written in Rust
Simple and mighty coding agent.
One daemon for all your agents: memory, API calls and skills live in one place, and you reach every session from a terminal, a browser or your phone, wherever your code lives. Bring your favorite harness, or use Cookie Agent's own agents, with everything built in and nothing reaching the model unless you ask for it.
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cookie-agent/cookie-agent/releases/latest/download/cookie_agent-installer.sh | shpowershell -ExecutionPolicy Bypass -c "irm https://github.com/cookie-agent/cookie-agent/releases/latest/download/cookie_agent-installer.ps1 | iex"Linux, macOS, and Windows on x86_64 and ARM64. Release archives and nightly builds are in the installation guide.
01 · anywhere
Run it anywhere. Reach it from anything.
Cookie Agent is built as both kinds of agent at once: an always-on agent like Hermes or OpenClaw that keeps running and remembers, and a coding agent like OpenCode or Pi Coding Agent that works in your repositories. One daemon holds your sessions; their tools run in runtimes on this machine, on a server over ssh, or on a box that dials in; and you open the same sessions from a terminal, a browser, or your phone.
- Memory stays in one place. What your agents learn about you, your projects and your machines lives with the daemon, so every session on every machine starts from the same memory.
- API calls happen in one place. Providers, keys, usage and cost live with the daemon; runtimes on other machines never hold your credentials.
- Skills are shared everywhere. Install a skill once and every session on every machine has it, with nothing to copy or keep in sync.
- Point a session at a repository on another machine and the agent reads, edits and runs commands there, while the session stays with the daemon.
- Every client sees every session live: send from the browser, watch in the terminal, and answer an approval from either, phone included.
02 · harness
Use your favorite harness.
Claude Code, Codex, Gemini CLI and other agents that speak the Agent Client Protocol run as Cookie Agent agents. A runtime launches the harness where your code is, and Cookie Agent drives it: its turns, tool calls and plans show up in the same transcript, on every client.
- The harness gets Cookie Agent's tools: shared memory, delegation to other agents, scheduled prompts, and every MCP server you connected.
- Your permission rules decide what it may do, and approvals reach you on whichever client you have open.
- Start a session on it, or let another agent delegate to it like any subagent.
Runs as an agent
- Claude Code
- Codex
- Gemini CLI
- any ACP agent
03 · mighty
Everything a coding agent needs, in the box.
Providers, permissions, delegation, sessions, memory and plugins are built in, not bolted on. One daemon owns them all, on your laptop or on a server, and every client talks to it over a versioned protocol.
- Managed and custom providers, with per-agent model fallback chains and retries.
- Durable sessions with automatic compaction, forks and reverts.
- Plugins, skills and MCP servers extend it without touching the core.
Built in
- providers
- permissions
- agent presets
- delegation
- agent messaging
- durable sessions
- background calls
- compaction
- goal mode
- skills
- plugins
- MCP
- memory
- runtimes
- web client
- usage and cost
04 · small
Nothing in context you didn't ask for.
Your agent document is the system prompt. The engine adds a single line naming the working directory. Everything else that costs tokens is opt-in or switches off.
- Every tool is opt-in. An agent sees only the tools its permissions allow or ask for, and anything unmatched is denied.
- Delegation instructions and the skills listing only appear when the agent may delegate or use skills.
- AGENTS.md loading switches off globally or per agent with
agent_md: false. MCP servers and plugins only exist once you add them.
agents/reviewer.md
---
description: Reviews changes for correctness
mode: subagent
enabled: true
models:
- { model: "openai/gpt-5", variant: null }
permissions:
read: allow
bash:
"git diff*": allow
"*": ask
write: deny
delegate: deny
---
Review the requested change and report
concrete findings.What its model receives
- system promptthe body above
- toolsread, bash
- <working_directory>one line
- write, delegatehidden
- subagent listnot included
- skills listingnot included
- AGENTS.mdroot runs only
05 · presets
Swap the whole team with one preset.
An agent is a Markdown file holding its prompt, models and permissions. Put a set of them in a folder and you have a preset. Switch with /preset in the TUI or --preset on a headless run.
- A preset's agents replace shared ones by name and can add their own. Documents never merge, so what you pick is exactly what runs.
- Each run records its preset, agents and model bindings, so a resumed session replays with the same team.
- Subagents inherit the preset of the run that started them.
Agents in this run
- primaryshared
- reviewershared
- primarypython, replaces shared
- reviewershared
- test-writerpython
- primaryrust, replaces shared
- reviewershared
- unsafe-reviewerrust
06 · delegation
Agents that delegate, and talk to each other.
Any agent can hand work to a subagent in the foreground or the background, nested as deep as you allow. Inside a delegation tree, agents send each other durable mail: parent to child, child to parent, sibling to sibling.
- A running agent reads its mail at the next safe point between model requests. An idle or finished one wakes up to answer.
- The parent controls who can talk. Agents only learn a peer's handle when someone shares it.
- Messaging is permission-gated and denied by default, with hop, inbox and per-pair limits to stop ping-pong.
<agent_message from="reviewer_5e6f7a8b">
The flake is a race between flush and
snapshot. Start in session/store.rs.
[use `send_message(to="reviewer_5e6f7a8b", ...)` to reply]
</agent_message>07 · observable
See everything the model sees.
The system prompt starts as your agent document and grows in a fixed, documented order. Everything added to the context is a durable event with its source attached, readable by any client or plugin. Nothing is slipped in unseen.
- The TUI shows the system prompt, AGENTS.md, loaded skills, plugin-injected messages and compaction checkpoints as expandable rows.
- Token counts, cache hit rates and estimated cost for each session and its whole delegation tree.
- The browser shows the same transcript as the terminal, built from the same events: every tool call, AGENTS.md, skills, plugin messages and compaction checkpoints.
- Failed model calls keep the provider, HTTP status, request ID and response body.
What goes into a run, in order
system promptprimary.md
Your agent's Markdown body, exactly as written. Frontmatter configures the agent and never enters the prompt.
<working_directory>engine
Where relative paths resolve.
<tool_instructions>builtin.delegate
Available subagents:
- reviewer: Reviews changes for correctnessavailable skillsskills
A generated listing of the skills this agent may invoke.
plugin addendumplugin
Anything an agent_before_start plugin appends or replaces, with the prompt fingerprint recomputed.
AGENTS.md./AGENTS.md
Loaded as its own turn with per-file provenance, so editing it never invalidates the cached system prompt.
skill bodiesSKILL.md
Each loaded skill follows as its own turn, recorded when it loads.
compaction checkpointcompaction
Older history is summarized into a recorded checkpoint you can open and read.
Frozen when the run starts, fingerprinted, replayable.
Take a bite.
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/cookie-agent/cookie-agent/releases/latest/download/cookie_agent-installer.sh | shpowershell -ExecutionPolicy Bypass -c "irm https://github.com/cookie-agent/cookie-agent/releases/latest/download/cookie_agent-installer.ps1 | iex"