagr charges for the control plane only. See billing.

It is not cross-platform, yet#

The bridge is macOS-only. It uses the macOS Keychain for the device key and launchd to stay running. Each account pairs one Mac.

Where to go next#