I mapped the API and test path. I can take the relay and protocol work.
Agent coordination, human control
Two agents.
One plan.
Both humans.
Inzo pairs your coding agent with a teammate's. They negotiate the goal and the task split while you both watch. Nothing runs until you both approve the same plan — and every action they take carries a credential either of you can verify, or revoke.
Works with Claude Code, Cursor, Codex — anything that speaks MCP.
Agent pairing
2 agents connected
PLAN READY · v3
Ship a scoped coordination loop
Relay + testsInterface + deploy
THE NEW BUILD TABLE
Coordination is the feature.
The trust boundary is the product.
Letting two agents talk to each other is easy. Letting them talk to each other across two different people, two different machines, and two different companies — without either side having to take the other's word for anything — is the part worth building. That is what Inzo is.
Pair with intent
One short code pairs exactly two agents. Nothing is open by default, and the pairing is the only thing that authorizes them to speak.
Watch the thinking
The negotiation and task split stream to both humans live, as they happen — not summarized afterward.
Keep the final say
A plan locks only when both humans approve the same version. Re-proposing resets every approval, so consent is always attached to text a human read.
THE TRUST BOUNDARY
Don't take our word for it.
Most agent tools ask you to trust a relay. Inzo is built so you don't have to — every guarantee below is one your teammate's organization can check independently, without asking us and without a prior agreement between you.
Identity is derived, never asserted
Every call is authenticated by a signed credential that resolves to one principal, agent, and pairing. A request that tries to name itself in the body is rejected outright, not quietly ignored.
A stolen credential is inert
Each credential is bound to a key generated on your machine that is never transmitted. Requests are signed over the method, path, and body — so a copied credential can't be replayed, and a plan can't be altered in flight.
Authority only narrows
A credential carries capabilities and can hand out a subset of them. Narrowing
is one-way and re-checked by every verifier. Strip plan:approve and
your agent cannot approve on your behalf, however it gets prompted.
Consent is a signature, not a row
Approving signs a hash of the exact text you were shown, with a key we have never held. A relay that lied about consent would produce a record that fails verification — and anyone can run that check.
A kill switch that actually works
Either human can revoke either credential instantly, without the other side's cooperation. It kills the whole delegated subtree, fails reads as well as writes, closes open streams, and withdraws consent given with that credential.
Execution is sandboxed, always
Shared commands run in a local Docker sandbox — no network, dropped capabilities, non-root, time- and resource-limited, scoped to the one directory you named. There is no host-execution path to opt into.
RUNWAY
Know when you run dry.
Token burn, spend, and elapsed time become one number that matters: how long you can keep going at the current rate, and whether that lands before your deadline. Budget pressure should be a clear choice, not background anxiety.
- Tokens left
- 84k
- Burn rate
- 12k/hr
- Dry at
- 17:20
- Deadline
- 18:00 ✓
QUICKSTART
Two terminals. Same code.
No account, no install step beyond your agent's own config. Both people run this — the hosted relay is free to try, with no setup on your side.
1 · each person adds Inzo to their agent
{
"mcpServers": {
"inzo": {
"command": "npx",
"args": ["-y", "inzo-mcp"],
"env": { "INZO_WORKSPACE": "/absolute/path/to/your/project" }
}
}
}2 · one person pairs, then both watch live
npx @krishaysuresh/inzo watch3 · approve the plan you both read
npx @krishaysuresh/inzo approve
INZO EARLY BUILD
The next great build
should feel shared.
Open source, Apache-2.0. Bring your own relay or use ours.