Waymark: The Control Layer Your AI Coding Agent Was Missing

#ai #claude #githubcopilot #security

AI coding agents are getting good at writing code. The problem is they're just as good at touching files they shouldn't, running commands you didn't ask for, and doing it all without leaving a paper trail.

Waymark sits between your agent and your codebase. Every file write and shell command gets intercepted, logged, and checked against your policy — before it happens.

npm install -g @way_marks/cli
waymark init   # registers with Claude Code or GitHub Copilot CLI
waymark start  # spins up the MCP server + dashboard

What It Actually Gives You

A policy that runs before the agent does anything

One config file. Three layers of control:

{
  "allowedPaths": ["src/**", "tests/**"],
  "blockedPaths": [".env", "*.pem", "*.key"],
  "requireApproval": ["package.json", "Dockerfile"],
  "blockedCommands": ["rm -rf", "regex:curl.*-o\\s+/"]
}

Allow — executed and logged automatically
Block — stopped cold, agent gets a clear reason
Require Approval — agent waits, you decide from the dashboard or Slack

The agent never touches .env. It never runs rm -rf. And before it rewrites your Dockerfile, it asks.

Every write is reversible

Before any file change goes through, Waymark snapshots the original. One click in the dashboard restores it — or you roll back an entire agent session at once. No git stash gymnastics, no "what did it do exactly."

A live view of every agent on your machine

$ waymark agents

Agent     PID    Status      Ctx%  Tokens   Task                         Age
copilot   39897  thinking     52%  146,032  Refactor auth middleware       1m
claude    64586  waiting      37%   75,060  (idle)                        12m

Context-window fill, token count, current task, tool calls — all live, all local. Nothing leaves the machine.

Approvals that don't kill your flow

When an action hits a requireApproval path, Waymark sends a Slack message with Approve / Reject buttons. The agent waits. You approve from your phone. Work continues. The dashboard shows the full audit trail: what was requested, who approved it, what changed.