Built to run on your machine, with you in charge

Where things run

DevMayor has two parts on your Mac: the app you look at, and a runner that starts agents and keeps their history. The runner listens on 127.0.0.1 only. Every request needs a random bearer token stored in a file only your user can read, and only the app’s own origin is allowed.

Agents are the official CLIs — Claude Code, Codex, Gemini CLI, OpenCode — started in your project folders. DevMayor never reads or stores their logins.

Keys and tokens

• API keys, bot tokens, MCP tokens and service credentials are stored in the macOS Keychain, passed over stdin, never on a command line.
• Per-run config files for agents reference environment variables only; the secrets travel in the agent’s environment and the files are deleted after the turn.
• In subscription mode, API-key variables are removed from the agent’s environment, so a stray key in your shell cannot start a per-token bill.
• Git hosts: your existing gh login or SSH keys are used first. When a token is needed for HTTPS it is passed in the environment — never written into a URL or .git/config.

What agents can do

• Each agent has an autonomy level — plan, edit or full — and anything beyond it becomes an approval for you.
• Agents cannot run git push. Pushing and deploying are buttons.
• With a branch per task, agents work in separate git worktrees; your main checkout is untouched until you merge.
• The mayor delegates but cannot approve requests, merge, commit, push, or change servers, connections and keys.

Servers

Servers you add are stored as an address or an ~/.ssh/config alias plus the path to a key in ~/.ssh — never the key itself, never a password. Commands run with ssh -o BatchMode=yes, with an output cap and a time limit. You choose per server whether agents may only run the configured deploy command or any command.

Skills and tools

Skills are installed from the CodexGuild registry only after each file’s sha256 matches the scanned version. MCP connectors are tested with a real handshake before they show as connected, and agents still ask before tools that change data.

Messaging

A Telegram or Discord bot is paired with exactly one chat using a six-digit code. Messages go to the mayor; approvals and results come back to that chat only.

What leaves your Mac

Prompts and code context go to the AI provider you chose, through its own CLI or API — the same as using that tool directly. DevMayor fetches public model lists, the skills you install and the signals you link (Sentry, Google, GitHub, npm). There is no DevMayor cloud that receives your code.