Oren Agent · private beta

Your coding agent has production credentials. Give it guardrails.

Oren Agent reviews what your agent is about to do — and what it already did. Cloud cost, token cost, and destructive actions, caught in the editor before execution and in the pull request after.

No pricing yet. No credit card. Works with Claude Code and Cursor.

claude code · oren-agentpre-execution
agent wants to run:
  $ terraform apply -auto-approve
⊘ blocked destructive action
  blast_radius  34 resources
  includes      aurora-prod (no snapshot 7d)
  est_cost       −$1,240/mo, +4h restore
suggested instead:
✓ allowed terraform plan -out=tfplan
Illustrative. Real output, real command — nothing was destroyed.
01 · The problem

Agents are fast, confident, and unsupervised.

Code review catches bad code. Nothing catches a shell command, a provisioned GPU, or a fifty-turn retry loop. Three failures repeat across every team we’ve worked with.

destructive

One command, no undo

A drop, a force-push, a delete on the wrong account. The agent has no model of what is irreversible, and no sense of how many things it is about to touch.

$ terraform apply -auto-approve
$ aws s3 rm --recursive
$ DROP TABLE …
cloud cost

Infrastructure written by autocomplete

Instance sizes, GPU types, and provisioned throughput chosen because they appeared in the training data. Nothing fails; the bill arrives next month.

db.r6g.4xlarge in staging
p4d.24xlarge for a smoke test
no budget alarm declared
token cost

Loops nobody is watching

A vague prompt becomes fifty turns of the same failing approach. Cost per feature becomes unpredictable, and nobody can attribute the spend.

51 turns · same diff
2.4M tokens in 9 minutes
no stopping condition
02 · How it works

Two surfaces. Before execution, and after commit.

The editor plugin sits between the agent’s intent and your shell. The GitHub App sits between the branch and main. Same policy engine, two places to enforce it.

Where Oren sits

Six-step flow. One, the agent forms an intent in Claude Code or Cursor. Two, Oren evaluates it against policy, cost, and blast radius — Oren enforces here. Three, only what passed reaches the shell or cloud. Four, commit and pull request, your normal flow. Five, Oren reviews the pull request inline with its reasoning — Oren enforces here. Six, merge to main, followed by a weekly team report.

01
Agent intends
Claude Code · Cursor
02
Oren evaluates
policy · cost · blast radius
03
Shell or cloud
only what passed
04
Commit & PR
your normal flow
05
Oren reviews
inline, with reasoning
06
Merge to main
weekly team report
Oren enforces hereYour existing workflow, unchanged
03 · Editor plugin

Stops the call before it runs.

Installs into Claude Code and Cursor. It reads the tool call the agent is about to make, scores it against your policy, and either lets it through, rewrites the prompt, or blocks it with a reason. It also tightens vague prompts before they burn a hundred turns.

Blocks destructive tool calls and explains the blast radius.
Flags cloud and token spend before the call executes.
Rewrites vague prompts into scoped, checkable instructions.
Policy lives in your repository, reviewed like any other code.
prompt rewritten:
  − “fix the failing tests”
  + “run only tests/api/*, no network,
     report before editing”
04 · GitHub App

Reviews what already shipped.

Reviews pull requests for cost and blast radius, comments inline where the risk is, explains its reasoning rather than posting a score, and sends the team one weekly report on what agents actually did.

Reviews every pull request for cost and blast radius.
Comments inline at the line that carries the risk.
Explains its reasoning — no opaque score, no blocking merge.
One weekly report on what the agents actually did.
oren-agent commented on infra/rds.tf
cost db.r6g.4xlarge in staging is 8×
the production instance. ~$920/mo.
Was this intentional?
05 · Examples

Pick the one you’ve already lived through.

Illustrative traces. Commands and reasoning are real; figures are representative.

A cleanup that took the database with it

The agent was asked to remove an unused module. The plan also dropped the production Aurora cluster, because the module was referenced there.

caught by
editor plugin
signal
blast radius 34
action
blocked, plan offered
agent  → terraform apply -auto-approve
oren   ⊘ blocked · destructive
         34 resources destroyed
         aurora-prod: no snapshot 7d
         restore estimate: ~4h

oren   ✓ suggested
         terraform plan -out=tfplan
         review before apply

result   0 resources destroyed
06 · Security

A tool with repo access owes you specifics.

PII-redacted context only. What leaves your machine is the fragment under suspicion — the action a tool call performs, and the part of the architecture that looks risky. Never the file, its neighbours, or the repository.

Below is the whole answer, including the parts we have not decided yet. We would rather lose a signup than imply a guarantee we cannot make in beta.

Question
Answer
Status
What does it read?
The tool call the agent proposes, the diff in a pull request, and your policy file. Nothing else in the repository is read unless the diff references it.
defined
Where does evaluation run?
Policy and cost rules evaluate locally in the editor plugin. The GitHub App evaluates in our infrastructure, on the diff only.
defined
What leaves the machine?
PII-redacted context only, and only the specific fragment under suspicion: the action a tool call performs, and the part of the architecture that looks risky. Not the file, not its neighbours, not the repository.
defined
What is sent to a model?
That same redacted fragment — the action and the suspected issue. Never secrets, environment files, customer data, or whole-repository context.
defined
What is stored?
Decisions and their reasons, so your weekly report can be assembled. The retention window is not fixed during private beta — we will publish it before general availability.
not yet
Which credentials does it need?
The GitHub App requests read access to code and write access to pull request comments. No write access to code, ever.
defined
Can it be self-hosted?
Planned. The policy engine is designed to run without our infrastructure; the review service is not there yet.
not yet
Compliance posture?
No certifications during private beta. We will say so plainly until that changes.
not yet
07 · Roadmap

Ordered, not dated.

Early access changes this list. If the thing you need is in Later, tell us and it moves.

Now

  • Editor plugin for Claude Code and Cursor
  • Destructive-action blocking with blast radius
  • Cloud cost estimation on tool calls
  • Prompt tightening before execution

Next

  • GitHub App: inline pull request review
  • Weekly team report
  • Policy as code, versioned in your repo
  • Token budgets per repository

Later

  • Self-hosted policy engine
  • Organisation-wide spend attribution
  • More editors and agent runtimes
  • Custom rule authoring
08 · Early access

Let it write the code. Keep the veto.

We onboard in small batches so we can watch what the policy engine gets wrong on real repositories.

Want to describe your stack? Longer form
The portal lives at app.oren.run once you’re in.