Run coding agents you don't have to sit and watch
The reason nobody leaves an agent running unattended isn't capability, it's that you can't predict what it'll do at step forty. Incord gives you three layers between the agent and your repo: hard guards it can't cross, a proxy that answers routine decisions using your PRD and roadmap, and your phone for anything destructive.
GET YOUR API KEYThe problem
Current tools give you two options and neither is what you want.
Sit at the keyboard. Most coding assistants assume you're there, approving each step. That works, and it means the agent runs at the speed of your attention.
Or trust it completely. Hand the task off and hope. Fine until it force-pushes, drops a table, or rewrites a config it shouldn't have touched.
Most people want the middle: let it run, but not off a cliff. That middle didn't exist until now.
What you get from the layer
Guards and rules
Hard limits the agent cannot cross, checked before anything executes. Not a prompt instruction it might ignore, an enforcement point.
The proxy
Holds your PRD and roadmap, and answers routine decisions on your behalf up to a severity ceiling you set. It runs on your own CLI and your own auth, so your code doesn't leave your machine to get a decision made about it.
You, on your phone
Anything destructive escalates. Shell access, deletions, force pushes, anything irreversible. The agent stops and waits for your tap, and if your phone is unreachable it keeps waiting rather than proceeding.
Where teams put it to work
Scoped memory, so it knows this project
Memory is partitioned by folder. Code chunks, past chats and tool history for a project live in that project's graph, so an agent working in one repo searches one graph, not all ten you have open.
Watchman, so it doesn't redo work
Every tool call is recorded with its result. When the same call comes back and the answer has been identical every time, Watchman replays it instead of re-executing.
A determinism census
Watchman reports what fraction of your agent's behaviour is repeatable enough to stop paying for, an artifact no other tool produces.
An auditor that argues with the coder
A second model reviews on a cadence you set, and opens a conversation with the coding agent rather than filing a note. The coder can accept a finding or dispute it with recorded reasoning.
Claims that get re-checked
If a file changes after a finding was raised, the auditor re-reviews it, so a fix that didn't hold comes back instead of being marked done. Auto-apply is gated on your build or test command.
Memory that survives a long run
Context auto-saves and hands off cleanly when it compacts, so a four-hour run doesn't lose its state or burn tokens rebuilding what it already knew.
Proxy modes
Switchable at any time. You set the severity ceiling the proxy acts up to, and PIN-gated items always reach you regardless. Start in Recommend and watch it work, then move to Decide when you trust its judgement.
| MODE | BEHAVIOUR |
|---|---|
| Off | Never calls a model. Everything reaches you. |
| Recommend | Reviews and advises. You still decide. |
| Decide | Answers as you, escalates the risky rest. |
Configuration
Set per project, changeable at any time.
| SETTING | WHAT IT CONTROLS |
|---|---|
| Proxy severity ceiling | How much the proxy decides without you |
| Guard rules | Operations that are never permitted |
| Audit cadence | Hourly, every 6h, daily, or end of day |
| Auditor and coder models | Which model reviews, which one fixes |
| Auto-apply | Whether approved fixes land automatically |
| Test command | The build or test that gates an applied fix |
| Settle window | Skip files touched more recently than this |
| Round cap | Maximum auditor-coder exchanges per finding |
What the endpoint gives you
- Unsupervised runs that are actually safe
The escalation ladder, not blind trust
- Fewer tokens per run
Scoped retrieval, tool-call replay and clean handoff
- A second reviewer on every commit
That argues its case and verifies its own fixes
- Screen-free operation
Approve from your phone, over relay to your desktop
- Project isolation
The agent on one repo cannot read another's graph
- Any model
128+ options, OpenAI-shaped, or bring your own
- MCP native
Works with existing MCP clients as-is
Questions teams ask first
- What happens if my phone is unreachable?
- The agent stops and waits. Approval failing closed is the entire point, an escalation that times out is never treated as a yes.
- Can the proxy approve something dangerous?
- No. The proxy operates below a severity ceiling you set, and guard rules sit above it as a hard floor. Destructive operations escalate to you regardless of how the proxy is configured.
- How does the proxy know what to approve?
- It holds your PRD and roadmap in memory, so it's answering scope and design questions against your actual product context rather than guessing.
- Does the auditor just create noise?
- It has to convince the coder, and the coder can dispute a finding with reasoning that gets recorded. Findings neither side settles are flagged for a human rather than auto-applied. The round cap stops a disagreement running forever.
- What if the coder claims a fix that didn't work?
- The auditor re-reviews any file modified after a finding was raised. A claim isn't trusted, it's re-checked.
- Which models can I use?
- 128+ via the OpenAI-compatible endpoint, or your own. Auditor and coder can be different models, a stronger reviewer with a cheaper implementer is a common setup.
- Can it work on multiple projects at once?
- Yes. Each gets its own scoped graph, its own audit config and its own guard rules. They don't see each other.