Your official coding agents.
One place, any device, your rules.
Maestro is a browser interface for the AI coding CLIs you already use. It starts them, shows their conversations, and lets you answer them from your phone. It has no AI of its own: every word an agent writes comes from the agent's own program, signed in with your own account.
Three pieces, and only one of them is new.
The agents are the official programs from Anthropic, OpenAI, Google and the others, installed on your computer as usual. Maestro sits beside them and gives them a screen you can open anywhere.
You
A browser tab or installed app: on this computer, your laptop, or your phone.
Maestro, on your computer
- Lists every agent's conversations, read from the agent's own files
- Starts a turn in the agent's own program, and shows it live
- Asks you when an agent needs a decision, a key, or an approval
The agents
The official CLIs, each with its own sign-in, settings, history and permission rules. They talk to their own company's AI, as they always do.
Maestro keeps no copy of your conversations and no AI gateway: if you stop using it, every conversation is still in each agent's own app, exactly where it was.
Every piece, and what travels between them.
Read it from left to right: your devices reach your computer (only if you allow it), and from your computer each agent talks to its own company's AI and to the services you connect.
op; keys read only when allowedDashed: off until you turn it on. Nothing here sends your conversations or keys to Maestro's makers: the connection service, if you use it, only introduces your devices to your computer.
Three doors, each with its own lock.
Working safely with agents comes down to three questions. Maestro answers each one in a place of its own, and nothing is open until you open it.
Who can reach Maestro
Only this computer, until you turn remote access on. Then only devices you paired or that signed in with your account, each one lockable with a passkey and removable at any time.
Reaching it from anywhere →What the agents may do
Each agent's own permission rules, which you can set here. They ask before acting, you answer on a card, and an agent can be shut in a few folders so the rest of the computer does not exist for it.
The agents' controls →Which keys they may use
Your API keys and passwords stay in 1Password. An agent asks by name, you allow it from your phone, and it gets the key inside one command only: never in the chat, never in a file.
Credentials →Closed by default. Opened by you, one device at a time.
Out of the box, Maestro answers only on this computer (127.0.0.1:4317): another
device on your network cannot even see it. To use it from your phone or laptop, you choose one of three ways.
No port, no router, no certificate
Your computer connects out to the service and waits. Your phone signs in there with your Google account; your computer checks that sign-in itself (it must be the account you linked) and then the two talk directly, encrypted end to end (WebRTC).
- Which computers are linked, and the owner's Google identity and e-mail.
- Not your conversations: they travel encrypted between your phone and your computer; a relay, when one is needed, carries only scrambled data.
- It does serve the page your phone runs, so you trust its operator the way you trust a website you sign in to.
A second door, on your network only
Maestro opens a separate port (4318 by default) on the address you choose. Your everyday port stays closed to the network. You pair each device with a QR code you approve on the computer.
- Give it a certificate (HTTPS). Without one, you must tick "plain HTTP" yourself, and everything, the sign-in cookie included, crosses the network unencrypted.
- Over plain HTTP or a bare IP address, devices cannot have a passkey, so they never lock.
Your tunnel, your address
Maestro does not install or run tunnels. If you have one, point it at Maestro's port on loopback and tell Maestro its public HTTPS address. Devices still pair with a QR code you approve.
- The tunnel's own access rules (Cloudflare Access, your Tailscale network) are a good extra lock in front.
- Whoever runs the tunnel carries your traffic: choose one you trust.
Every device, whatever the way
A QR code that works once, for two minutes. The phone and the computer then show the same six-digit number; you approve on the computer only if they match.
A device with a passkey locks after 15 minutes without use and opens with your face, fingerprint or PIN. Through the connection service a passkey is required, and Google is asked again every 30 days. Add one on every device: without it, a device does not lock.
A device is removed after 30 days unused, and in any case after 90. Remove any device at once from Settings › Remote access › Devices; a list of security events shows what happened.
Some things a remote device can never do, even signed in: change how Maestro is reached, pair a device, turn an agent's isolation off, change its browser, copy sign-ins into it, read a key's value, export the settings or change automatic start. Someone holding your unlocked phone still cannot open those doors, though they can answer cards and change an agent's permission mode: keep the phone locked.
The agents keep their own rules. You hold the switches.
Maestro enforces nothing of its own here, on purpose: every control is a setting written into the agent's own configuration, the way that agent documents it. So the same rule holds when you use the agent in a plain terminal, and you are never locked into Maestro.
The agent wants to act
Run a command, edit a file, open a web page.
Allowed, denied, or asked?
- Allowed by a rule you set: it just happens
- Denied: protected folders, keys, other agents' files
- Asked: a card appears in the conversation
From any device
Allow once, allow from now on, or refuse. The card shows exactly what will run.
How much the agent asks
Every agent has modes, from "ask for everything" to "approve everything". Maestro shows each agent's own modes, and the conversation's mode can be changed for that conversation only.
For Grok, Kimi, Qwen and Mistral Vibe, one button, Restricted, sets in one go: ask for everything,
"approve everything" blocked, no access to keys and private folders (.ssh, .aws,
.env files, every agent's own folder), no files outside the project, web access asked, the
agent's sandbox on, telemetry off, as far as each agent allows.
Cards, not surprises
When an agent asks, its conversation shows a card and is marked as waiting for you; your phone can notify you. The choices are the agent's own: Claude Code offers allow, always allow, deny; Codex offers allow, allow for this session, decline.
One exception, shown in the conversation: with Grok set to "Always approve", Maestro answers the few commands Grok still asks about with allow once, never with a lasting rule.
A room with only the folders you choose
For Kimi Code and Qwen Code, Maestro can start the agent shut inside the folders you allow: the rest of your home folder, other projects, keys and other agents simply do not exist for it. It is off until you turn it on, and only on the computer itself.
A browser the agents can use, and you can watch
Each agent gets Clean (no sign-ins, the default), Clean, and my profile (your extensions and the sign-ins you copied to it, site by site, at most 20 at a time), or Off. You see its tabs live beside the conversation. Changed only on the computer.
A real shell on your computer, opened in the project's folder, for you. Agents can read it and run a command in it where you see it happen. It is not isolated: it can do what your user can do.
Conversations stay in each agent's own files; Maestro keeps only names, choices, a search index you can delete, and a log of approvals. Whatever an agent reads is sent to its company's AI, isolated or not: whether they may train on it is a setting of your account with them.
Keys live in your vault. Agents ask; you allow.
An agent often needs a key: to call an API, deploy, send an e-mail. Pasting it into the chat puts it in the conversation's history and in the AI company's logs, forever. Maestro does it differently: it reads the key from your vault when it is used. It connects to 1Password today, and more vaults are on the way.
The agent asks for what it needs, not for the key itself
Every agent has an Maestro tool called request_credential. It says what it needs and
why, in words: it never sees your vault.
Maestro looks in the vaults you gave it, by name only
It searches item names in your 1Password (an "API key" request prefers API credentials over logins), reads no value, and prepares a card. If nothing matches, the card says where to add it, or lets you paste it once: it is saved straight into 1Password, never into the chat.
A card in the conversation, on whichever device you are
You see who asks, what for, and which item. Allow it for a working day (eight hours, renewed while it is used), always, or not at all.
The key goes into one command, and nowhere else
The agent runs its command through Maestro's runner. Only then, on your computer, is the value read from 1Password and put in that one command's environment. The chat shows the command, never the key.
See everything allowed, and end it in one click
Settings › Credentials › Allowed now lists every key an agent holds, until when, and for which agent. Take back ends it at once, the copy held in memory included. A day's permission also ends by itself when it is not used for eight hours.
Connecting 1Password: two ways, for two situations
| Service account | 1Password app on this computer | |
|---|---|---|
| Works when you are | Anywhere: you approve on Maestro's card | At this computer: 1Password itself asks here |
| Reaches | Only the vaults you give it (never your Private vault) | Everything you see in 1Password, Private included |
| How you set it up | Create it on 1Password's website, paste its token once into Maestro | Turn on "Integrate with 1Password CLI" in the app |
| Good for | Keys agents use every day | The occasional password, when you are at the desk |
The service account's token is kept on your computer, encrypted with a key from the system's keyring, and never shown again. A service account may make 1,000 requests a day, so Maestro keeps the list of names for ten minutes.
The same tools in every agent, with their keys out of the settings files.
Agents reach outside services through MCP servers (small programs that give them tools: your task tracker, a database, a browser). Each agent keeps its own list, and most people paste API keys straight into it. Maestro shows all of them side by side and moves those keys out.
Every server, every agent
Settings › Credentials › MCP servers: one line per server, a mark per agent that has it, and a warning where a key is written in an agent's settings file.
The key leaves the file
One click puts the key in a 1Password item and rewrites the agent's entry to start the server through Maestro's launcher, which hands it the key as it starts. The file keeps where the key is, not what it is.
Same tools everywhere
A server whose keys are in 1Password can be added to the other agents with one click, each written the way
that agent's own mcp add writes it.
Every agent also gets Maestro's server: the visible browser, the terminal beside the conversation, threads with other agents, sending files, linking work to your tracker, and asking for a key. Each one that acts on your behalf goes through a card or is something you can see happening.
Environment files: every .env under your home folder, how many values sit in plain text,
and which are committed to git. GitHub secrets: your repositories' secrets, by name and date.
claude.ai connectors (Gmail, Drive…) belong to your Claude account and are shown, not copied.
Start safely in eight steps.
Do them in order. Each takes a few minutes, and every one can be changed later.
Install the agents you use, the official way
Claude Code, Codex and the others, from their makers. Sign in to each in its own terminal first: Maestro uses those sign-ins.
Install and start Maestro
It finds the agents by itself. Open it on the computer and check that every agent shows as signed in.
Choose how careful each agent is
Leave each agent asking before it edits or runs commands (Restricted, where offered). For Kimi or Qwen, turn on isolation to keep it in a few project folders.
Connect 1Password with a service account
Create a service account on 1Password's website, give it the vaults that hold what agents may use (API keys, deploy tokens), and paste its token into Maestro once. 1Password never gives a service account your Private vault.
Take the keys out of your agents' settings
Where MCP servers show "Key in settings", move them to 1Password. Then give the servers you want to every agent.
Turn on remote access
The connection service is the simplest: link this computer once with your Google account.
Add your phone, and lock it
Sign in from the phone, then add a passkey so it locks when you put it down.
Start a conversation, and watch the cards
Ask for something real. When a card appears (an approval, a key) read who asks and why before you answer.
What Maestro does not protect you from.
Knowing the edges is part of working safely.
"Approve everything" means everything. In that mode (yolo, Full access) an agent runs commands and edits files without asking. Use it only in an isolated agent or a throwaway folder.
An allowed key can be read by the command that gets it. Maestro keeps keys out of the chat and the files, and tells agents never to print them, but a command given a key can technically print it. Allow keys for what you trust; prefer a working day to "always", and take back what you no longer need.
Isolation covers two agents, and shares the network. Kimi and Qwen only, from Maestro only (not when you run them in your own terminal). An isolated agent can still use the network.
Everything runs as you. The agents, Maestro and the terminal run with your computer user's rights. A program set on breaking in as your user could reach what you can. Isolation and a separate user account are the real walls.
Your data goes to the AI companies. What an agent reads is sent to its maker, as with any use of these agents. Maestro adds no AI and no extra party, but does not change that.
Remote access trusts what carries it. The connection service serves the page your phone runs; a tunnel's operator carries your traffic; plain HTTP on a network is readable by anyone on it. An unlocked phone in someone else's hands can do what you can, except what is kept for the computer itself.
Web pages can carry instructions. An agent reading a page, a file or an e-mail can meet text written to trick it. Keep "ask" modes on for agents that browse, and read cards before you allow.
Golden rules
If an agent asks you to paste one, answer "ask for it with request_credential". The card puts it in 1Password instead.
Who asks, what will run, which key, for what. Ten seconds that matter.
The service account sees the vaults you give it, nothing else. Your Private vault stays yours.
A working day renews while it is used and ends when it is not. "Always" is for keys that are harmless.
And remove devices you no longer use: Settings › Remote access › Devices.
Start each agent asking for everything; allow more as you learn what it does.