Solutions

One doctrine, scored the same way on every machine.

A written policy that nothing checks is a document. A pack of shell probes is the same policy with a number attached, and the number moves for reasons anyone on the team can read.

One pack, three laptops, the same arithmetic A single rule pack checked into git, reaching three laptops that each score themselves locally and arrive at the same number. No score is uploaded. ONE PACK checked into git LAPTOP 1 LAPTOP 2 LAPTOP 3 68 / 100 68 / 100 68 / 100 same probes, same arithmetic, no score uploaded what does not travel is the result

Bring your own pack

Every rule is an editable shell probe. Write the team's rules, weight them by what they cost when they fail, and the score follows your pack rather than ours.

A profile per agent

Each agent gets its own policy-engine endpoint and key for reaching your linked accounts — tool calls only; prompts and model traffic never pass through it. If one leaks, revoking that profile affects nothing else, and an agent is never shown tools for an account it may not use.

Changes become events

A settings file whose fingerprint moved, a hook that disappeared, a policy edited with nobody at the keyboard. Named at the next scan rather than at the next review.

Agent Access: accounts linked once, not once per agent

Agent Access, added in 1.0.240, is an optional local gateway. You link Google, Microsoft 365, Notion or Slack once. The sign-ins stay in your macOS Keychain. Each agent gets its own profile, key and local URL, and every call is logged on your device. It carries an agent’s tool calls to those accounts, not model traffic. Nothing is pooled in a Mockingbyrd cloud.

The usual shape is every agent holding its own Google, Microsoft, Notion and Slack grants, which means the answer to what can our agents reach lives in four consoles and three laptops. The policy engine is one local endpoint every agent points at: accounts linked once, then per agent what it may see and what it may do there, default deny, scoped and expiring grants, and an audit line per call.

Where those sign-ins live. You authorize each service once, in that service’s own consent screen, and the resulting token is held in your device’s Keychain. There is no Mockingbyrd account holding them and no copy on a server of ours; the endpoint every agent points at runs on the same machine. That is a different thing from the Mockingbyrd account the next section says does not exist — this one is your account with Google or Slack, used from your own machine.

The uncomfortable part, first

There is no fleet console. Each machine scores itself locally and keeps its own history; no score is uploaded, there is no Mockingbyrd account, and no central place shows you nine laptops at once. That is a deliberate consequence of a product whose argument is that what it measures does not leave the machine, and it is the thing to weigh before rolling this out to a team.

What a team does instead: each machine keeps its last sixty scans as plain JSON in the operator’s own home folder, so a team that wants a shared view collects those files the way it already collects anything else from a laptop and reads them with its own tooling. Mockingbyrd does not do that collection for you, and nothing is built to.

What travels is the pack. A rule file is text: check it in, review it the way you review anything else, and everyone runs the same probes and gets a number computed the same way. What does not travel is the result.

The failure a team actually hits

Not an exploit. An allow list that held 85 entries after a cleanup and 107 thirteen days later, each entry a reasonable click at the time, one of them a network tool that turned broad read access into a way off the machine. Nothing reviews the list as a whole — every approval is judged on its own, never against what is already granted. Read the allow-list case study.