> ## Documentation Index
> Fetch the complete documentation index at: https://agmxcode.com/llms.txt

# What the server sees

> Most tools that orchestrate agents over your code need a copy of your code.
> AGMX does not, and this page is the factual accounting: every field that
> crosses the boundary, the details worth knowing, and how to verify all of it
> directly.

## Every route your machine speaks

Your machine only ever talks to your team's server through six HTTP routes.
They are all in one file in the runner, `client.py`, about 140 lines. Nothing
else in the package opens a connection.

| Route | Direction | What it carries |
|---|---|---|
| `/runner/enroll` | out | Hostname; for each checkout: `project_id`, its absolute path on your machine, and its git remote URL with any credentials stripped; whether this machine accepts teammates' work |
| `/runner/lease` | out, then in | Out: your runner id and which CLIs are installed. In: a `project_id`, a command to run, a base commit, an MCP config |
| `/runner/heartbeat` | out | Your runner id and the ids of the runs it is executing right now |
| `/runner/output` | out | The agent's stdout and stderr, in batches, as the run goes |
| `/runner/result` | out | `status`, `exit_code`, `base_sha`, `head_sha`, `timed_out`, `error` |
| `/runner/land` | out | The merge commit, or the reason there is none; the list of file **paths** the merge changed; a sha256 for each spec anchor named in the offer |

That is the complete list. Research runs by subagents follow the same routes
and rules. There is no route that sends a file, a diff or a tree, because no
part of the server has anywhere to put one.

## What never crosses

- **The repository.** The server does not clone, does not fetch, and has no
  worktree. Planning, critique, execution, and review all happen on the
  developer's machine.
- **File contents.** Nothing on the wire carries source code. The only code that
  reaches the server is text the agent outputs to stdout or stderr, discussed
  below.
- **The code graph.** Every run gets a code graph of its own checkout, built
  and used on the developer's machine, and never sent to the server. Agents query
  it locally to inspect impact and search code by meaning.
- **Your CLI credentials.** Your `claude`, `agy`, `codex`, `kimi`, `qwen` and
  `opencode` sessions stay in your home directory. The server never receives
  them and never asks. Runs are billed to your own subscription, which is also
  why AGMX cannot mark up your tokens or steer you towards a particular model.
- **Your git credentials.** Your machine fetches, merges and pushes. The server
  is handed no key and no token for your remote — which is exactly why it can
  only learn a merge commit's SHA after the fact.
- **A directory to work in.** The server names a `project_id` and nothing more.
  The map from `project_id` to a real path exists only on your machine, in
  `~/.agmx`. An id your machine does not know is reported `failed` rather than
  guessed into some path.
- **Runner update packages.** Self-update installs from the machine's own package
  index, not from the team's server.

## Details worth knowing

A complete accounting of what reaches the server includes the operational
metadata needed for coordination, logging, and review:

**The agent's log is stored on the server.** Stdout and stderr stream back and
are kept, because you need to read what the agent did and the reviewer needs to
read it too. If the agent prints a diff, a file or a stack trace, those lines
are on the server. The only thing removed is the run's own MCP token, redacted
line by line before the batch is sent. So the accurate claim is narrow: the
server never *fetches* your code; it stores whatever the agent chose to print.

**Path names travel at landing.** The merge reports which files changed, by
path. Directory and file names describe a codebase even when the contents do
not follow.

**Spec anchors travel as hashes.** When a task is linked to a spec item
anchored at a path plus a symbol, the runner extracts that symbol's source,
normalises it and sends a sha256. A hash confirms whether an anchored symbol has
changed, without transmitting its body.

**Your checkout's absolute path is registered.** `/home/you/work/thing` is on
the server, because a person looking at a stuck run needs to know which
directory on which machine.

**`--serve-team` changes who runs what.** Off by default. Turned on, a
teammate's task can run on your machine, under the CLI subscriptions signed in
there, with your user's privileges.

**This is a boundary in software.** It holds because the runner is the only
thing on your machine that talks to the server, and you can inspect the runner's
source code directly.

## How to check it yourself

1. **Read the runner.** `pip download agmx --no-deps --no-binary :all:` gets you
   the source distribution — with `httpx` as the only dependency. Start at
   `client.py`: if a field is not constructed there, it never leaves.
2. **Watch the socket.** The runner speaks plain HTTPS to one host. Point
   `mitmproxy` or your own inspecting proxy at it and compare what goes past
   with the table above.
3. **Check the digests.** Every release on
   [PyPI](https://pypi.org/project/agmx/) publishes a wheel and a source
   distribution with a sha256. Pin the version; verify the hash.
4. **Read your own server's rules.** `<team>.agmxcode.com/coordinator-rules.md`
   and `/install.md` are public on your install, generated from the version it
   is running.

## Guarantees enforced by the database

Key workflow rules are enforced directly by the database schema rather than only
by process:

**Four eyes.** A task whose executor and reviewer are the same person cannot
exist. A database rule enforces this on the tasks table and on the gate
ledger. An agent cannot approve its own work because the database rejects the write.

**An append-only gate ledger.** Gate records can be inserted and never modified
or deleted. Every dispatch, every review order, every verdict is a row with who
asked, who decided and when — and the history cannot be altered afterwards.

**Brakes that meter people.** Cost and token ceilings per task are easy to
evade by making more tasks, so AGMX also meters the person who requested the
work: cost and tokens over any rolling 24 hours, and how many runs they may have
executing at once. Work done through a CLI subscription counts too, priced from
what the CLI itself reports.

Next: [install it](/install/), or read [the workflow guide](/workflow/).