So you're deep in a session with Claude Code or Cursor, everything's flowing, and then it hits a wall:
"I can't install this package system-wide, I don't have sudo."
And you're sitting right there, hands on the keyboard, perfectly willing to run that one command yourself. But instead you have to stop, alt-tab to a real terminal, type it out, come back, and re-explain what just happened so the agent can pick up where it left off. Every time. All day.
The sandbox isn't wrong, by the way. You want your AI boxed in — nobody wants an agent that can quietly touch /etc or fiddle with firewall rules on its own initiative. The problem isn't that the sandbox exists. It's that there's no door in it. No way to say "yes, this one, go ahead" without leaving the conversation entirely.
That's the whole reason I built Conduit.
What it actually is
Conduit is a small Python process that runs on your machine, with whatever privileges you give it. Your AI proposes a command. You get a popup showing exactly what it wants to run. You click Yes or No — and it defaults to No, on purpose. Nothing executes without you personally reading it first.
Starting it is about as complicated as it gets:
python run_conduit.py
That's it. No pip installs, standard library only. It opens a local dashboard, prints a session token, and waits.
How the flow actually looks
- You start Conduit in an elevated terminal (or just double-click
conduit.baton Windows). - It opens a dashboard in your browser with a token and a "copy prompt" button.
- You hand that prompt to your agent, or wire it up once as an MCP server.
- The agent asks to run something privileged — say, installing a package or restarting a service.
- A dialog pops up on your screen with the exact command.
- You click. If yes, it runs and the output streams back to the agent as JSON. If no, the agent gets
DENIEDand that's the end of it.
No silent execution, no "trust me," no background magic.
Two ways to wire it up
If your client speaks MCP (Claude Code, Cursor, Claude Desktop), this is genuinely one command:
claude mcp add conduit -- python /full/path/to/run_conduit.py --mcp
That gives the agent a native run_command tool, plus read-only list_shells and get_status that don't need your approval at all. Worth noting: the MCP piece is just a thin bridge. It runs inside the agent's own sandbox and can't execute anything itself — it just forwards the request over localhost to the real Conduit process, which is the one actually holding the keys and the dialog box.
If MCP isn't an option, plain HTTP works too, and it's about eight lines of stdlib Python:
import urllib.request, json
req = urllib.request.Request(
"http://127.0.0.1:40404/",
data=json.dumps({"command": "brew install ffmpeg"}).encode(),
headers={"Authorization": "Bearer YOUR_TOKEN"},
method="POST"
)
print(json.loads(urllib.request.urlopen(req).read()))
Both paths land in the same queue and the same approval dialog. Doesn't matter which one your tool prefers.
Why I didn't cut corners on the boring stuff
The security details matter more than the UI here, so a quick rundown: it binds only to 127.0.0.1, never touches your network. Every session gets a fresh UUID token that dies when you close Conduit — nothing persists, no history lingers around waiting to be a problem. Unanswered prompts auto-deny after 60 seconds instead of hanging open forever. And there's a --headless flag with --always-allow baked in for when you're running on a VPS and genuinely trust the pipeline — but that's opt-in, never the default.
Where this actually helps
Mostly it's the small stuff that used to break my flow: apt install-ing a missing system dependency, restarting a local service after a config change, checking disk space, tweaking something in a protected directory. None of it is dangerous when you're the one clicking approve. It was only ever annoying because there was no clean way to approve it without leaving the chat.
Conduit doesn't make your AI more powerful. It just gives you a button.
Repo's here if you want to poke at it: github.com/Rehan30g/Conduit
