Coding agents

Atmos scans after every agent turn that changes files and sends new findings back to the agent, which fixes what it just wrote before it finishes.

Set it up#

Install atmos and sign in with the Quickstart, or run atmos self-update if atmos is already installed, then run this once in each repository:

atmos agent setup

Setup writes these hook files, installs the Atmos skill and lists every file it wrote. Setup writes the Codex and OpenCode files only when it finds those agents on your machine or in the repository.

Setup adds these files to the local exclude list of your git repository, so only you get the hook and your teammates see no change. Each teammate who wants the hook runs atmos agent setup on their own machine. Run it again after you install another agent.

What happens after a turn#

When an agent turn that changed files ends, Atmos scans the repository and sends the new findings back to the agent as a list, and the agent fixes them before it finishes. Findings that were already there are not sent again. Agent turn scans keep the findings on your machine.

Claude Code, Codex and OpenCode show you notes from Atmos. At the end of the first agent turn after setup, Atmos records every finding the repository has, including any from that turn, and shows you one note. When the repository has findings, the note gives their count. Run atmos scan . --no-upload to see them. After Atmos or its rules update, the next agent turn that changes files starts over the same way, with one note.

Atmos sends findings back at most three times in a row, then shows you a note and lets the agent finish. A new known vulnerability in a dependency the turn did not change reaches you as a note instead of going back to the agent. When a scan cannot run, for example because this machine is not signed in, Atmos shows you one note with the reason and never holds the agent back.

The Atmos skill#

Your agent reads the Atmos skill when you ask for a security scan, when the hook sends findings, or when you want a rule for your own conventions. The skill teaches the agent to fix the cause, to ask you before it treats a finding as intended, and to never weaken a rule to hide a finding.

Setup installs the skill in ~/.claude/skills/atmos/ and ~/.agents/skills/atmos/, where every supported agent looks for it. Without a network connection, setup installs the hook and tells you to run it again for the skill.

Turn it off#

Delete the Atmos entry under hooks.Stop in .claude/settings.local.json and .codex/hooks.json, and delete .opencode/plugins/atmos.js. To remove the skill, delete ~/.claude/skills/atmos/ and ~/.agents/skills/atmos/.