ato-make-agent

ATO — The cockpit where every AI follows your rules

Your AIs already have hands. ATO is the seat you fly them from. Set the rules. Watch every tool call. Kill the runaway. Compare what each one actually did to your code. Multi-runtime. Local-first. MIT.

$ ato review --reviewer claude --reviewer codex --reviewer gemini --against main
# illustrative output — your numbers (cost, duration, tool calls) will vary by runtime, model, and diff size

review session 7F3A1B6E · 3 reviewers · your rules: read-only, repo-scoped, killable

  CLAUDE     🔧 verified via 4 tool calls
             flagged 2 issues — XSS in src/render.ts:142, auth bypass in api/login.ts:87
             read_file ×3 · grep ×1 · 6.4s · $0.024 · 0 files written (read-only mode)

  CODEX      🔧 verified via 6 tool calls
             flagged 3 issues incl. SQL injection in db/queries.ts:64
             ← caught one claude missed by grep'ing for raw string concatenation
             read_file ×4 · grep ×2 · 7.1s · $0.004 · 0 files written

  GEMINI     ⚠️ prompt-only — didn't open the code
             flagged 2 issues from the diff alone (XSS×2, CSRF)
             5.9s · $0.001 · 0 tool calls · downweight in synthesis

  closer:    4 unique findings, 1 disputed.
             tags: security, sql-injection. cost: $0.029 total.
             every tool call, every byte read, archived to ~/.ato/local.db
             paste-ready transcript at .ato/reviews/7F3A1B6E.md

Three AIs all could have walked the code. You see which ones did, and which one just replied. That's the cockpit.

---

In 30 seconds

# macOS
brew install willnigri/ato/ato && ato demo-war-room

# Linux
curl -fsSL https://agentictool.ai/install.sh | sh && ato demo-war-room

# Desktop app (macOS · Windows · Linux)

Download → (Tauri 2.x · MIT)

demo-war-room runs without API keys — picks your configured runtimes, falls back to Ollama. First receipt in 30 seconds.

---

Research (open multi-model coding benchmark)

Finding: higher floor, lower ceiling. We ran nine single models and nine coordination recipes on 49 contamination-audited LiveCodeBench coding tasks (execution-graded, metered receipts). Multi-model coordination did not beat the best single model. It lifted weak models (~+9 problems) and capped peaks (war rooms can lose to their own best member). Cascades were limited by the verifier gate, not the strong closer. Full write-up, draft paper, and re-run path:

Practical takeaway: coordinate when you cannot pick/afford the best model; route to one model when you can. ATO’s job is that decision with receipts, per task — not “always run five models.”

---

What's new on main (unreleased)

• The open-box router. ato bench run (verifiable sandboxed code-exec grading of pinned LiveCodeBench slices, contamination-clean headlines, reproducibility hashes) + ato route explain (transparent advisory over YOUR local receipts) + --cascade coordination benchmarks. See The open-box router.

What's new in v2.18.0

• Real-time team participation — now bidirectional. Share any war-room, session, or chat into a team workspace and teammates see a live rich card (title, summary, tags, runtime badges, 👥 TEAM badge, member avatars) the moment it lands. Append a turn from the UI or CLI and every member's machine updates instantly — no refresh, both directions (HTTP append + Postgres NOTIFY + WebSocket push). Previously team shares were read-only snapshots. CLI: ato war-rooms share <id> --team <slug>, ato sessions share, ato chats share; append a turn live with ato war-rooms append-event <id> --team <slug> --kind <kind> --json <payload>. Requires Team tier + ato login on the prod app binary. Close summaries now prefer your Claude Code subscription (no API key billing): ato war-rooms close <id> --coordinator claude.
• Browse your team workspaces from any browser. Sign in to your cloud account on the web — every shared session, war-room, chat, loop, and mission renders with the same fidelity as the desktop. Mobile-responsive.
• Pair your browser to your desktop. v2.17 tether: X25519 DH + AEAD, fingerprint-verified pairing. Your laptop becomes a secure oracle for the page you're looking at — no plaintext through the cloud relay.
• Create + manage teams from the web. New "+ New team", invite by email, role changes, danger-zone delete. Account page with profile + plan + sign-out. (LLM keys, runtimes, and skills still live in the desktop where the OS keychain is.)
• ato war-rooms sweep — auto-closes idle war-rooms with a coordinator-summary, single-JSON envelope output, clap-layer validators. Wire to cron and one-shot R1 reviews self-close.
• ato subagent log — Claude Code's Agent (Task) tool dispatches now show up in execution_logs alongside outer-session work. Canonical auth_mode / billing_surface vocab so analytics group cleanly. Git commit SHA captured per receipt.
• Web sign-in + Onboarding redesigned. Minimal centered sign-in card. Onboarding walks users through install / .env / wrap-the-client with explanations of why each step matters.
• Deprecated Google models auto-filtered from the chat picker (no more gemini-2.0-flash-001 404s).
• See CHANGELOG.md for the full list.

---

Why ATO

Claude Code, Codex, Gemini CLI already come with tools. They can grep your repo, read your files, run your tests, edit code. That's the default now — chat is a commodity and so are hands.

What you can't do without a cockpit:

• Set rules across every runtime at once. Read-only here. No network there. Repo-scoped everywhere. ATO speaks the permission flag each runtime understands (--allowedTools for Claude, the equivalent for Codex / Gemini) so one config governs them all.
• Watch every tool call. Per-dispatch receipts: prompt, runtime, model, every read_file / grep / git_log with arguments, every byte returned, files written via mtime-snapshot diff. Verified-via-N-tool-calls vs prompt-only badges per seat so you know which findings were checked against the code and which are vibes.
• Compare what each AI actually did. Side-by-side replay across runtimes. File attribution per dispatch. "Claude touched 3 files, Codex touched 5 — these two diverge here."
• Kill a runaway. Live runs registry, one-click kill, across every runtime.
• Bring API models in as full teammates. Claude Code, Codex, Gemini CLI, Hermes, and OpenClaw already have hands — they ship with their own coding tool layer. The runtimes that don't are API providers without a first-party coding agent — Grok, MiniMax, DeepSeek, Qwen, GLM, Yi, Kimi — they hit a prompt-in, text-out endpoint with no built-in read_file / grep / bash. ATO wraps them with the same tool loop the CLI runtimes use, so a Grok or DeepSeek call can review code alongside Claude Code under identical rules + receipts. One war room, every seat with hands.

All of it local. AES-256 at rest,