What is Ony.ai?

Ony.ai is the on-call layer for AI coding agents. When your agent (Claude Code, OpenAI Codex, or OpenCode) hits a decision it cannot make alone, Ony.ai calls your phone, reads out the situation, and returns your keypad answer to the agent as a signed verdict. You do not have to be at a screen.

The 60-second pitch

You let an agent run a long task and step away. Normally the agent stalls the moment it hits a risky command, a permission prompt, or a multiple-choice question, and it waits until you are back at the keyboard. With Ony.ai wired in, a hook holds that action and raises a handoff: the Ony.ai server classifies the risk, places a real phone call, and reads out what the agent wants to do. You press a key. The verdict comes back signed and bound to that exact action, and the agent proceeds or is blocked.

A phone call reaches you on a walk, a commute, or in a meeting, where every screen-bound approval flow does not. Risk classification keeps the calls rare and worth answering.

Who it is for

Developers who let agents run long or unattended tasks and leave the desk. If you already trust an agent to do the work but want to stay in the loop for the handful of decisions that actually matter, Ony.ai is the layer that reaches you for those and stays silent for everything else.

The core loop

1. The agent pauses. A hook holds the pending tool call before it runs.
2. The server classifies the risk. Ony.ai re-derives the risk from a closed taxonomy; the agent’s own risk hint is never trusted.
3. Your phone rings. Ony.ai reads out the action, or the question and its options, as a phone menu.
4. You decide on the keypad. Press to approve or deny, or pick an option. Never by voice.
5. A signed verdict returns. An HMAC-signed, expiring verdict bound to that specific action reaches the hook, which verifies it.
6. The agent continues (or is blocked), and the whole exchange lands in a tamper-evident audit chain.

See how the gate works for the mechanics behind each step.

What works today

Ony.ai inherits each agent’s own permission surface, so what you get depends on the agent.

Agent	What you get	Status
Claude Code	Full blocking gate. Risky tool calls hold until your phone decision; multiple-choice questions become phone menus; /ony modes control how much gets gated. Wire it with ony init or the marketplace plugin.	Works today
OpenAI Codex	A deny-only hook (ony hooks codex): a phone denial blocks the tool, an approval defers to Codex’s own flow. An app-server bridge and a forwarding proxy additionally route VS Code and desktop-app approvals through Ony.ai with full allow/deny.	Hook: beta, not yet verified against a live Codex CLI. Bridge/proxy: experimental, pinned against codex-cli 0.142.x
OpenCode	Attach to a running opencode serve with ony opencode. Each permission ask is answered by phone, one decision at a time, never a standing grant.	Works today

Call goes unanswered? Optional escalation channels (SMS, Telegram, Slack) can pick it up. SMS is carrier-dependent: US numbers require a 10DLC campaign approval before SMS delivers. See the escalation guide.

Open source and self-hostable

Ony.ai is AGPL-3.0. The repository is the complete open-source product: self-host it with your own domain, telephony provider, models, and database. See self-hosting. A hosted plan lives at ony.ai; the hosted app is currently a waitlist.

Next steps

• Quickstart - install Ony.ai and wire your agent in a couple of minutes, no Docker.
• How the gate works - the inheritance model, fail-closed behavior, and signed verdicts.
• The /ony modes - off, on, away, and how project scope works.