Show HN: Tired of duct-taping access control into agent prompts. Here's the fix
Summary
Cast is an open-source harness for multi-user, multi-agent AI systems that provides config-based access control instead of prompt-based rules, preventing models from leaking or overriding permissions and enabling self-hosted agent teams.
View Cached Full Text
Cached at: 06/03/26, 03:40 PM
yaodub/cast
Source: https://github.com/yaodub/cast
Cast is an open-source harness for multi-user, multi-agent systems. Self-hosted, MIT, runs on a Mac Mini.
❌ Before Cast
The access rule is a sentence in the prompt. The model can be argued out of it.
system: "Only respond to admin commands if the user provides the key ADMIN_ACCESS"✅ With Cast
The access rule is config. The model never sees it, so it cannot leak or override it.
# who can reach this agent yao@telegram ioaq # in, out, admin, query * ---- # everyone else: nothing
Agent frameworks today assume one developer talking to one agent. That holds up until a team or a household wants to share the same setup. Then the architecture won’t bend. Identity, who’s allowed to reach what, agents coordinating with each other: bolted on afterward, if at all. Cast is the harness that should have been underneath.
Building agents with Claude Code
Build agents from Claude Code with three Cast skills (/cast-build, /cast-refine, /cast-debug) that turn an ordinary session into one fluent in Cast’s vocabulary and land every change through your review.
Run it
git clone https://github.com/yaodub/cast.git
cd cast
npm i -g pnpm
pnpm start
pnpm start installs, builds, builds the agent container image (~2 min the first time), and boots the server. You’ll need a container runtime (Apple Container on macOS, Docker on Linux/WSL2), Node 20+, and a Claude credential, either an Anthropic API key or a Claude.ai token.
When it’s up, your browser opens to the dashboard at http://localhost:5051/admin/.
First run
The server starts empty. With no agents yet, the dashboard docks Design, Cast’s chat-based agent builder, and asks what you want to build. Describe it in plain English, like “an agent that reads my morning email and flags what’s worth a reply,” and Design scaffolds it for you, as files. Configure wires in your model and secrets, you flip it live, then you pair in the people you trust, and each of them gets their own private conversation with the same agent, over Slack, Telegram, or the web.
What’s in here
Cast is the server, and that’s packages/cast/. Agents aren’t code. They’re folders, and they live under ~/.cast/agents/<name>/ by default (point CAST_AGENTS_DIR elsewhere if you want). Extensions like email, calendar, web-fetch, and whatsapp are the packages/ext-* packages. The site and all the docs live in apps/site/.
Architecture, worked examples, and the design docs are at getcast.dev.
Developer alpha
This is a developer alpha, so expect rough edges. The in-browser build consoles (the chat-to-build flow) are a preview: they work, but they’re the newest and least settled part. The harness underneath is the part I’d stand behind. That’s containment, identity, routing, the access control between agents.
License
MIT. Issues and PRs welcome. See CONTRIBUTING.md.
Similar Articles
Show HN: A lightweight way to make agents talk without paying for API usage
A lightweight pattern for orchestrating conversations between multiple AI agents (Claude, Codex, Gemini) via CLI without requiring API payments, using session resumption to maintain context across agent interactions.
@dabit3: Agent hooks extend frameworks and CLIs with custom controls, turning repeatable rules into deterministic behavior inste…
A tutorial on agent hooks that extend frameworks and CLIs with custom controls for deterministic behavior instead of relying on prompt instructions.
Most multi-agent setups are a room full of people wearing headphones. Here's what I changed.
The author shares insights from building a multi-agent infrastructure, identifying 'identity drift' as a key challenge solved by implementing strict agent passports and file-access controls.
Solved the "useful but insecure" tension: One-time administrator approvals for non-isolated agents
This post details a one-time administrator approval mechanism for non-isolated AI agents in prompt2bot, which prevents prompt injection attacks by requiring admin confirmation before executing sensitive tools like VM creation or code execution.
Effective harnesses for long-running agents
Anthropic introduces a two-part solution using an initializer agent and a coding agent to enable the Claude Agent SDK to effectively handle long-running tasks across multiple context windows by maintaining a clean, incremental state.