Run a whole team of coding agents like one product
See every agent at a glance. Give them work, answer their questions, read their
diffs, review what they built, and ship it - from one screen, on your own machine.
work in progressscreenshots from a live demo fleet
One agent is easy to watch. Five are not. Mission Control gives a fleet of
Claude Code, Codex and Pi sessions a single control room: a board that tells you who needs you,
a backlog that feeds them work, an autonomous operator that handles the routine interruptions,
a review system that decides what "done" means, a merge gate for what lands without you, and a
memory so the next agent does not repeat the last one's mistake. When a whole SDLC engine is
driving the work instead, it watches that too.
01The board
One column per state, so "what is my fleet doing" is a glance, not an investigation.
Agents are grouped by what they need from you: Needs you, Working, Idle. The backlog sits in front of them, the strip along the top folds the whole fleet into six stages, and a column with nothing in it is tucked into the right-hand rail rather than taking up space. On the right, two reviews at once: one has passed and says so, and the other is running right now - No-Mistakes Review v12, stage 1 of 5, repair round 1 of 5 - with its session collected under Held by a workflow, which explains in words why nobody needs to touch it.
Needs you comes first. A card is amber only when a person has to act. When
nothing is waiting, the column says All clear out loud instead of leaving you to infer it.
Every card answers "what is this for?" - a one-line goal written from your own
prompts, the tool it is running right now, how far its review has got, its branch, its model, its
cost so far, and how much context it has left. You choose which of those it draws, with a live
preview card beside the checklist - except the flags that ask for you, which cannot be switched
off, because no setting should make a session that needs you look like one that does not.
Cards group under the repository they belong to, so a fleet spread over four
checkouts reads as four teams rather than one queue.
Drag a backlog item onto a free agent to hand it over. If that agent is not
actually free, the board says so rather than quietly resetting it.
Fully keyboard-driven. Arrow keys move, Enter opens,
Esc backs out one layer at a time, / filters - by name, by repository, or by
pull request number - and every button prints its own shortcut.
You get told when something needs you
One inbox for everything blocking: questions you can answer without leaving it, agents parked on a menu, decisions waiting on you, pipelines an outside engine halted, and work that has got stuck.
Notifications fire the moment an agent starts waiting - not repeatedly while it waits. Turn on
Away mode and Mission Control holds everything back and hands you one digest when
you return, except for genuinely stuck agents, which always get through. A one-key
Sitrep gives you the whole fleet as a readable summary.
It also runs as a real macOS app rather than a browser tab, which is what makes that promise
keepable: the window can be closed and the alerts still arrive. It installs from your own machine,
keeps itself current from releases, and will hold the Mac awake with the screen dark while agents
work.
02Every agent's desk
Click any card and you get the conversation, the change, and the files - plus every
control you need to steer it.
An agent that needs an answer puts the question at the top, where you cannot miss it - and you answer it right here. Underneath, three follow-ups you already typed sit queued, waiting their turn until the question is settled.
Conversation
Read the session as a terminal stream or as a chat log. Your messages, the agent's, and
Foreman's are colour-coded, tool activity is folded into a single line you can expand, and a side
rail indexes either every tool the agent ran or just your own messages - useful, because most of a
transcript is not you.
Type to any agent, any time. Messages queue up visibly, and you can edit or
reorder them before they land. ↑ recalls the last one.
Answer questions in place - single choice, multi-select, permission prompts,
folder-trust checks. If Mission Control cannot be sure a message was delivered, it tells you and
offers to retry rather than assuming.
Change its posture on the fly - ask-me-first, accept edits, plan mode,
read-only - and interrupt a turn with one key.
Drop in screenshots and images straight into the composer, and read the
agent's own HTML - a report, a plan - rendered in the conversation instead of as a path you have
to go and find.
A live turn, mid-flight: the agent is working, the tool rail is filling up, and you can queue the next instruction without interrupting it.
Diff
The change, stated in words before you read a line of it - 3 files, +68. Files list on the left with per-file counts, patch on the right, and one key jumps from any file into the editor.
The diff shows what this agent changed - not everything that has happened on the main
branch since it started. If a file cannot be opened for editing, the row says why instead of
failing silently.
Files
Browse and edit the agent's working copy yourself. Preview and the editor each have their own key, Markdown and diagrams preview in place, ⌘F finds inside either one, any file can pop out into its own window, and if a file changed underneath you, you are offered a comparison rather than a silent overwrite.
You can also review a file the way you would review a pull request: leave a comment on a line,
then walk the agent through your comments one at a time - one per turn, and the next only once it
has finished with the one before. Its answer lands in that comment's thread, on that line, and the
tab raises a count of answers nobody has read yet.
Review progress
The review the agent's work has to pass, stage by stage, with each reviewer's verdict. Note the honesty: a gate that could not run says Skipped and explains why - a pass that did not actually happen never pretends otherwise.
A terminal in the agent's own working copy is one click away, in whichever terminal app you
actually use - WezTerm, Ghostty, iTerm2, tmux - and the ones that are not installed are listed with
the reason, not hidden.
03Dispatch & task types
Describe the work, pick who does it, and it starts - in its own isolated copy of the
repo, so agents never trip over each other.
Four questions - which repo, what kind of work, which agent, and what happens afterwards - over the full form, which fills in as you answer. Repositories are listed by their directory name rather than by a column of paths that all begin the same way. Every step is typeable; ⌘↵ launches.
Guided or straight to the form. The guided pass is four keystrokes; skip it
whenever you already know what you want.
Send it now or shelve it. The same form adds to the backlog, and clicking a
shelved item reopens it for editing.
Attach more than one repo. A change that spans services stays one agent and
one conversation - a worktree per repository, one pull request per repository it actually changed,
and a full review run per changed repository, each spending its own repair budget so a finding in
one never holds up a sibling's merge. The task is done when every one of them has merged.
Nothing is claimed until it is true. If an agent cannot be confirmed as
started, the dispatch fails - it is never reported as running when it is not.
Five kinds of work
Ship
Deliver a change and open a pull request. The default, and the
only kind that gets a review workflow attached.
Scout
Answer a question. You get one self-contained report page,
filed in a searchable library - no code change, nothing to review.
Plan
Produce a plan you actually review, then have it broken into
properly ordered follow-up tasks automatically.
Pipeline
Hand the work to an external SDLC engine and watch it from
the same board as everything else. Section 10.
Chat
Just talk to an agent. No deliverable, no ceremony.
04Standing instructions
The things you would otherwise re-type into every agent you point at a repository.
One box per repository, in your own words. Underneath each rule is its reach: which sessions get the text, by which mechanism, and - just as important - which ones do not.
Every repository has a handful of rules that are not in its README and are not worth a pull
request. Integration tests need Postgres up first. Never edit the generated client. This
service owns the public API, so a route rename is a breaking change. Write them once here and
the next agent dispatched into that checkout already knows.
Per repository, and only your machine
AGENTS.md is
committed, so it reaches every teammate on every machine. This does not leave your laptop -
nothing is written to your home directory and nothing is pushed to GitHub.
The longest match wins
A machine-wide Every repository box
covers the checkouts with no rule of their own, and a monorepo package's rule beats the
monorepo's. An empty box is not the same as no box: it means send nothing here.
It states its own reach
Per harness and runtime: a system prompt on
Claude, developer instructions on an embedded Codex, turn-one prose where a harness has no channel
of its own. And what it does not reach - sessions you started outside Mission Control, and its own
Foreman and reviewer prompts.
Honest about timing
A live process's system prompt cannot be
rewritten, so an edit reaches the next session, not the five already open. A running
session's header carries a chip showing what that session was actually given at launch.
05Scouts & the archive
Not every question needs a code change. Send a scout and you get an answer you can
keep.
Half of what a team asks an agent is not "build this" - it is why is this slow, where
did this behaviour come from, which of these three approaches is least risky. A
scout is that job. It investigates, and instead of a branch and a pull request you
get one page that answers the question - filed, searchable, and still readable long after the work
is gone.
Choosing scout when you dispatch. The picker says what each kind produces, and scout is explicit that there is no diff - so no review is attached, and none is expected.
What a scout gives you
The answer first
A scout's page leads with the finding, then the
evidence behind it, then what it could not establish. You should not have to read to the bottom to
learn what it concluded.
One page, no dependencies
Self-contained and static. It opens in any
browser with no network, no server and nothing installed - so it can be mailed, archived, or read
in three years.
Its working kept beside it
Logs, spreadsheets, screenshots - whatever
the scout leaned on is captured alongside the page and listed with it, rather than left in a branch
that gets deleted.
It cannot quietly fail
A scout is not finished until its page exists
and can actually be opened. No report, no completion.
The archive
The Scouts archive. Search across every report's title, its findings, its files and the original request; results are grouped by day. The reader shows the report itself, and the rail on the right lists every piece of evidence it came with, down to the file you can still open. Each entry states whether everything was captured - Complete, or partial with the reason.
Everything is searchable, including the question. You can find a report by what
it concluded, by the file it examined, or by what you originally asked.
Reports outlive their work. The branch, the agent and the task are all
temporary. Deleting any of them never deletes the report.
They are just files. Portable, openable outside Mission Control, and honest
about their own gaps - a report missing part of its evidence says so instead of looking complete.
Plans land here too, so the reasoning behind a piece of work stays available
after the work ships.
This guide is a scout report. One page, every screenshot embedded in it,
no network needed - which is why you can read it at all.
06Backlog & sources
Everything that should happen but has not started yet - fed by the tools where you
already wrote it down.
The backlog counts the three things you care about: ready, blocked, parked. A blocked row names what it is waiting for, in words. The footer is unambiguous about whether anything will start on its own.
Order it how you like - priority, labels, and a hold switch that keeps an item
on the list but off the launch pad.
Chain work together. Say one task depends on another and it waits until the
first one's pull request has actually merged.
Or let it run itself. Turn on autopilot and Mission Control works down the
list one item at a time, reusing agents that are genuinely free, never exceeding the number of
agents you allow.
Work arrives on its own
Point Mission Control at a GitHub issue filter or a Jira search and it sweeps them into the backlog on a schedule. It is deliberately one-directional: it files items and does nothing else - it never launches an agent behind your back.
A sweep's rows arrive parked, with autopilot switched off for them, so what a
tracker hands you is a list you triage rather than work that starts dispatching before you have read
a title. Enabling a row is you saying yes to that row - and a source whose upstream you already
curate can be set to file ready-to-schedule tasks instead. Agents can file follow-up work
themselves, a finished retrospective can queue its own task, and a shelved idea can be pushed out to
GitHub as an issue when it belongs in the open.
Recurring missions
Anything you would otherwise remember to do - a nightly dependency audit, a weekly flake sweep - becomes a mission on a schedule. It files the task and stops; a human or autopilot still decides when it runs.
Missed runs are handled honestly: if the machine was asleep, the schedule says so and accounts
for the run once, rather than pretending it happened on time.
07Foreman
An optional operator that handles the interruptions you would have handled anyway -
and escalates the ones only you can decide.
Foreman's set-once configuration, and the record of what it has decided. What it may do - how much rope it has, which repositories it may act in, what counts as "finished" - lives here; turning it on, its mode and its work queues live in the topbar control beside the fleet. It is off until you say otherwise, and it says so.
Most of what a fleet asks you is routine: may I read this file, is this the right
directory, shall I run the tests. Foreman reads what each blocked agent is actually
asking, answers the routine calls, and turns the real forks into a short brief with a
recommendation - so the only things that reach you are the things worth your attention.
It reads the screen, not just the log
An agent parked on a menu has not
written that question down anywhere yet. Foreman looks at what is actually on screen - which is
also the only way to answer a menu correctly.
Three levels of trust
Draft only - it writes what it would say
and sends nothing. One-click send - you approve each answer. Live - it answers on your
behalf, in the repositories you named and nowhere else.
Per-agent consent
Foreman touches only the sessions you invited it
into. Withdraw the invite and it stops - no purpose notes, no answers, no queue.
It never guesses on the risky ones
Anything destructive - force
pushes, hard resets, dropped tables, skipped checks, secrets - is escalated to you no matter how
confident it is.
It also keeps agents moving without you: it drains the follow-up work you queued - one item at a
time, each one verified as landed before the next is released - checks each against your repo's own
standards before calling it done, nudges an agent when one of its pull requests picks up review
comments or fails CI, and wraps up work that is finished.
Every decision Foreman makes is on the record - what was asked, what it saw, what it recommended, what happened, and who decided. You can watch it run in shadow mode, agreeing or disagreeing with itself, before you ever let it type.
08Workflows & Personas
Decide once what "done" means, then have every change held to it.
The Library, where each shelf is headed by the question it answers: where work comes from, what counts as done, what each standard gate runs, who does the reviewing, what a run can tell a session to do, and what to try when you are not sure of the best approach.
A review that runs itself
The review that ships with Mission Control, at version 12. Run the cheap checks first, then one reviewer for drift, then three reviewers in parallel, then three more, then open the pull request - and every published version before it is still there, still exactly what it was.
Cheap checks first. A change that does not compile never reaches a reviewer,
so it never costs one.
Reviewers run in parallel against the same snapshot of the work, and a stage
only advances when all of them pass.
Failures come back as one clear list of what to fix - not a wall of restated
opinions - and you set how many attempts it gets.
The pull request is a stage, not an afterthought, and the run cannot finish
until Mission Control has seen the pull request exist at the commit it reviewed.
Published reviews are frozen. Editing a reviewer tomorrow cannot change what
a review that already ran was judging against.
A finished review: every stage, every verdict, the reviewer's own rationale, and a worklist that separates what is still blocking from what has passed.
Reviewers you write yourself
A reviewer is a name and a page of standards in plain Markdown. Seven ship with Mission Control - intent, risk, quality, design, test evidence, documentation and a slop filter - each shown read-only with Duplicate to edit as the way to a version you own.
Each reviewer has exactly one job, which is what makes their verdicts useful: the risk reviewer
is told not to demand an abstraction as the price of passing, the design reviewer is the only one
that may object to shape, and the intent reviewer only fails a change that removed something you
asked for or added something you forbade. The slop filter is the newest of them, and it rejects the
thing a fast agent produces most: redundant comments, defensive branches nothing asked for,
mock-only tests, padded prose.
They judge more than the diff. Whatever the agent registered as evidence - a screenshot it took,
a focused log, the exact output of a command it ran - is part of what they read, none of it
committed. A reviewer that could not be reached is reported as unavailable - never as a
rejection.
Steps that ask the agent to do something
Some stages do not judge - they instruct. "Open a pull request" is one, and it carries the proof it needs: Mission Control marks it done when it sees the pull request, never because the agent said so.
09Shipping & the GitHub reviewer
The last mile, and the one place an autonomous fleet can do real damage - so it is
gated at every step and off until you say otherwise.
The GitHub reviewer, as it ships: off, in dry run, trusting no repositories. Three separate switches, and the first two are reversible without anyone else seeing anything.
The reviewers in the last section run on your machine, before a pull request exists. The
GitHub Inspector is the other half: it reviews the pull requests Mission Control
opened - and only those - on GitHub itself, against standards you keep in the repository, so each
project sets its own bar.
It comments inline on what it finds, answers replies in its own threads,
re-reviews on every push, and resolves its own threads once a push fixes what they were about.
It never approves and never blocks. When a review finds nothing further and
every earlier finding is resolved, it says so in one comment - and that is all it does.
Only pull requests it can prove are ours. A pull request is adopted when the
agent was seen to open it. One a colleague opened on the same branch is never touched.
Dry run is genuinely dry. It reviews, records what it found, and posts
nothing - so you can read what it would have said before it says it.
And, if you let it, the merge
What lands without you. Off, no repositories trusted, a ten-minute soak - and a merge queue that names the current reason per pull request, because an auto-merger's real failure mode is merging nothing and never saying why.
With YOLO mode on, a pull request Mission Control opened merges itself once
every one of these is true on the same read - and each of them is a way the fleet could otherwise
have shipped something nobody looked at:
Reviewed, and published, on this push. A review of the previous head
is not a review of what would land. Dry run means dry for the merge too: it reviews and publishes
nothing, so nothing qualifies.
Nothing outstanding - no open findings, and no unresolved review thread,
whoever asked it. It will not merge over a colleague's unanswered question.
No human veto. Anyone requesting changes, or a required review still
outstanding, stops it dead.
CI green on the head commit. A commit with no checks does not pass
this - it has never been asked.
Open for the soak - the window in which somebody can look and say no. Ten
minutes by default, and a push resets the review rather than the clock.
Two separate grants. Letting the reviewer comment on a repository is a smaller
permission than letting it merge there, so a repository has to be on both lists - and the one
dangerous combination, merge granted without review, is flagged in amber.
The merge is a compare-and-swap against the exact head that was evaluated, so a push landing in
the seconds between the decision and the call makes GitHub refuse rather than merge code nothing has
looked at. When GitHub refuses for a reason this app cannot see - a branch protection rule - its own
message is shown verbatim, because that is the only account you get of it.
10AI Conductor
When the work is driven by a whole SDLC engine instead of a single agent, that shows
up on the same board as everything else.
Some work is not one agent taking a task from start to finish. ai-conductor
walks a feature through a fixed, gated 22-step pipeline in its own worktree, runs its own agents,
keeps its own state on disk, and halts for a human when a gate refuses. Mission Control does not
replace it and does not merge with it. It watches - and acts through the engine's
own command line, which is a different thing, deliberately.
Three facts, kept separate because they fail separately: the engine is installed on this machine, a repository is registered with it, and observation is something you consent to afterwards. Under them, the master switch is off - so nothing is being read at all - and every card says which of the three is missing rather than leaving you to guess why no pipelines appear.
Never a second writer
Nothing here writes a file the engine owns. Its
state is lease-guarded by the engine itself, so every action spawns the engine's own CLI and is
judged by what it printed - never by an exit code.
Off until you consent, per repository
Detection is automatic; reading
is not. With nothing switched on, a watch tick reads one setting and returns: no probe, no engine
file opened, nothing on the stream.
Installed under supervision
It will set the engine up for you, but
only from a checkout it verified is the real upstream, and it shows you the exact installer command
first. It then reports only that the terminal opened - because opening a terminal is not proof
anything installed.
The engine's files stay the truth
What Mission Control stores is a
cache derived from files still on disk. Delete it and one refresh pass rebuilds it.
What it looks like once it is on
A second tab on Runs.Workflows is the page it always was;
Pipelines is what the engine is driving - grouped per repository under its daemon's state,
each feature's whole gated sequence drawn in the same grammar a workflow run uses. A step this
build has never heard of renders in the state the engine reported rather than breaking the page.
The engine's agents appear on your fleet, marked as its rather than yours:
they wear the run's badge, group under it, and have a sentence where the composer would be,
because nothing typed at them would be read.
A halt is a row in your inbox - with its class, what the engine said stopped
it, and the runbook that clears it. It is the one thing waiting on you with no session behind it,
because the agent that hit the gate has usually already exited.
You can act, not just read. Start, stop, pause and resume the engine's daemon,
park and unpark a feature, authorize one re-entry with your own written rationale, watch the
daemon's console, and run its re-seal ceremony in a real terminal.
Dispatch a pipeline like anything else. An observed repository offers
pipeline as a task kind; when the run opens a pull request it is adopted under pipeline
provenance and joins Shipped beside the rest. What a shipped feature cost lands in the
spend strip under the engine's own figures.
Foreman can help, narrowly. A separate switch, off by default, lets it unpark
only a halt the engine classified as mechanical. Everything else - anything needing a
human, anything unclassified - stays yours.
11Retro & memory
So the next agent does not repeat the last one's mistake.
When a piece of work is finished, Mission Control offers a retrospective - but only
when there is something to learn, which it works out from whether you had to correct the agent or a
reviewer found something real. It never nags, and it is never offered greyed out.
At most three lessons
Three is a ceiling, not a target. Restating
something already written down does not count as a lesson.
You approve every word
Each proposed lesson is shown in full, exactly
as it would be saved, with the evidence behind it. Approve it, rewrite it in your own words, or skip
it.
It lives in the repo
Lessons are committed to the project they are
about, so anyone who clones it gets them - including the next agent, automatically.
It is curated, not hoarded
A lesson confirmed often enough gets
promoted into the project's main guide and deleted from the list. One copy, never two.
Nothing is written that you did not approve, and the commit is the agent's own - so a lesson
arrives for review in the same pull request as the work that taught it.
12Ensembles
When one attempt is not enough, run several and pick the best.
Flip Dispatch from one agent to an ensemble and choose how to decide: rank the attempts, compare what they decided, or put them to a panel of judges. The plan at the bottom tells you exactly what will happen and what it will cost before you commit.
Best of N
Several agents attempt the same task independently. One
comparison ranks the results and recommends a winner.
Consensus
Where the attempts agreed becomes a settled decision; where
they diverged becomes a question for you, with each real position as an option.
Panel vote
Independent judges each score on one dimension -
correctness, maintainability, risk, evidence, scope - and the ranking comes from their votes.
Judged blind. Judges never see which agent or model produced which attempt, so
they cannot have a favourite.
Judges recommend, you decide. Nothing is promoted and nothing is thrown away
until you confirm it.
Every attempt is kept. The results you did not pick stay available - there is
no automatic clean-up you did not ask for.
Ties are declared, not broken. If the judges genuinely split, you are told
that rather than handed an arbitrary winner.
Candidates appear on the board as a group with a progress square each, so a five-way attempt reads
as one thing rather than five unrelated agents.
13The whole loop
Read separately these look like a dozen features. They are one loop, with you at the
decision points.
Blue is the path work takes. Amber is the part that makes a review a review rather
than a checklist - a failure is not a verdict, it is a round trip. Purple is Foreman, which is
optional everywhere and reaches only the agents you invited it into. The bottom lane is the other
shape work can take: an engine of its own, watched from the same screen.
The habits that run through all of it
Never claims what it cannot see
A pull request is done when Mission
Control observes it, not when an agent says so. A check that did not run says so. An uncertain
message says so and offers to retry.
A failure to reach a reviewer is not a rejection
Outages and timeouts
block or retry. They never come back as "your change was rejected".
Off by default where it matters
Foreman, the GitHub reviewer, the
merge gate, the pipeline engine and every outward-facing action ship switched off, and tell you
what they would have done first.
States are words, not colours
All clear.Enabled, but no
worker running.Nothing starts unless you start it. Empty screens say which kind of
empty they are.
No API key anywhere
The app's own model calls - naming a dispatch,
refining a goal, reviewing a pull request - run through a local CLI you are already logged in to,
and one page says which provider does each of them and what it is costing.
Your setup is recoverable
Settings and everything in the Library are
snapshotted automatically, with a redacted preview before any restore - and the database keeps
verified backups of its own.