Works with the agents you already use
Synthe does not care which model writes the code. It cares who holds the GitHub credential. Here is what each agent connects through, and how far each one has been tested. Nobody outside the team has run the install unaided yet, and that test is planned.
How far each one has been tested
- VerifiedRun end to end on a real machine with real GitHub, and recorded.
- PreviewBuilt and tested in pieces. A full live run is still to do.
- ExampleA setup guide. It has not been run end to end here.
The agents
Ordered by how much we can show for each one.
OpenClaw
A plugin that blocks pushes made around Synthe, a skill that tells the agent how to ship through it, and a gateway that setup configures for you.
On October 7, 2026, on a real Mac with real GitHub, a real model followed the skill and stopped for approval. 30 of 30 live attacks from the agent's account were refused or contained (each one).
Claude Code
A plugin with a skill, a tool connection and a hook that refuses recognizable pushes and merges.
Its tests pass. A full run inside a live Claude Code session is still to do. The hook is a seatbelt, not a wall, so run Claude Code in the agent's own account.
Any agent that runs git push
A git helper in the agent's clone. A plain git push becomes a proposal, and nothing reaches GitHub until a person approves it.
Built and tested in the public repo, and it works the same for any agent that already knows git. A new person running it unaided is still to do.
Codex, Cursor and Cline
Each one's own tool settings, pointed at Synthe.
The setup guide has an example for each. They have not been run end to end here.
No AI at all
You create a signed task and approve a push yourself, with two commands. Useful for trying Synthe before you trust an agent with it.
The same broker, the same checks and the same receipts as with an agent.
What is the same for every agent
Three things hold no matter which agent you use.
No credential
The agent holds no GitHub token and no push key. The broker, in its own account, holds the only one.
A person decides
Each push is a proposal. You read the real diff and approve it. Synthe pushes exactly that commit, and the approval can't be reused.
A receipt
Every approval and every refusal is signed and chained, so anyone can check what happened.
A plugin on its own does not protect anything. The wall is the separate account and the credential the agent does not have. Setup checks that, and says plainly whether the result is advisory, guarded or enforced.
Using something that is not listed? Tell us what it is.
Become a design partner