Cortex

top for your coding agent. Watch every model call, tool call and dollar your agent spends, live — then cut the waste.

Claude Code · OpenCode · Codex · IBM Bob · any agent that can use an HTTPS proxy. One binary on macOS or Linux. No Kubernetes, no account.

Quick start

curl -fsSL https://www.rossoctl.dev/cortex/install.sh | sh

Then, in a new terminal:

agentop configure claude-code enable    # once — or opencode, codex, bob
claude                                  # start (or restart) your agent as you always do
agentop observe                         # in another terminal: watch it live

Setup asks once before changing anything. If something looks wrong, agentop doctor names the fix. Can't reach rossoctl.dev? The same script is in this repo.

What you can do with it

See where your tokens go. Every session's tokens, cost and context fill, live. Open one to read the whole conversation, and the tool list it re-sends every turn.

agentop observe
agentop cost --window month --by agent

Trim 4–20% off Claude Code's prompts (median 6% in our measurement). Cortex strips the tool definitions you never call.

agentop tools scan --write ~/.cortex/config.yaml

Switch model servers without touching your agent. Provider down, or want the traffic to stay local? Send new sessions to a LiteLLM gateway or Ollama. For Ollama, pull the model and raise its context length first.

echo ollama | agentop server add ollama http://localhost:11434 \
  --main granite4.2:8b --helper granite4.2:8b --key-stdin   # Ollama takes any key
agentop server use ollama --agent claude-code

Guides: token savings · local models · pricing

How it works

Your agent uses Cortex as its HTTPS proxy. Cortex decrypts the traffic with a CA made on your machine, runs it through a pipeline of plugins, and sends it on re-encrypted. Running Cortex covers each piece.

Supported agents

Agent	Connect it
Claude Code	agentop configure claude-code enable	Guide
OpenCode	agentop configure opencode enable	Guide
Codex	agentop configure codex enable	Guide
IBM Bob	agentop configure bob enable — the editor and the bob shell command both	Guide
Any other agent	agentop exec -- <command>	Guide

status and disable check and undo each one.

Your data stays on your machine

• Loopback only. Cortex contacts the servers your agent asks for, or the one you route it to. Its own calls: LiteLLM's public price list, hourly (pricing.bundled: false turns it off), and the model list of any server you add.
• Your own CA, created locally in ~/.cortex/ca. Never added to a keychain by Cortex.
• Bad certificates aren't intercepted. When a server's certificate fails, Cortex leaves that connection encrypted end to end.
• Read-only until you turn on pruning, server routing or an enforcing script.
• History on disk in ~/.cortex/sessions and ~/.cortex/cost. agentop uninstall removes Cortex; --purge also deletes ~/.cortex.

Beyond the laptop

The same binary runs as a Kubernetes sidecar: a verifiable identity per workload, the right credentials for each downstream call (AuthBridge), guardrails, egress control and spend caps. Start with Running Cortex in Kubernetes.

Learn more

All docs · agentop reference · plugin catalog · script plugins · cpex policy build · full install guide · install stats (from GitHub's download counts, no telemetry)

Something broke? Tell us with the Laptop feedback form under new issue, or on Slack. A half-finished install with the error pasted in helps more than a polished report never sent. To contribute, see CONTRIBUTING.md; to report a vulnerability, SECURITY.md.

Licensed under Apache 2.0.