Resin turns repeated coding-agent workflows into reusable tools. It works with Claude Code, Codex CLI, Oh My Pi, Pi, Cursor CLI, Grok Build, Muse Code, OpenCode, and GitHub Copilot CLI through a local MCP gateway.
- Turns recurring coding-agent workflows into qualified tools
- Runs tools with filesystem, network, command, and secret limits
- Pins tool versions and SHA-256 digests in
.resin/resin.lock - Keeps raw prompts, transcripts, and source code on the local machine
- Continues serving locked tools while offline
Resin requires Node.js 22 or newer and supports Linux, macOS, WSL2, and native Windows 10/11 on x64 and arm64.
curl -fsSL https://resin.sh/install.sh | shRun in Windows PowerShell 5.1 or PowerShell 7+; no WSL2 or administrator rights needed:
irm https://resin.sh/install.ps1 | iexResin installs to %USERPROFILE%\.resin (or RESIN_HOME), adds resin to your user PATH, and runs its background service as a per-user Scheduled Task that starts at logon. To install into WSL2 instead, run & ([scriptblock]::Create((irm https://resin.sh/install.ps1))) -UseWsl.
The installer prompts for device authorization, configures detected coding agents, starts the local service, and verifies the installation.
Check the local service and gateway:
resin statusResin detects the current project when a supported coding agent starts. It creates two files in the project root:
.resin/
├── project.json # Project identity
└── resin.lock # Pinned tool versions and digests
Ask your coding agent to search for a tool:
Search for tools that can inspect this repository's structure.
- Resin observes supported coding-agent sessions locally.
- Repeated workflows become candidates for reusable tools.
- Candidates are qualified and versioned before activation.
- The local MCP gateway makes active tools available to coding agents.
- Each tool runs within its declared capability limits.
With metadata sharing enabled, workflow links identify shared files or issues using temporary labels—not paths, repository names, issue numbers, contents, or hashes of those values. Only completed, successful steps count as workflow evidence. These links never grant tool permissions.
Recorded output observations share only a JSON type and whether meaningful output was present; the values and program source stay local. Native command output is associated with its original call even when completion arrives late, without replacing a recorded failure or treating the child command as another call.
Capture retains bounded, dependency-closed subworkflows without rewriting the original recording. Ordinary non-program data arguments can suggest typed caller inputs without sharing their values; prior-result bindings take precedence. These remain proposals until independent recorded variations distinguish the bound workflow from the original literals.
A captured baseline can request validation, but it cannot prove correctness or establish new input bindings. Validation executes nothing recorded: it resolves every step's call as an invocation would, requires it to equal the call this device recorded for that step, and binds the result to the exact plan digest as a recording proof. Recorded values are read only from the local private store, never from the plan. Invoking a published tool runs its recorded commands directly, by design; the calling harness's own permission policy governs that tool call, as for any MCP tool, and Resin adds no approval or consent step of its own.
Every coding agent sees four stable MCP tools from Resin: search_tools to discover tools, get_tool_schema to inspect their inputs, invoke_tool to run them, and manage_tools to manage them. Learned tools are not listed one by one, which keeps each session's prompt small; agents find them with search_tools, and newly available tools are reached through these same routes without restarting the session. resin mcp --full-catalog lists every tool instead (--search-listing, the former opt-in, is accepted and does nothing).
Oh My Pi supports deeply nested workspaces with bounded, deterministic workspace IDs. Existing IDs within the shared 128-character limit remain unchanged; longer paths use a readable prefix and a path-derived hash.
For Codex CLI 0.156.1 rollouts, the local observer decodes native session_meta, response_item, and event_msg records for session lifecycle, model context, messages, tool calls/results, and reported token usage. Structured item_completed / CommandExecution items retain their native argv, working directory, outcome, output, and duration; only terminal status with explicit exit code produces a command event. A restricted, single-awaited-tools.exec_command code-mode wrapper followed by text(result.output) is parsed locally (never executed as JavaScript). A unique compatible native command start inside that wrapper's call-to-reply window may associate the two observations, including command completions arriving after the reply. Unrecognized, overlapping, yielded, or missing-start cases remain unassociated. The operational association carrier contains only bounded IDs, times, and its rule; script, command, working directory, and output remain local and are not exported as association metadata. Failed wrappers and native nonzero exits keep their separate outcomes. Missing status and usage are not treated as zero or success; unsupported records remain available as unknown events rather than inferred activity.
Matching is derived evidence, not a parent ID recorded by Codex. Supported wrappers run the original command through /bin/bash -lc; an omitted working directory is taken only from recorded session or turn context.
After a connection's initial catalog baseline, Resin includes a brief notice of catalog changes in the next successful Resin tool response. Notices coalesce pending changes: new or updated tools include names and short descriptions from the connection's visible catalog; removals receive a generic notice. Notices are bounded and do not include tool arguments, results, or secrets.
No custom harness, extra daemon, refresh script, or repeated configuration edits are needed. Reconnect to the updated server once after a software update to use this behavior. Codex's native permission choices still apply: read-only discovery does not authorize execution or management. Resin cannot send an unsolicited model message; the agent must first interact with Resin, and it is not guaranteed to search for or use Resin on every task.
- Getting Started
- Configuration
- Coding Agent Integrations
- Security and Privacy
- Troubleshooting
- Architecture
Resin uses Node.js 22+, pnpm 10+, and a pnpm workspace.
git clone https://github.com/Resin-AI/resin.git
cd resin
pnpm install --frozen-lockfileRun the full verification suite before opening a pull request:
pnpm check:allRead CONTRIBUTING.md for development commands, package boundaries, and pull request requirements.
apps/ CLI, gateway, observer, and web applications
packages/ Runtime, protocol, contracts, crypto, and shared libraries
adapters/ Coding-harness integrations (Claude Code, Codex, OMP, Pi, Cursor, Grok, Muse, OpenCode, Copilot)
fixtures/ Conformance and end-to-end fixtures
docs/ User, architecture, security, and operations documentation
scripts/ Build, verification, release, and repository tooling
Report vulnerabilities using the process in Security Vulnerability Reporting.