A
ashlrai/locus
Identity plane for coding agents: wrong account, impossible
View on GitHub ↗Link checked 2026-11-12 · HTTP 200 · opens the vendor's own site
Official descriptionIdentity plane for coding agents: wrong account, impossible. Multi-account MCP/CLI bindings so agents never act in the wrong tenant. Works with Phantom: phm.dev
Install & config
Client config (built from the install command this repo gives)
{
"mcpServers": {
"ashlrai-locus": {
"command": "npx",
"args": ["locus-cli"]
}
}
}Parsed from the README we fetched on 2026-11-04; we have not executed it.
command/args come from the install command the repository states. When it is ambiguous, the project README wins.
VS Code (.vscode/mcp.json - the key is servers)
{
"servers": {
"ashlrai-locus": {
"command": "npx",
"args": ["locus-cli"]
}
}
}Same server, but VS Code keeps it under <code>servers</code>.
Claude Code (command line)
claude mcp add --transport stdio ashlrai-locus -- npx locus-cli
Claude Code does not read a config file; add the server with this command.
Key names differ by client: Clients & CLI
- Star count
- 3 ★ · ashlrai/locus · read from the GitHub search API · (checked 2026-11-13 20:00:50)
- Source
- read directly from its GitHub page · type: open-source project
- Harvest history
- first seen 2026-11-05 · last seen 2026-11-14 · seen 10× · listed by 1 sources
- Score
- score 103 · 3 ★ · 1 sources · repo
- Install
npx locus-cli
FAQ (answers come from our records)
How do I install it?
The repository provides this install command:
npx locus-cli. It comes from the repository itself; we cannot guarantee it runs as-is in your client.Who is it for?
We filed it under these tags: 开源项目. The tags come from the entry itself, not a taxonomy we imposed.
Who maintains it?
repository
ashlrai/locus；first catalogued 2026-11-05；last seen 2026-11-14。There is no official certification or quality rating here — we record sources and dates only.# Locus
以下摘录自该仓库的 README（片段） · 在 GitHub 读完整 README →
Your coding agent can't act as the wrong account.
Locus is the identity plane for coding agents. You pin one client. After that, the CLI, the MCP tools, and the local dashboard act only as that client until a person pins again.
That matters on a machine with more than one client. Ambient gh auth, a shared Supabase token, or the last Vercel team can send an agent to the wrong account. A pin makes the other account unavailable.
Agents are first-class users. Start with the commands below. Machine indexes: llms.txt, llms-full.txt, and the agent contract.
For agents ·
30-second start ·
How it works ·
Install ·
FAQ ·
Star
Latest release: v0.6.2 (2026-11-01).
npm package READMEs use version-neutral installation commands to avoid stale pinned releases.
## For agents
One command installs both binaries:
bash
npm install -g locus-cli @ashlrai/locus-mcp
Homebrew and Cargo are in Install options. At the v0.6.2 release, the live Homebrew tap installs v0.6.1, so use npm for v0.6.2.
Read state as JSON. The first key is schema. Failures on stderr use locus.error.v1. No command prints a secret.
bash
locus whoami --json
locus status --json
locus doctor --json
locus version --json
locus topic agent-contract --json
locus doctor --json can exit 0 while verdict is WARN and ok is false. Exit 0 means the findings are setup advice, not that setup is finished.
Print the MCP entries without writing a client config:
bash
locus setup --client claude --print
locus setup --client cursor --print
locus setup --client codex --print
Those entries launch locus-mcp and serve control tools only. For the pinned binding's provider tools, paste the supervised server below. Launch the client from the shell that ran locus hook and locus enter. Restart the client after a re-pin. Agents cannot pin. Ask a person.
Claude Code (.mcp.json) and Cursor (~/.cursor/mcp.json):
json
{ "mcpServers": { "locus": { "command": "locus", "args": ["mcp", "--supervised"] } } }
Codex (~/.codex/config.toml):
toml
[mcpservers.locus]
command = "locus"
args = ["mcp", "--supervised"]
Same paste, by hand, if the client CLIs are installed:
bash
claude mcp add locus -- locus mcp --supervised
codex mcp add locus -- locus mcp --supervised
More copy-paste blocks: docs/copy-paste.md. Rules for agents in this repo: AGENTS.md.
## 30-second start
Run this in one shell. It creates sample bindings, pins personal, and checks that acme is refused. LOCUSHOME keeps the trial off your real ~/.locus.
bash
export LOCUSHOME="$(mktemp -d)" # omit this line to use ~/.locus
npm install -g locus-cli @ashlrai/locus-mcp # or brew or cargo; see Install options
locus quickstart # sample bindings, pin, whoami, doctor
eval "$(locus hook zsh)" # or bash; exports the control capability
locus enter personal # pin from this shell (it supervises the pin)
locus whoami # who your agents are acting as, right now
locus exec --expect personal --no-resolve -- echo ok # runs: personal is pinned
locus exec --expect acme -- echo ok # refused, exit 1, child never starts (pinmismatch)
The echo check uses --no-resolve because it needs no credentials. quickstart does not replace bindings you already have. --no-resolve refuses bindings whose upstreams resolve credentials. For real provider work, supply credentials outside the agent and replace the sample scopes. See the sample exec walkthrough.
Locus is the identity plane for coding agents. You pin one client. After that, the CLI, the MCP tools, and the local dashboard act only as that client until a person pins again.
That matters on a machine with more than one client. Ambient gh auth, a shared Supabase token, or the last Vercel team can send an agent to the wrong account. A pin makes the other account unavailable.
Agents are first-class users. Start with the commands below. Machine indexes: llms.txt, llms-full.txt, and the agent contract.
For agents ·
30-second start ·
How it works ·
Install ·
FAQ ·
Star
Latest release: v0.6.2 (2026-11-01).
npm package READMEs use version-neutral installation commands to avoid stale pinned releases.
## For agents
One command installs both binaries:
bash
npm install -g locus-cli @ashlrai/locus-mcp
Homebrew and Cargo are in Install options. At the v0.6.2 release, the live Homebrew tap installs v0.6.1, so use npm for v0.6.2.
Read state as JSON. The first key is schema. Failures on stderr use locus.error.v1. No command prints a secret.
bash
locus whoami --json
locus status --json
locus doctor --json
locus version --json
locus topic agent-contract --json
locus doctor --json can exit 0 while verdict is WARN and ok is false. Exit 0 means the findings are setup advice, not that setup is finished.
Print the MCP entries without writing a client config:
bash
locus setup --client claude --print
locus setup --client cursor --print
locus setup --client codex --print
Those entries launch locus-mcp and serve control tools only. For the pinned binding's provider tools, paste the supervised server below. Launch the client from the shell that ran locus hook and locus enter. Restart the client after a re-pin. Agents cannot pin. Ask a person.
Claude Code (.mcp.json) and Cursor (~/.cursor/mcp.json):
json
{ "mcpServers": { "locus": { "command": "locus", "args": ["mcp", "--supervised"] } } }
Codex (~/.codex/config.toml):
toml
[mcpservers.locus]
command = "locus"
args = ["mcp", "--supervised"]
Same paste, by hand, if the client CLIs are installed:
bash
claude mcp add locus -- locus mcp --supervised
codex mcp add locus -- locus mcp --supervised
More copy-paste blocks: docs/copy-paste.md. Rules for agents in this repo: AGENTS.md.
## 30-second start
Run this in one shell. It creates sample bindings, pins personal, and checks that acme is refused. LOCUSHOME keeps the trial off your real ~/.locus.
bash
export LOCUSHOME="$(mktemp -d)" # omit this line to use ~/.locus
npm install -g locus-cli @ashlrai/locus-mcp # or brew or cargo; see Install options
locus quickstart # sample bindings, pin, whoami, doctor
eval "$(locus hook zsh)" # or bash; exports the control capability
locus enter personal # pin from this shell (it supervises the pin)
locus whoami # who your agents are acting as, right now
locus exec --expect personal --no-resolve -- echo ok # runs: personal is pinned
locus exec --expect acme -- echo ok # refused, exit 1, child never starts (pinmismatch)
The echo check uses --no-resolve because it needs no credentials. quickstart does not replace bindings you already have. --no-resolve refuses bindings whose upstreams resolve credentials. For real provider work, supply credentials outside the agent and replace the sample scopes. See the sample exec walkthrough.
Listed badge (optional)
Copy this line into the README if you want the listing mark. Optional, and it does not affect being listed.
[](https://anclum.com/en/s/ashlrai-locus/)
- Source
- github · https://github.com/ashlrai/locus
- Browse by field
- Open source
- Traction
- 3 ★
- added
- today
More like this
Filed under
Every tag opens the full list for that filter. Counts are the live catalogue figures.