Free and Open Source
The flanner CLI, MCP server, and web UI are free and open source (MIT). Mesh adds sync for one person or a whole team, starting with a 30-day trial.
Open source · MIT
Local
Everything the tool does today, on your machine
- Unlimited projects and plan files
- Every revision kept, numbered and attributed — full history, no hand edits
- Freshness status for every plan, backed by evidence
- MCP integration with Claude Code and Codex, set up by flanner init
- Agent integration: a guard hook, CLAUDE.md and AGENTS.md guidance, and two skills
- Personal and project memory, searchable, on your machine
- Flanner Curb: what your coding agents can reach, checked on your machine
- Local web dashboard and CLI tools
- Git protection for plan files
- Local SQLite storage, no account required
uv tool install flannerThen flanner init in a repository. Quick start
30-day free trial
Personal Mesh
Your own devices, in sync
Save 2 months by paying yearly
- Plans sync directly between your own devices
- Memories you share reach your other devices; personal memory stays on the machine that wrote it
- Up to 5 devices
- Devices sync while both are online; nothing is stored in between
- Flanner does not store your plan content
- Everything in Local
We take your card first and charge nothing for 30 days. Cancel before then and syncing pauses. Nothing is deleted — nothing was stored.
30-day free trial
Team Mesh
Team sync, without handing over your plans
Save 2 months by paying yearly
- Plans sync directly between your team's authorized devices
- No VPN, no open ports, and no administrator rights
- Flanner does not store your plan content
- Every version signed, so any device can verify its history
- Review and approval, with a clear accepted baseline
- Shared workspace memory, promoted explicitly
- Messages to teammates, inside Claude Code and Codex
- Organization, device, and access management
- Flanner Curb for the team: one agent policy, device reports and alerts
- Everything in Local
We take your card first and charge nothing for 30 days. Cancel before then and syncing pauses. Nothing is deleted — nothing was stored.
Talk to us
Organization
Contracts, onboarding and support for companies
- Guided onboarding and rollout
- Priority support with a stated response time
- A yearly contract and volume pricing
- Help with your security review
- An audit log of administrative actions
- Everything in Team Mesh
Single sign-on is on the roadmap. It is not part of the plan yet.
Free for teams
Flanner Curb for a team
One policy for your team's coding agents, and a view of where it holds. It needs a Flanner Mesh account, and no subscription.
Free
- One agent policy for every device, signed by your organization
- Device reports: each device's policy state, drift and counts of findings
- Alerts when what an agent can reach grows, to a webhook or Slack
- A registry of the keys your agents sign commits with
- Everything in Local, with Curb on each machine
Team Mesh adds
- Team sync: plans, shared memory and skills, device to device
- The encrypted relay, for machines that cannot connect directly
- Messages to teammates, inside Claude Code and Codex
Creating a team starts a 30-day trial of team sync. When it ends, the free column keeps working, and only team sync needs a subscription. A team without a subscription cannot invite new members. How it works
Frequently Asked Questions
Is flanner really free?
Yes. The CLI, MCP server, and local web UI are open source under the MIT license and free to use forever. You can read, fork, and self-host the whole thing from GitHub.
Do I need an account to use flanner?
No. The local tool stores everything in a SQLite database on your machine and works entirely offline. An account only comes into play with Mesh, later.
How do I install it?
Run uv tool install flanner, then flanner init in your project. It auto-registers with Claude Code and Codex. pip install flanner works too; uv gives the tool its own environment so nothing else can break it.
Which AI assistants does it work with?
Claude Code and Codex out of the box (via CLAUDE.md and AGENTS.md), plus any assistant that speaks the Model Context Protocol.
What is Flanner Memory?
Flanner Memory saves decisions, constraints and facts about your project as Markdown files in your repository. A later agent session can search them instead of asking you again. It refuses to store anything that looks like a secret, and personal memory is never shared.
What is Flanner Mesh?
A hosted tier for teams. Plans sync directly between your authorized devices rather than into our storage: Flanner Mesh manages accounts, billing, devices, and access, and never holds your plan content. Devices reach each other by key, so there is no VPN to install and nothing to open on your firewall. Personal Mesh covers one person on up to 5 devices, for $9 a month. Every plan starts with a 30-day trial. We take a card first and charge nothing until the trial ends.
Can my agent act on a teammate's message?
flanner tells it not to. The message arrives as a quote, with a note that it was only shown. What your agent may do on your machine is still set by its own permissions.
Do messages go through your servers?
No. They go from device to device. When no direct path works, a relay passes on the encrypted traffic without being able to read it.
How long are messages kept?
90 days, unless your organization's admin chooses 30, 180 or 365. Then every device deletes them.
What is Flanner Curb?
Flanner Curb shows what Claude Code and Codex can reach on your machine: which credentials each could read, and each channel that could carry them away. It is part of the free flanner CLI and needs no account. Run flanner curb map to see it.
Why does Flanner Curb rate most machines High?
One readable credential and one open network channel is enough, and most machines have both: a cloud or git login an agent can read, and web access or an MCP server with no limit on it. Curb counts a credential as wide when it cannot read its scope, and it does not count an approval prompt as a control. The report says which setting would close each open channel.
Why does a Read deny rule alone not protect a file?
A Read deny rule stops the agent's built-in file tool. A shell command such as cat, or a script, can still open the file. Only the agent's sandbox, set to deny that path, closes both. That is why Curb judges the file tool and shell commands as two separate channels.
What does “assumed” mean in a Curb report?
Curb took it from documentation, a default, or something it could not read, rather than from your settings. Anything it cannot read takes its worse value. An agent version other than the tested one makes every result assumed.
Why can my agent not call Curb as an MCP tool?
A map of the credentials an agent can reach is a target list for an agent that has been tricked. So Curb has no MCP tools. Your agent can run the commands in its shell, where you approve each one, and it gets back counts, never a name or a location.
Does Curb send anything off my machine?
No. It reads settings and credential locations on your machine, and its reports stay there. The one exception is a check you ask for: flanner curb sweep --validate sends a found secret to its own issuer, after asking you. On a team, a device you enrol also sends your organization a small signed report: versions and counts, with no names or paths.
Curb found a secret in a transcript. Why rotate it now?
A transcript is what your agent sent to its model provider. A secret in one has already left your machine, so deleting the file does not take it back. Curb puts these in class A, sent to a model provider, and says to rotate now.
Does Curb ever print a secret?
No. No command prints a secret's value, and no value is stored. The sweep prints counts. Types and locations open in a window on your own screen, and the value is not shown there either.
What does flanner curb sweep --validate send, and to whom?
Each secret the sweep found, to the issuer its type names, to ask whether it still works. Nothing goes to flanner. It happens only when you pass --validate, and Curb asks you again on every run.
What does flanner curb forget delete?
Everything Curb keeps on your machine: its redacted reports, and the key behind its fingerprints, so older fingerprints can no longer be matched. It also removes the decoys a test planted. It asks separately about settings backups, because they are the only undo for a fix. The action log goes too.
Curb says a channel was “not seen”. Can I close it?
Not on that alone. Not seen is not the same as not needed: the log may be too short, some sessions may have run without the hooks, and the hooks cannot see everything. Curb lists such a channel for you to review, and never closes one itself.
Does Curb's action log hold my prompts?
No. A record is metadata: the agent, the tool, the channel, the kind of target with a fingerprint of it, the decision and the time. No prompt, no reply and no file contents.
What happens if a Curb hook fails?
Your agent carries on. The hooks fail open: a tool call that cannot be logged goes ahead unlogged, and observed use counts that session as unlogged.
What does a Curb fleet report hold?
The device id, a sequence number, the time, each agent's name and version, the policy state, and counts of findings by severity and exposure class. No paths, usernames, hostnames, repository names or fingerprints. Each device signs its own reports, and an admin's flanner curb fleet checks those signatures itself.
Why does an expired agent policy stay in force?
The other choice is a device that weakens itself when a date passes. An expired policy is flagged as expired and kept until a newer one arrives. A device never falls back to weaker settings on its own.
Why do some policy changes wait for me?
A change applies on its own only once you have enrolled, and only if your device can show that it only tightens your agents' settings. Anything else waits for your approval on that device: a change that would open a channel wider, one whose effect Curb cannot work out, or one for an agent version it has not tested.
Why does an agent step triggered by an issue rate High?
Anyone can write an issue or a comment, so that text is untrusted input reaching the agent. If the step also holds secrets, a token it can use or an unsafe mode, and nothing blocks its outbound traffic, an injected instruction has what it needs. That is rule CI-H1.
What do Curb's CI fixes change?
Only one-line edits that are safe without a person. They remove allowed_non_write_users, turn Codex's unsafe safety strategy into drop-sudo and danger-full-access into workspace-write, and drop --dangerously-skip-permissions and --yolo. They edit the workflow files, and you open the pull request.
Why does the app audit mark everything “assumed”?
It finds LLM calls in Python code by pattern matching. That is a starting point for a review, not proof, so every result is marked assumed. Its SARIF output is there to hand deeper analysis to tools such as Semgrep or CodeQL.
Can I pay yearly?
Yes. Paying yearly costs $190 a seat instead of $228, which is 2 months free. A seat is an accepted member, so invitations cost nothing until somebody takes one up.
Why is there a $2 charge when I sign up?
Some cards can only be saved by charging them, so we charge $2 to check yours. It comes off your first bill. If you cancel during the trial, or do not finish signing up, we refund it.
Can I contribute?
Absolutely, it's open source. Open an issue or PR on GitHub.
Start in one command
Free and open source. Nothing to sign up for.
uv tool install flanner