Security for coding agents. Coding agents for security.
AI writes code faster. IndexQube helps verify what it changes.
A local-first control plane for coding agents. Supervise their work with durable tasks, guarded execution, approvals, and verification evidence. Next, use that foundation to help agents investigate security findings and propose fixes with evidence.
Git snapshots checked against the agent’s reported changes.
03
Checks attached to the task
Commands, output, verification status, and security findings.
Ready for your inspectionReview the diff and check results before accepting the work.
Illustrative evidence summary, not a live session or product screenshot.
One task. A lasting record.Codex + Claude CodeLocal SQLite historyTerminal + browser views
Two sides. One foundation.
Supervise the work. Build toward the fix.
Today, IndexQube keeps agent work controlled and inspectable. The next direction applies that same task history, approval model, and verification to security findings.
Available foundation · Alpha
Security for agents
Give coding agents a clear scope, and keep the evidence of what they do.
Durable tasks and cross-agent handoff
Keep goals, turns, and decisions in local history. Explicitly hand an idle task between Codex and Claude Code with its context and evidence.
Controlled writes and approvals
Grant write access per task. Workspace locks coordinate writers; command and file approval requests wait for a recorded decision.
Git change reconciliation
Compare before-and-after workspace state with agent reports. Track pre-existing changes separately and flag evidence mismatches for attention.
Verification and security findings
After successful write turns, run configured or detected checks. Store output and rule-based security findings with severity and evidence; distinguish passed, failed, and skipped verification.
Planned · Next direction
Agents for security
Help an agent take a finding from investigation to a proposed fix you can review.
Investigate a finding
Trace the relevant code, gather context, and explain the suspected issue with supporting evidence.
Propose a bounded fix
Prepare a patch within an approved task, with a clear explanation of what changes and why.
Rerun the checks
Test the proposed fix and attach the results, including failures or gaps that still need attention.
Present it for human review
Bring the finding, proposed diff, and verification evidence together so a person can decide what to accept.
This dedicated security workflow is planned. Today’s task-scoped audit findings and verification provide the foundation.
Open the durable workspace with iq ui. Start a task, handle its approval requests, then inspect the actual changes and check results.
01 / START
Give the task a home
From your Git repository, open the terminal UI. It starts the local daemon when needed.
cd /path/to/your/repo iq ui
02 / SCOPE
Choose the work
Create an explicit write task on Codex. The goal and turns stay in the local task record.
/new codex write Harden cancellation and add regression tests
03 / DECIDE
Review requests
When an approval is requested, inspect the command or file target. Approve or deny it in the UI.
/approve APPROVAL_ID /deny APPROVAL_ID
04 / INSPECT
Read the evidence
After the turn, inspect changed files, commands, verification, and findings. Review the diff in Git.
/view evidence
After the task · in your repository’s shell
# Leave the UI without cancelling work# Type /detach inside iq ui, then:$ iq tasks
$ iq task show TASK_ID
$ git status --short
$ git diff HEAD
$ iq dashboard
The result is more than a reply.
iq task show exposes the durable task evidence. iq dashboard opens an authenticated browser view of the same workspace.
Review check output, warnings, and skipped checks alongside the diff. Open untracked files listed by Git separately. Agent completion alone does not mean the result is verified.
Replace TASK_ID and APPROVAL_ID with the IDs shown by IndexQube. Slash commands run inside iq ui.
Two entry points today: bare iq launches the normal Claude Code experience through an ephemeral local proxy. Use iq ui for durable tasks, approvals, and evidence.
Continuity belongs to the task
The agent is temporary. The task is not.
A terminal can close. A native session can disappear. IndexQube keeps the goal, conversation, decisions, and evidence in its own local record so the work can be inspected and continued.
That continuity is also the foundation for the planned security workflow: an investigation and its proposed fix should remain understandable after the agent that produced them is gone.
Local-first today: task history lives on your machine. Coding agents use their configured providers; local task storage does not mean offline model execution.
Try the available foundation
Your repo. Your next task.
Install the alpha, check your backend compatibility, and open the durable workspace.
macOS or Linux · Git · an installed, authenticated Codex or Claude Code CLI. Supported versions are checked by iq doctor; see the README requirements.
Install the latest release
curl -fsSL https://github.com/Revanth14/indexqube/releases/latest/download/install.sh | shiq doctor
cd /path/to/your/repo
iq ui