Open Source Agent Tools: November 3, 2026

1. Nomos Puts a Go Harness Between Coding Agents and Git That Blocks Deleted Assertions, Stubs and Spec Rewrites

Nomos, released as v4.0.0 on November 1 and posted to Show HN on November 2, is a 28 MB static Go binary that sits between an existing coding agent (Claude Code, Cursor, OpenCode, Windsurf, Aider or Antigravity) and the repository, locking main read-only through Git hooks and running each task in its own Git worktree under a fixed IDLE, PLAN, EDIT, REVIEW, SYNC, LEARN state machine. Spec tasks (INT-*) and code tasks (SUB-*) are tracked separately in a local dependency graph so an agent cannot rewrite a spec to excuse broken code, and nomos verify runs 42 built-in AST gates (about 460 ms for a full pass) plus the repository’s own compiler and tests, blocking deleted or skipped tests, stub returns, leaked secrets, functions over 60 lines and edits to the pinned nomos.yaml before a two-phase merge. Lessons enter a local SQLite memory only after a verified merge, there is no cloud account or telemetry, and the author notes the loop adds overhead that does not pay off on small prototypes. License: Apache-2.0. Source Show HN

2. Deedglass Checks What an Agent’s Database Write Actually Changed and Seals the Result as a Signed Record

Deedglass, posted to Show HN on November 2, is a self-hosted gateway between AI agents (Claude, Cursor, OpenAI or any MCP client) and the systems they change: policies allow, deny or require approval for each tool call, the call runs with credentials the agent never holds, and the outcome is compared with what the agent reported. Checks come in three levels, Claimed (the tool’s own answer), Checked (a read-back from GitHub, Slack, Stripe, Notion, REST or Postgres) and Proven (Postgres logical decoding of every row the transaction committed), and each result is sealed as a signed record that deedglass verify checks offline; the demo shows an agent reporting a one-row UPDATE while a legacy trigger changed 301 rows, which Deedglass flags and can undo after a person countersigns. A beta FHIR R4 connector targets health records, and a Lockdown mode makes every agent write wait for a person. It starts with npx -y deedglass, is pre-1.0 with one maintainer, and has no SOC 2 report or SSO yet. License: Apache-2.0 core, with the ee/ directory under FSL-1.1-ALv2 (all features currently free). Source Show HN

3. Maat Lets Agents Diagnose Ubuntu From a Kernel-Confined Snap and Turns Fixes Into Plans a Person Approves Through Polkit

Maat, posted to Show HN on November 2, is an MCP server and toolkit for troubleshooting Ubuntu in which the agent’s tools run inside a strictly confined snap that can read the journal, services, processes and disks but cannot write or open network sockets, so the kernel rather than the prompt enforces read-only access. The agent proposes a typed fix (such as restarting a named failed service), Maat attaches preconditions, a success check and an undo step, and a separate maatctl tool shows the cited log lines, rejects plans that differ from what Maat would derive or that cite invented evidence IDs, and applies them only after a polkit prompt; every step goes into a hash-chained audit trail. First results from the bundled maat-bench of deliberately broken machines, published November 2, show gpt-oss:20b finding the root cause in 28 of 30 attempts and qwen3:8b in 24 of 30, with both ignoring all six instructions planted in logs, though the authors describe the scenarios as still easy. It is a developer preview tested on Ubuntu 24.04. License: GPL-3.0. Source Show HN

4. MCPgraphy Is a Proxy That Learns From an Agent’s Own Calls Which MCP Tools Fail in Which State

MCPgraphy, released as v0.1.0 on November 1 and posted to Show HN on November 3, wraps any MCP server and reads each touched resource before and after every call to build a behavior graph of observed states and the tools that succeeded or failed from them. It can list which tools are candidates for a resource’s current state, attach warnings to calls that failed from that state before, or block those calls (plus destructive or approval-gated tools) before the server sees them; learning is passive, with no extra probes or resets, and untried paths are reported as unknown rather than safe. On the author’s benchmark of 200 stateful tasks on two simulated servers with a scripted agent, invalid calls per task fell from 2.19 with raw tools to 0.71 and task completion rose from 0.85 to 1.00. It installs with pip install mcpgraphy and runs locally with no keys. License: MIT. Source Show HN

5. Knock Gives Claude Code a Local Map and Memory of a Codebase Over MCP to Cut Exploration Costs

Knock, released as v0.1.0 and posted to Show HN on November 2, is a local MCP server that indexes a repository and gives the agent a map tool returning a code skeleton with exact line ranges, plus open and remember tools so findings and decisions persist across sessions, with each answer marked fresh or stale. Setup is a single claude mcp add knock -- uvx knock-mcp serve --repo . --toolset map command with no API key, and the index re-reads only changed files. The author’s benchmark reports a median of about 4,300 characters read per question against 27,000 to 118,000 for grep-based baselines, and on the 4,776-file Saleor repository a Claude Code investigation dropped from 30 tool calls and $0.49 to 13 tool calls and $0.25 (median of three runs); the author also reports gains within noise on a small repository and a slight added cost on quick edits. License: Apache-2.0. Source Show HN

6. codex-session-operator Runs OpenAI Managed Agents Sessions Against Git Repos in Self-Hosted Kubernetes Sandboxes

codex-session-operator, an independent project posted to Show HN on November 2, is a Kubernetes operator for OpenAI’s Managed Agents API in which OpenAI runs the agent loop and inference while codex exec-server executes commands inside the user’s cluster through Kubernetes Agent Sandbox, on persistent workspaces. Users define Agent, Environment and Profile resources (the profile selects the workspace and a spending policy), send tasks through an HTTP gateway or CLI, and continue a conversation in the same workspace, with messages, results and approvals stored in PostgreSQL. It is alpha, requires Agents API access and incurs API charges. License: Apache-2.0. Source Show HN

7. One Roof Is a Mac App That Collects Every Question From Many Coding-Agent Sessions Into One Inbox

One Roof, released as v2.0.0 on November 1 and posted to Show HN on November 2, runs Claude Code, Codex, Gemini CLI, Kimi and Antigravity sessions as real terminals under a background service (roofd) that keeps them alive when the app is closed. Prompts from every session land in one Inbox with their options as buttons, a Home page summarizes overnight failures and suggested next steps, and Loops rerun an agent on a separate copy of the repository until a check such as “tests pass” succeeds, never pushing, merging or deploying on their own. A Resources view tracks memory and CPU per session and ends a session that passes 2 GB; the app needs macOS 14 on Apple silicon. License: MIT. Source Show HN

8. EvalCart Scores Grocery-Shopping Agents Against a Synthetic Store, Budget and Household Brief

EvalCart, posted to Show HN on November 2, is a free eval and leaderboard for shopping agents built on a synthetic store of about 2,000 grocery items: the agent receives a household brief with meals, servings, owned staples, constraints and a budget, returns a cart, and a deterministic scorer reports completeness, constraint and budget violations, taste fit, waste and efficiency. The public eval repository defines one synthetic household with eleven variants (including a budget cut, pantry-first, leftovers, a party week and out-of-stock items), entries rank only when submitted with a transcript, and nothing places real orders. The leaderboard so far holds only the author’s own runs and baselines, and no sign-up is needed to run it. License: MIT (eval repository). Source Repository Show HN