// agentic cli · programmable agent loop
The agent loop, with the lid off.
You describe the change you want. A planner reads the repo, a coder writes it, a verifier runs your tests, and a failed test sends the job back a step instead of back to you. That is one line in a terminal and usually a few cents. Every one of those steps is a station you staffed yourself. Which model works it, which tools it may touch, how many retries it gets before it gives up.
Every tool call runs on your machine, behind a prompt you answer. Reads and greps go through without asking. Anything that writes a file or runs a command stops and waits for you. The diff lands on your filesystem, and the model never touches a file without a yes.
// your first run
You are in a real project, in a real terminal, and you type what you want in the words you would have used on Slack. ko "add OAuth with Google"
Three models from three vendors argue out the approach. The best coder of them writes it. A cheap fast model runs your test suite, and a failure routes the job back to the coder rather than surfacing as an apology.
The diff is on your filesystem, in git, reviewable like any other diff. The running cost sat in the status bar the whole time. Memory is written before the session closes, so tomorrow's first prompt starts where tonight ended.
Signup is free and takes no card. Model calls cost money, so you either top up a wallet or point ko at your own provider keys. The tutorial walks both, plus one feature end to end.
Ask three good engineers to fix the same bug and you get three shapes of answer. One reads the whole module before touching anything. One writes a failing test first. The third patches it, runs the suite and sees what screams. A pipeline is you deciding which of those ko is, before it starts.
Every agent you have used gets shaped by asking nicely. You write a longer system prompt, you add "do not refactor unrelated files" in capitals, and it drifts anyway. Knockout shapes behaviour by taking capabilities away. A planner whose step lists only Read, Glob, Grep, Lsp cannot drift into implementing, because Write is not on the table. You get a plan back. Not half a patch and an apology.
From there each step carries its own model, its own system prompt, its own temperature, its own retry budget and its own spend cap, plus a transition rule that decides where the job goes next. A verifier that emits tests_fail routes back to the implementer. Loop protection caps any one step at three visits so a bad branch cannot drain a wallet overnight. Design it as a drag-and-drop graph, edit the JSON directly, or work the card view. Whichever you pick, the loop is yours to change.
Nothing in the pipeline machinery knows what code is. A step is a model, a prompt, a tool list and a rule about what happens next, which is the same shape whether the work is a database migration or a lease agreement. So the same ko binary that shipped your billing endpoint this morning can argue both sides of an MSA this afternoon. Ten pipelines seed to your account on day one, covering coding plus legal, finance, business, research, HR and creative work. Type /pipeline to switch mid-session and your conversation history carries over.
KO_consensus
Plan, then 3 frontier models from 3 vendors implement in parallel, a judge picks the best, verify.
KO_consultant_multipart
Brainstorm to a spec, plan atomic tasks, implement against checkpoints, verify. Built for non-trivial features.
KO_legal_adversarial_review
Argues both parties of a contract and surfaces the risks each side would rather you missed.
KO_finance
Investment analysis, modeling, valuation and budgets. Not everything ko runs is code.
Nobody puts their principal engineer on the job of running npm test and reading the output. Every single-model agent does exactly that, on every step, because it only has the one model. Reading a codebase and checking whether a suite went green are jobs a cheap model does perfectly well, and they are most of the tokens in a real session. Point each step at the model that fits the work it does, and the expensive one only gets billed for the thinking that was actually hard.
Reading files, gathering context, summarising what is already there. High volume, low judgement. A budget model does this as well as a frontier one and costs a tenth as much.
Gemini 2.5 Flash, $0.30/M inputThe code that ships, and the tradeoffs nobody wrote down. This is the step where a worse model costs you an afternoon of review, so it is the step worth paying for.
Claude Sonnet 4, $3/M inputRun the suite, read the output, decide pass or fail. A verifier with only Bash can run your tests but cannot quietly patch them to go green, which is the failure mode you actually worry about.
GPT-4o mini, $0.15/M inputSteps can point at a slot rather than a model id. slot:code_frontier resolves platform-side, so your pipeline keeps working through frontier model releases without you editing anything.
The second task in a session is cheaper and faster than the first, because the plan step is reasoning over a codebase it has already read rather than starting cold.
You explain your codebase to an agent on Monday. On Tuesday you explain it again, in the same words, to the same tool. Every agentic CLI works this way and everyone has quietly accepted it as the cost of the format. Four things below are what ko does instead, and none of them are the same mechanism.
Ask a normal tool about "the auth flow" and it hunts for files containing the word "auth". Half your login code never uses that word, so it comes back half-blind. ko workspace init reads your repo once and files every function by what it means, not what it is called. So "the auth flow" returns the session check, the password hash and the redirect handler even though none of them says "auth" anywhere.
The first pass takes about 30 seconds. After that a watcher re-reads only what you change, so the map never goes stale, and files matching secret patterns never get embedded at all. The part that matters is how retrieval is wired: Cursor and Continue.dev inject retrieved chunks into every model call, so you pay for context you did not ask for on turns that never needed it. In ko, retrieval is a tool the agent chooses to call. You pay for it when it is used, and the chunks come back as tool output the agent can cite by source rather than as text that mysteriously appeared in its head.
Turn it on once with ko memory enable and every finished session gets summarised and indexed. New sessions open with the most relevant past ones already in the prompt, and the agent can search the rest mid-task if it wants more.
The store is server-side, so the memory follows the account rather than the laptop. Sign in on a different machine and it still knows what you were arguing with on Thursday.
Three hours into a session every model gets worse, and the reason is that one npm test dump from hour one is still being re-sent, at full price, on every single turn since. Any tool output over 8 KB gets offloaded to a per-session store and replaced with a short stub the agent can pull back verbatim when it needs it.
On by default, no flag to set, and the per-session store self-destructs 24 hours after the session ends.
Every tool call from every session is indexed. ko audit search "prod_secrets" answers "did the agent really not touch that file last Tuesday" in one query. Retention defaults to 90 days. Bump it to 7 years per scope when compliance asks.
Zero matches is a real answer, not a hope. Every other CLI hands you a transcript and wishes you luck.
Tag sessions with whatever axes you actually care about. Project, release, customer, severity. Settings cascade per scope, so prod gets long retention and a sensitive customer gets --scope-widening-locked=true, a server-enforced wall the agent can't talk its way around.
Searches respect scope filters too. No more grepping all your projects to find one staging incident.
Six complaints we heard often enough to build against.
One model, one approach. Hope it works.
19 providers. Pick a different model for every step, or have three of them race and let a judge score the results.
It went wrong somewhere and you cannot tell where.
Named steps with visible transitions, plus a searchable record of every tool call the agent ever made.
$20-200 a month for a tool you open on Tuesdays.
Per token. A full feature usually lands under $0.50, and an idle month costs nothing.
Your code goes through their servers. Trust them.
Encrypted on your machine under a password we never receive. The server holds ciphertext it cannot open.
Works in one editor. Locked in.
A CLI in any terminal, plus VS Code, JetBrains, Cursor, Windsurf and anything else that speaks MCP.
Every session starts by explaining the codebase again.
The repo indexed by meaning and past sessions recalled, both following the account rather than the laptop.
Starting from an empty directory is the worst way to start. A wizard asks five to ten questions about the business, the audience and the tone, turns the answers into a project design and hands you a template id. ko build tp_abc123 picks it up and starts building.
Bash, file I/O, glob and grep, web search and fetch, git diffs, clipboard, Docker and SQL, plus the code-aware ones: Patch applies a multi-file unified diff atomically, Lsp answers definition and references through a real language server, and VectorSearch queries the index by meaning. Each pipeline step declares which subset it may call.
Move a working tree between machines with ko sync push. It is encrypted locally under a key derived from your vault password, so what lands on the server is a blob nobody there can open.
Global memory for how you work, project memory for how this repo works. Enroll a scope in cross-device sync and it travels through the vault, still encrypted.
Five ship ready to run: code-review, explain, test, refactor and ringside. ko skills audit prints a SHA-256 hash and signature status for every loaded skill, which is the supply-chain question nobody else answers. Skill Seekers, which turns any docs site into a working skill, is coming soon.
The CLI in any terminal, or drive the same agent from VS Code, JetBrains, Cursor, Windsurf and Claude Desktop over MCP. Four lines of config, no bespoke extension per editor.
Reads and greps run without asking. Writes and shell commands stop and wait. Trust a directory once and the list lives on your machine, where a repo you clone cannot add itself to it.
Tokens carry fine-grained scopes and are stored server-side as SHA-256 hashes, so a leaked database yields nothing usable. Browser OAuth for laptops, KO_TOKEN_FILE for CI.
OpenAI, Anthropic, Google, DeepSeek, Mistral, xAI, Cohere, Groq, Together, Fireworks and more, including Ollama for local models. Spend from the platform wallet, or bring your own key and spend against your own provider account.
| Feature | Knockout | Claude Code | Cursor | Copilot |
|---|---|---|---|---|
| AI models | 19 providers, any model | Anthropic only | Limited | OpenAI only |
| You control the loop | Yes, visual pipeline editor | No | No | No |
| Multi-model per task | Yes: consensus, judge, chain, fallback | No | No | No |
| Vertical pipelines | Legal, finance, HR, research | No | No | No |
| Encrypted code storage | Yes, password we never see | No | No | No |
| Cross-machine sync | Yes, encrypted | No | No | No |
| Skills | 5 preinstalled + custom | Plugins | Limited | Extensions |
| Pricing | Pay per token | $20/mo | $20/mo | $10-19/mo |
| Editor support | CLI + VS Code + any MCP client | CLI | Cursor only | VS Code/JB |
Per token, with the running total ticking in the status bar about four times a second while a model streams, so you can hit ESC on a run that is going nowhere and pay only for what already came back. Before any platform-billed call, ko estimates the worst case and refuses to start a request that could outrun your balance.
Want it cheaper? Run the task on a budget model with ko -m fc:<model>, or set a per-step spend cap in your pipeline. Want it better? KO_consensus puts three frontier models on the same job and pays for all three.
Where does my code actually go?
File edits happen on your machine, run by the local binary behind a permission prompt, and the diff lands on your filesystem. The session history is whatever the agent read or was told, and it gets written back to the server encrypted under a key derived from your vault password, which we never receive. If even that is too much, ko local keeps the whole loop in-process on your box.
What if my model isn't supported?
19 providers are wired today, and the OpenAI-compatible adapter usually covers whatever is missing. Ollama is in there too, so a local model is a valid answer to this question. Tell us if you hit one that doesn't work.
What does a real session cost?
A quick fix usually runs under five cents. A full feature usually runs under a dollar. Cost per step is capped by maxCostUsd in the pipeline, and the total is on screen throughout.
Subscription?
None. Top up a wallet and pay per token, or bring your own provider keys and pay the providers directly. An idle ko costs nothing.
Can I prove what the agent did?
Turn on ko audit enable and every tool call from every session is indexed with its scope tags. Retention defaults to 90 days and goes to seven years on the scopes that need it. That is the first question a regulated team asks, and it deserves a query rather than an assurance.
Install the binary, point it at a repo, give it a job. About five minutes to the first working diff.
Then start moving steps around, because that is the part nobody else lets you do.
No subscription and no card at signup. You pay for the tokens your models burn, and nothing when ko is idle.