008 — Cursor agent gate (CLI)

The agent has a license to run. You have a license to stop it.

Approve every Cursor AI agent shell/MCP/file action from your Android phone, with a 25 s timeout that fails open if the tunnel is down. An Ipenga Consulting product.

Install

npm install -g 008-cli

You'll also need cloudflared on your PATH (or 008 will use the bundled cloudflared npm package if your platform supports it). And you need Cursor.

First run

cd path/to/your-cursor-workspace
agent008 init        # writes .cursor/hooks.json for this workspace
agent008 start       # boots local server + Cloudflare tunnel, prints a QR code

Scan the QR with your Android phone. The PWA installs to your home screen and pairs with this machine. Open a Cursor agent task — every shell or MCP command pings your phone for APPROVE or DENY.

Commands

| Command | What it does | | --- | --- | | agent008 init | Adds agent008 hooks to .cursor/hooks.json in the current directory (idempotent, merges with existing). | | agent008 start | Boots the local WebSocket server on :7891, launches cloudflared, prints a pairing QR code. | | agent008 hook | The hook Cursor calls per hooks.json. Reads stdin JSON, talks to the local server, writes {"permission":"allow"\|"deny"} to stdout. Fail-open on any error. | | agent008 activate <key> | Validates a license key against https://008-license.vercel.app/api/validate and stores it. | | agent008 status | Prints license/trial state, paths, push subscription count. |

Pricing

| Plan | Price | What you get | | --- | --- | --- | | Trial | Free for 14 days | Full Solo features, no credit card | | Solo | $5 / month | 1 device, email support | | Pro | $11 / month | Up to 5 devices, instruction back-channel, history sync, priority support |

Buy at https://008.ipengaconsulting.com

How it works

Cursor agent
  → .cursor/hooks.json
  → agent008 hook
       ↓ ws://localhost:7891
  agent008 start (WS server + cloudflared tunnel)
       ↑ wss://*.trycloudflare.com
  Android phone PWA (008-pwa.vercel.app)
       ↓ approve / deny

The 25 second decision timeout means a dead tunnel never blocks your agent — the hook returns allow and Cursor continues. Your traffic goes through your own Cloudflare Tunnel, not our servers.

Configuration

All state lives in ~/.008/config.json:

| Key | Purpose | | --- | --- | | secret | 16-byte hex shared pairing secret (auto-generated on first run) | | vapid | Web Push VAPID keypair (auto-generated) | | licenseKey, licensePlan, licenseExpires, licenseValid, licenseLastChecked | Set by agent008 activate. Revalidated every 24 h. 7-day offline grace. | | installedAt | First-run timestamp — used to compute 14-day trial expiry | | subscriptions | Web Push subscriptions for connected phones | | tunnel, wsUrl, lastTunnelAt | Last seen tunnel URL |

Environment variable overrides:

| Var | Default | | --- | --- | | PORT_008 | 7891 | | HOOK_WS_URL | ws://localhost:7891 | | HOOK_TIMEOUT_MS | 25000 | | LICENSE_API_URL | https://008-license.vercel.app | | PAIR_HOST | https://008-pwa.vercel.app/pair |

License

MIT. Built by Ipenga Consulting · https://ipengaconsulting.com