ljos MCP server

ljos

Tell your coding agent a rule once. It comes back on every prompt it bears on, and the hook refuses the command that breaks it.

Coding agents forget what they learned when the session ends, and they run whatever shell command they pick. ljos fixes both on your own machine. It keeps what you tell the agent in a local store and hands the matching notes back before the model reads each prompt. It checks each shell command against your rules and a built-in list of destructive commands before the command runs. It plugs into the agent through the agent's own hook and MCP settings. Nothing leaves the machine unless you turn on a remote judge.

It works with Claude Code, Codex, Cursor, GitHub Copilot CLI, Gemini CLI, Windsurf, Factory's Droid, Kiro, Cline, Qwen Code, Crush, Grok Build, opencode, omp, hermes and Antigravity's agy.

Five minutes

curl -fsSLO https://github.com/leidarljos/ljos/releases/latest/download/install.sh && sh install.sh
ljos prefer "Tag a release with git push origin TAG; --follow-tags leaves v-tags behind."
ljos rule 'terraform destroy*' --verdict deny --why "Destroy only from the release runbook."

The installer downloads each program from its GitHub release, checks it against the published SHA-256 sum, and builds from source with cargo where a platform has no release. It then runs ljos onboard for every coding agent it finds and shows the guard refusing a force push. Its programs are ljos, packset (memory), vissue (the tracker), deedar (records of work), claimdag (who works on what), ljos-policyd (the command check) and ljos-consensus (voting). --with-embed adds packset-embed, the optional encoder for meaning-based search; without it search matches words, and nothing needs ONNX Runtime. ljos doctor names any part that is missing. --version 0.29.0 installs that ljos release instead of the latest, and --pin packset=0.14.0 holds another repository at a version; a pinned version with no release for the platform builds that version's crate, never a newer one. With the gh CLI signed in, the installer also checks each tarball's GitHub build attestation and prints whether it verified; --attest stops the install when one does not. ljos-hud, the desktop pane, is optional, and the doctor lists it as info. An ljos-policyd built without phronesis checks commands with its table alone, and the doctor marks its policy row warn. Building from source (cargo install, or binstall on a platform with no release tarball) needs Rust 1.89 or newer; rustc --version says which you have, and rustup update stable gets a current one. An older Rust fails on several crates and can leave an ljos-policyd older than 0.3.0 installed without a word, so the doctor marks that row no and names the fix.

Each ljos release attaches the script as install.sh, starting with the first release after 0.28.0. Until that release is out the link is a 404, and the hand install below works. Read the script before you run it; it is scripts/install.sh in this repository. To install by hand:

cargo binstall --locked ljos packset vissue-cli vissue-mcp deedar-cli claimdag-cli ljos-policyd ljos-consensus   # or: cargo install --locked, same list
ljos onboard                                # every coding tool found on this machine: MCP server, hooks and skill
ljos prefer "Tag a release with git push origin TAG; --follow-tags leaves v-tags behind."
ljos rule 'terraform destroy*' --verdict deny --why "Infra teardown is mine to run."

--harness takes claude, codex, grok, cursor, antigravity, opencode, omp, hermes, windsurf, zed, vscode, claude-desktop, gemini, amazonq, kiro, copilot, factory, qwen, crush or cline. Cursor's IDE and its agent CLI share ~/.cursor/mcp.json.

Start a new session and ask for something the preference bears on, such as tagging a release. Before the model reads the prompt, the hook adds:

Shortened. The full README is on GitHub.