008 — Cursor agent gate (CLI)
The agent has a license to run. You have a license to stop it.
Approve every Cursor AI agent shell/MCP/file action from your Android phone, with a 25 s timeout that fails open if the tunnel is down. An Ipenga Consulting product.
Install
npm install -g 008-cli
You'll also need cloudflared on your PATH (or 008 will use the bundled cloudflared npm package if your platform supports it). And you need Cursor.
First run
cd path/to/your-cursor-workspace
agent008 init # writes .cursor/hooks.json for this workspace
agent008 start # boots local server + Cloudflare tunnel, prints a QR code
Scan the QR with your Android phone. The PWA installs to your home screen and pairs with this machine. Open a Cursor agent task — every shell or MCP command pings your phone for APPROVE or DENY.
Commands
| Command | What it does |
|---|---|
agent008 init | Adds agent008 hooks to .cursor/hooks.json in the current directory (idempotent, merges with existing). |
agent008 start | Boots the local WebSocket server on :7891, launches cloudflared, prints a pairing QR code. |
agent008 hook | The hook Cursor calls per hooks.json. Reads stdin JSON, talks to the local server, writes {"permission":"allow"|"deny"} to stdout. Fail-open on any error. |
agent008 activate <key> | Validates a license key against https://008-license.vercel.app/api/validate and stores it. |
agent008 status | Prints license/trial state, paths, push subscription count. |
Pricing
| Plan | Price | What you get |
|---|---|---|
| Trial | Free for 14 days | Full Solo features, no credit card |
| Solo | $5 / month | 1 device, email support |
| Pro | $11 / month | Up to 5 devices, instruction back-channel, history sync, priority support |
Buy at https://008.ipengaconsulting.com
How it works
Cursor agent
→ .cursor/hooks.json
→ agent008 hook
↓ ws://localhost:7891
agent008 start (WS server + cloudflared tunnel)
↑ wss://*.trycloudflare.com
Android phone PWA (008-pwa.vercel.app)
↓ approve / deny
The 25 second decision timeout means a dead tunnel never blocks your agent — the hook returns allow and Cursor continues. Your traffic goes through your own Cloudflare Tunnel, not our servers.
Configuration
All state lives in ~/.008/config.json:
| Key | Purpose |
|---|---|
secret | 16-byte hex shared pairing secret (auto-generated on first run) |
vapid | Web Push VAPID keypair (auto-generated) |
licenseKey, licensePlan, licenseExpires, licenseValid, licenseLastChecked | Set by agent008 activate. Revalidated every 24 h. 7-day offline grace. |
installedAt | First-run timestamp — used to compute 14-day trial expiry |
subscriptions | Web Push subscriptions for connected phones |
tunnel, wsUrl, lastTunnelAt | Last seen tunnel URL |
Environment variable overrides:
| Var | Default |
|---|---|
PORT_008 | 7891 |
HOOK_WS_URL | ws://localhost:7891 |
HOOK_TIMEOUT_MS | 25000 |
LICENSE_API_URL | https://008-license.vercel.app |
PAIR_HOST | https://008-pwa.vercel.app/pair |
License
MIT. Built by Ipenga Consulting · https://ipengaconsulting.com