Mission Control
A phone remote for coding agents on your own models —
self-hosted, with approval gates.
Ask your lead agent from the couch, watch every edit land as a live diff,
answer its questions with a tap — and keep the risky steps behind your
approval. Runs on your hardware, prefers your local models, AGPL —
with a one-click model recipe for NVIDIA DGX Spark.
Spark recipe · Install · What it does · Maturity ·
Docs · Roadmap · Community
One-click local AI on DGX Spark
Pick a recipe on the Runtimes page and click Install — the recipe
downloads the weights and sets up its engine while MC shows the live install
log. For two-box recipes MC picks a free second box and wires it in. One
click on Start switches a box (or a pair) to another recipe; a switch
lock refuses it while the engine is still serving requests.
| Recipe | Boxes | Engine | Measured on 2× DGX Spark |
|---|
| GLM-5.3-Flash · EXL3 4-bit · TensorFold | 2 (tensor parallel) | TensorFold | 62.6 tok/s single stream · 211 tok/s at 16 parallel · 1M context per request · prefill ~1,800 tok/s |
This is the recipe MC ships today; more recipes are on the way and land in
the same catalog. The recipe builds on other people's engines, quants and
models — see CREDITS. Note: the GLM recipe's default speculative
drafter is licensed CC BY-NC-ND 4.0 (non-commercial); a licence-free drafter
option exists. Numbers: our own benchmark (tokens counted from the
API's usage, greedy, 512-token answers, on our own 2× DGX Spark pair,
08 Oct 2026); the same weights on the plain vLLM recipe reach 34.6 tok/s —
the dedicated recipe is ~1.8× faster. Catalog status: this entry's
gb10_validated flag is currently false — the catalog's own marker for
"actually watched running on a GB10 box" is not yet set for this recipe,
even though the numbers above come from a real run; if you install it and
hit a mismatch, open an issue with your own numbers. How it works:
ADR-077
· Runtimes.
Why
Coding agents are good enough to work while you are away from the desk.
The tools around them are not:
- You can't see what they do. A terminal on another machine is no use on
a phone. MC turns the agent's work into a chat you can read anywhere:
every tool call, every edit as a diff, every file it touched.
- You can't step in. When an agent asks a question or wants approval, it
waits — until you are back at a keyboard. In MC the question arrives as a
card on your phone; you tap the answer and it carries on.
- Your code and prompts go to someone else's cloud. MC is self-hosted.
Point the local agent at your own GPU box (vLLM, LM Studio, Ollama, any
OpenAI-compatible
/v1) and that work never leaves your network.
- "Autonomous" usually means "unsupervised". In MC, agents ask before
risky actions — deploys, config changes, external posts — and your
autonomy level decides whether that becomes a card you have to approve.
MC also tells you exactly where the tokens went.
What it does
MC is built around two fixed agents and one chat to steer them:
- a lead agent — your right hand, on Claude Code or on a local model;
- a local omp agent — small jobs on your own GPU box, driven over ACP.
Watch every edit as it happens
Live tool output, a diff for each edit, file chips and the session cost —
in the chat, on phone and desktop. The Changes panel lists what this chat
changed, file by file, with Revert, Commit and Open PR.
The commit message is suggested by your local model when one is set up
(otherwise MC writes a plain summary). The commit stays on your machine until
you open the PR.
Answer questions and approve plans from your phone
The local omp agent can stop and ask. Its questions arrive as question
cards; in plan mode it writes a plan first and waits for Approve,
Refine or Cancel. Screenshots taken by browser tools show up right on
the tool card.
Phone use is monitor and steer: read, answer, approve, stop, send the
next instruction. Full editing stays at the desk. MC installs as a home
screen app (PWA manifest); it is not an offline app.
Optional: talk to it
Call your lead agent from the chat and give instructions by voice. This uses
OpenAI Realtime with your own API key and has a daily budget cap
(default 5 USD). It is off by default (VOICE_LIVE_ENABLED) and in preview
(ADR-091, still Proposed). On a phone the
browser only allows the microphone over HTTPS — see
Reverse proxy & remote access.
Local first, honestly
Your GPU boxes show up as runtimes with model, context, speed and load.
For each agent you choose the runtime yourself; heads (preview) pre-select a
local runtime when one exists. There is no automatic fallback from local to
cloud yet.
Not every coding tool runs on every model. The matrix shows what works
today — and says no, with the reason, where it doesn't:
- Claude Code runs on Claude. It uses your own Claude Code login. Check
your plan's terms for automated use.
- Local models run through omp or OpenClaude. Claude Code on a local
model is not offered for agents.
- Switching an agent between runtimes goes through one switch service with a
health check and rollback.
Details: Runtimes ·
Run agents on a local LLM.
Guardrails
Agents ask MC before risky actions, and your settings decide what happens:
- Autonomy levels per action. For each kind of action you choose
Auto (done), Notify (done, and you are told) or Approve (a card that
waits for you). Deploys, config changes and external posts are set to
Approve by default.
- Approval cards. An action set to Approve becomes a card in your inbox
— one tap to allow or refuse, from the phone too.
- Honest limit: this gate works because the agent asks. MC does not yet
block an agent that skips the question, and the local omp agent runs its
own tools without per-call prompts. The enforced gates today are the ADR
gate below and your Git host's branch protection.
- ADR gate. A pull request that changes a decision record cannot merge
until you have approved that exact text. Editing it afterwards voids the
approval.
- Git, not magic. Work lands on branches and pull requests. Merges use
the GitHub CLI (
gh pr merge --squash) and respect your branch protection
and merge queue. There is no merge button in the phone chat.
See where the tokens go
Insights shows tokens per day, the share that ran locally, where usage
comes from (lead agent, omp agents, heads, you) and the local share per
week. Costs are shown at list price, even on flat-rate plans, so you can
compare. The chat's context ring shows the prompt cache hit rate.
The numbers in this picture are demo data.
What is stable and what is not
MC is changing direction (ADR-085,
ADR-089,
ADR-090): away from a
permanent fleet of named agents, towards one lead agent, one local agent and
the chat as remote control. Here is where each part stands.
| Status | What | How to get it |
|---|
| Stable | Core stack (boards, tasks, inbox, memory/vault, runtimes, insights, settings) · autonomy levels, approval cards, ADR gate · runtime switch with rollback | Default install |
| New (Oct 2026), live | Chat with live diffs and Changes panel (Revert / Commit / Open PR) · question cards and plan mode for omp agents · tool screenshots. In daily use; the phone acceptance check and reliability work are still open (ROADMAP) | Default install |
| Preview, opt-in | Heads — one short-lived coding session per job, in its own git worktree, ending in a PR and a run record | HEADS_ENABLED=true · macOS host (launchd + sandbox profile) |
| Preview, opt-in | Night shift — "run tonight" jobs and a morning report | NIGHT_SHIFT_ENABLED=true · needs heads, so macOS host |
| Preview, opt-in | Live voice in the chat (ADR-091) | VOICE_LIVE_ENABLED=true + OPENAI_API_KEY · daily budget cap · HTTPS on the phone |
| Frozen | The persistent agent fleet (dispatch, healers, group chat) · Skill Lab, ClawHub and plugin management | Still in the code, no new work; being removed step by step (ROADMAP E5) |
Fresh installs still start with the classic board. The first-run wizard
offers a demo board with a small demo crew of agents and sample tasks. That
is the older picture of MC. The two-agent setup above is not created by the
wizard yet — the quickstart walks you
through it.
Install
You need: git, curl, openssl and Docker with Compose v2. The installer
checks all of them at once and prints the exact command for anything that is
missing — it never installs system packages on its own.
# Debian / Ubuntu / Raspberry Pi OS
sudo apt update && sudo apt install -y git curl openssl
curl -fsSL https://get.docker.com | sh && sudo usermod -aG docker "$USER" # then log out and in again
# macOS: install Docker Desktop (and git via Xcode tools or Homebrew)
Then:
curl -fsSL https://raw.githubusercontent.com/argyelan-ai/mission-control/main/install.sh | bash
The installer installs the latest release — code and prebuilt images of
the same version (amd64 and arm64), so nothing has to be built. It writes
.env with fresh secrets, starts the stack and prints the address to open.
Developers who want main can pass --channel edge (built locally, not for
everyday use). Update an install later from its folder with
curl -fsSL https://raw.githubusercontent.com/argyelan-ai/mission-control/main/install.sh | bash -s -- --update
(never downgrades). Release rules: ADR-092.
On a server or a Pi without a screen the installer notices and asks
whether you will open MC from another device. If yes, it creates the first
admin account right there in the terminal (password hidden) and only then
opens MC to your network — nobody else on the LAN can grab the admin account.
Flags: --remote, --public-host <address>, --local. Prefer to keep MC
private? Use an SSH tunnel (ssh -L 8080:localhost:80 you@server, then open
http://localhost:8080) or Tailscale
(tailscale serve --bg 80, with sudo on Linux). Raspberry Pi notes (8 GB, SSD, memory cgroup):
docs/setup/raspberry-pi.md.
On Linux, MC runs as your own user id (PUID/PGID in .env, set by the
installer). If /health reports degraded, the message says what to fix.
Run one-off commands as that user: docker compose exec -u mcuser backend ….
After the first login the setup wizard opens by itself and stays until
it is done. After the install, no agent is running yet. To get a lead
agent and a local omp agent you can steer from the chat, follow
Quickstart: install to your first remote-controlled agent.
Reach it from your phone
Keep MC off the public internet. The easiest way to your phone is
Tailscale: tailscale serve --bg 80 (sudo on Linux) gives you an
HTTPS address inside your tailnet without opening MC to the LAN — HTTPS is
also what voice on the phone needs. Add MC to your home screen to use it as
an app. Other options (LAN address, your own reverse proxy):
Reverse proxy & remote access.
Platforms
| Platform | Path | Notes |
|---|
| macOS | the one-liner | Everything, including heads and night shift (preview) |
| Linux server / NAS | the one-liner | Core stack and Docker agents; no heads or host agents (they need macOS launchd) |
| Windows 10/11 | .\setup.ps1 — sets up WSL2 + Docker, then runs the installer (guide) | Same as Linux |
| Windows Server / company VM | a small Linux VM next to your Windows VMs (guide) | Same as Linux |
| Runtipi | community app store | Core stack only |
| Portainer | deploy/catalogs/portainer-template.json as an App Template source | Core stack only |
| Umbrel / CasaOS | manifests prepared in deploy/catalogs/, not submitted | — |
Catalog installs run the core stack. Agents, heads and host-level extras
need the full install.
How it fits together
- Backend: Python 3.12, FastAPI, SQLModel, PostgreSQL 16, Redis 7,
Qdrant, Alembic, server-sent events.
- Frontend: Next.js 15 (App Router), TypeScript strict, Tailwind CSS v4,
TanStack Query.
- Infrastructure: Docker Compose, Caddy. The backend reaches Docker only
through a filtering socket proxy.
Full map and "where do I change what": docs/ARCHITECTURE.md.
Docs
Where it's going
No dates are promised; stages move when their acceptance check passes.
Next in the chat: session list, resume and fork (P4), sending images,
installing plugins, skills and MCP servers through an approval card. The
lead agent's own merge and deploy gate is planned and not built yet. Full
status: docs/ROADMAP.md.
Built in the open
- 90 decision records in
docs/decisions/, each with
its reason. Some are still Proposed; the status line says which.
- 10,000+ backend and 3,000+ frontend tests, and a CI pipeline that
boots a fresh install end to end.
- Secure defaults: ports bind to localhost until you opt in (the
opt-in
voice profile's LiveKit media ports are the exception),
Docker only through a filtering socket proxy, secrets encrypted with
Fernet. Reporting a vulnerability: SECURITY.md.
Development:
cd backend && python3.12 -m venv .venv && source .venv/bin/activate
pip install -e ".[test]" && pytest -q # backend
cd frontend-v2 && npm install && npm run test:run # frontend
make help lists the common entry points. Rules for contributors and coding
agents: CONTRIBUTING.md · AGENTS.md.
Language note: the project grew in a German-speaking home lab. Many ADRs
and some code comments are German; the UI, README and setup are English
(the UI also ships in German).
Community
Credits
Mission Control's DGX Spark recipe builds on GLM-5.3-Flash by Z.ai, the
EXL3 quantization format and ExLlamaV3 by turboderp, the TensorFold engine by
ashhart, the DFlash2 drafter by Inco AI and the recipe work of Mia's AI Lab.
MC drives the coding harnesses Claude Code, OpenClaude, omp, Hermes Agent,
Kimi Code and Grok Build. Full list with licences and links: CREDITS.md.
License
AGPL-3.0 — see LICENSE. Use it, self-host it, change it. If you
distribute a modified version or offer it as a network service, share your
changes under the same license. For commercial licensing beyond AGPL,
contact the maintainer.
