Show HN: Tired of duct-taping access control into agent prompts. Here's the fix
Summary
Cast is an open-source harness for multi-user, multi-agent AI systems that provides config-based access control instead of prompt-based rules, preventing models from leaking or overriding permissions and enabling self-hosted agent teams.
View Cached Full Text
Cached at: 06/03/26, 03:40 PM
yaodub/cast
Source: https://github.com/yaodub/cast
Cast is an open-source harness for multi-user, multi-agent systems. Self-hosted, MIT, runs on a Mac Mini.
❌ Before Cast
The access rule is a sentence in the prompt. The model can be argued out of it.
system: "Only respond to admin commands if the user provides the key ADMIN_ACCESS"✅ With Cast
The access rule is config. The model never sees it, so it cannot leak or override it.
# who can reach this agent yao@telegram ioaq # in, out, admin, query * ---- # everyone else: nothing
Agent frameworks today assume one developer talking to one agent. That holds up until a team or a household wants to share the same setup. Then the architecture won’t bend. Identity, who’s allowed to reach what, agents coordinating with each other: bolted on afterward, if at all. Cast is the harness that should have been underneath.
Building agents with Claude Code
Build agents from Claude Code with three Cast skills (/cast-build, /cast-refine, /cast-debug) that turn an ordinary session into one fluent in Cast’s vocabulary and land every change through your review.
Run it
git clone https://github.com/yaodub/cast.git
cd cast
npm i -g pnpm
pnpm start
pnpm start installs, builds, builds the agent container image (~2 min the first time), and boots the server. You’ll need a container runtime (Apple Container on macOS, Docker on Linux/WSL2), Node 20+, and a Claude credential, either an Anthropic API key or a Claude.ai token.
When it’s up, your browser opens to the dashboard at http://localhost:5051/admin/.
First run
The server starts empty. With no agents yet, the dashboard docks Design, Cast’s chat-based agent builder, and asks what you want to build. Describe it in plain English, like “an agent that reads my morning email and flags what’s worth a reply,” and Design scaffolds it for you, as files. Configure wires in your model and secrets, you flip it live, then you pair in the people you trust, and each of them gets their own private conversation with the same agent, over Slack, Telegram, or the web.
What’s in here
Cast is the server, and that’s packages/cast/. Agents aren’t code. They’re folders, and they live under ~/.cast/agents/<name>/ by default (point CAST_AGENTS_DIR elsewhere if you want). Extensions like email, calendar, web-fetch, and whatsapp are the packages/ext-* packages. The site and all the docs live in apps/site/.
Architecture, worked examples, and the design docs are at getcast.dev.
Developer alpha
This is a developer alpha, so expect rough edges. The in-browser build consoles (the chat-to-build flow) are a preview: they work, but they’re the newest and least settled part. The harness underneath is the part I’d stand behind. That’s containment, identity, routing, the access control between agents.
License
MIT. Issues and PRs welcome. See CONTRIBUTING.md.
Similar Articles
Show HN: Claw Patrol, a security firewall for agents
Claw Patrol is a security firewall for AI agents, sitting between agents and production to parse traffic and gate actions using HCL rules, blocking destructive SQL or requiring human approval for risky commands like kubectl delete pod.
Does anyone actually read the agent permission prompts anymore?
The article highlights the problem of users blindly clicking through permission prompts for coding agents, and presents a fork-based workspace approach (built in Gensee Crate) where agents work on isolated copies, enabling safe experimentation and parallel approaches, though external API calls remain a challenge.
Stop trying to prompt your way to agent safety. It's an access-control problem
The article argues that AI agent safety should be addressed as an access-control problem, recommending practices like least privilege, allow-lists, and approval gates to prevent unintended actions.
Show HN: A lightweight way to make agents talk without paying for API usage
A lightweight pattern for orchestrating conversations between multiple AI agents (Claude, Codex, Gemini) via CLI without requiring API payments, using session resumption to maintain context across agent interactions.
@dabit3: Agent hooks extend frameworks and CLIs with custom controls, turning repeatable rules into deterministic behavior inste…
A tutorial on agent hooks that extend frameworks and CLIs with custom controls for deterministic behavior instead of relying on prompt instructions.