Your coding agents in your infrastructure. Driven, governed, measured.

Your developers already use agents. Each in their own terminal.

Coding agents came into teams through workstations, before any shared framework.

No visibility

Who ran what, on which repository, with what result: nothing is in one place.

No shared rules

Every workstation has its own permissions, secrets and habits. What an agent may do depends on who started it.

No known cost

Tokens are spread across subscriptions and API keys, with no view by team, model or project.

Agents run on your side. SideHub drives them.

The cockpit decides what to run, where and when. Your machine runs it, and keeps the code, the secrets and the model traffic, under your own licenses.

Security, point by point

What your security review will ask, and what exists today.

Outbound connection only

The agent opens an encrypted WebSocket on port 443. No inbound port, no VPN.

An open source agent

MIT license: read what it sends, build it yourself, deploy your own build.

One token per run

Each run gets its own token, which expires with it. It cannot approve an action, edit a workflow or administer the workspace.

Declared, masked secrets

Only the secrets the workflow declares reach the run, and their values are replaced with *** in the output.

Roles per workspace

Owner, Admin, Member, Collaborator, Viewer. Only the first three open terminals and start workflows. Each workspace is isolated server side.

No root by default

On Linux and macOS, the agent refuses to run as root without an explicit option. Its token only acts on itself.

Govern and measure

Delegate to agents without losing control, and know what they do and what they cost.

Govern

Approvals

A step or a sensitive action waits for a person’s decision, and the decision keeps their name.

Tool policy

Allow, deny or ask, tool by tool, for each workflow. Call-by-call control with Claude Code, a restricted mode for the other CLIs.

Allowed MCP servers

Each workflow declares the MCP servers it may use, and nothing else.

Who ran what

Each execution keeps the person who started it, or the scheduler, webhook or event behind it.

Measure

Every run tracked

Real status, duration, end reason, exit code and last lines on failure.

Usage from every angle

Tokens by day, workspace, repository, agent, model and person.

An estimated cost

At API prices, and as an API equivalent for subscriptions, to compare like with like.

Visibility you choose

Costs are visible to Owners and Admins, to Members if you allow it. The per-person view stays with the Owner.

Your licenses, not ours

SideHub does not resell model access. It only bills the cockpit.

Copilot for business, checked machine by machine

Sign GitHub Copilot CLI in with your organization’s account: its data and model policies apply. SideHub shows the account, plan and organization of each machine, and flags the ones running on a personal subscription.

Your subscriptions and keys

Claude, ChatGPT or Google AI: the CLIs use the subscriptions or API keys set up on the machine.

No proxy

Model traffic goes from your machines straight to Anthropic, OpenAI, Google or GitHub.

What is coming

What does not exist yet, said plainly. Your needs decide the order.

SAML and OIDC SSO

Today, sign-in is by email, Google, GitHub or Microsoft.

A dedicated audit log

Today, executions and approvals keep who started or decided them, without one exportable log.

Spending caps

Today, usage and estimated cost are visible, and the number of concurrent runs is limited by the plan.

A pilot before any commitment

A demo on your context, then a pilot on your own servers if it makes sense.

1. 30-minute demo

   Your agents, your repositories, your use cases: we look at what SideHub changes for you.

2. Pilot on your side

   The agent runs on your servers, with support throughout the pilot.

3. An offer built with you

   Based on the number of members and agents, and what your team needs.

Frequently asked questions

Where is SideHub’s data hosted?

The cockpit and its database are hosted by Railway, emails and files by AWS. The privacy policy lists every processor and the framework for transfers outside the EU. Your code stays on your machines.

Can we host the cockpit ourselves?

Not today. The agent, which runs everything, is on your side and open source. If self-hosting the cockpit is a must, let’s talk about it during the demo.

What does SideHub see of our code?

The code never leaves your machines. SideHub receives orders, statuses, token counts and terminal output, relayed live and not stored (except the last lines of a failed run). Workflow prompts are stored in the workspace.

Can we see who ran or approved what?

Yes: each execution keeps who started it, and each approval who decided. A dedicated, exportable audit log is among the next steps.

Which CLIs and systems?

Claude Code, OpenAI Codex, Antigravity CLI and GitHub Copilot CLI, on Linux, macOS and Windows (Gemini CLI too, with an API key). The agent installs with one command on a workstation, a VM or a build machine.

How do we know which Copilot license each machine uses?

For each machine, SideHub shows the GitHub account signed in to Copilot, its plan (Pro, Business, Enterprise) and its organizations. Set the expected organizations in the workspace: a machine on a personal subscription, or outside those organizations, is flagged on its card and in the cockpit. Only Owners and Admins see it, and no token leaves the machine.

How much does the enterprise offer cost?

It is built with you, based on the number of members and agents. For reference, Business is €15 per member per month, Viewers free.

See SideHub on your infrastructure

A 30-minute demo, then a pilot on your own servers if it fits.

Book a demo