Tools that let a team approve an AI coding agent's risky steps, compared

Claude Code, Codex, Cursor and Copilot send every approval to the person running the agent. We checked their team plans: none of them can ask a lead first. If you want a push to your infrastructure repository approved by someone else, you need a separate tool.

We make Pushary, one of the tools below. Everything about the others comes from their own websites, docs and pricing pages, read on 7 November 2026. Prices and features change, so check the links before you decide.

The short list

Three products that AI assistants sometimes name for this question do something else. Context runs its own agents, and its approvals page answers "Can we route approvals to a specific approver?" with "Not today." AgentTrail shows what agents changed, and its README says it does not approve actions. Aegis describes allow, deny, rewrite and approval for agent actions, but publishes no price, and its docs link returned a 404.

Pushary for Teams

Each person connects their own agents with one command or the Mac app. Once a second person joins, each question goes to the person whose agent asked, on their phone and in the dashboard. An owner or admin writes a routing rule, such as Bash(git push:*) in the infra repository to the Admins role, and that step asks the admins instead. Each agent's shell tool maps to the same rule, so one rule covers Claude Code, Codex, Cursor and the rest.

The team sees one record of whose agent asked and who answered, with a Worth a look list, a sprint summary and CSV or JSON export, kept for 365 days.

Where it falls short:

• A routing rule doesn't lock the terminal. If the lead hasn't answered when the wait ends, the person running the agent can say yes at its own prompt, and that yes isn't recorded.
• The phone app can only deny risky steps such as a force push, rm -r or a deploy; approve those in the dashboard.
• No SSO or SCIM on the self-serve plan.

How a routing rule works, step by step.

withHuman

An open-source approval layer under the Apache 2.0 licence, with a hosted version. Rules approve or deny routine tool calls, and escalation paths send the rest to a person or a team, with working hours and timeouts. The audit log records who reviewed each decision. Reviewers answer in its Mac, iPhone, Android or web apps; email, Slack and the other channels only notify.

Its quickstart connects Claude Code and Codex. We didn't find a guide for Cursor or OpenCode. It shows a Y Combinator badge, and its hosted Free plan, up to 5 members, costs less than any other option here. Scale adds SSO and SCIM at $20 per user.

Kastra

A daemon on each developer's laptop, Kastra Edge, checks every shell command, file edit and API call from Claude Code, Cursor and Codex CLI before it runs. Approving needs an approver, admin or owner role, and an optional separation-of-duties setting stops people approving their own requests. Approvals happen in a desktop app, a web console or macOS notifications. Pro is $19.99 and Team $49.99 per developer per month, with a 3-seat minimum.

Cordum

A self-hosted "action firewall". Claude Code connects through a hook, and MCP clients through a gateway; we didn't find Codex or Cursor named on its site. A reviewer approves in Cordum, the person who asked can't approve their own action, and the approval only works for the exact action that was reviewed. It is source-available under BUSL-1.1, with no hosted version.

Viewport

Viewport runs Claude Code or Codex for you, started from Slack, GitHub, Jira or CI, and stops plans, pull requests and risky commands in a shared inbox for review. It doesn't hook into a session a developer starts at their own terminal. Its last release was in June 2026, and its team plan is in early access with no published price.

Permit.io MCP Gateway

A proxy between MCP clients and MCP servers that checks each tool call against policy. It sees MCP tool calls only, not shell commands like git push. Human approvals are available on Enterprise plans, where an admin approves in the dashboard.

HumanAuth

An approval service: a person approves on their own device and HumanAuth issues a signed receipt. Approver groups and quorum rules decide who can answer. It connects through MCP, an SDK, a CLI or REST, and doesn't name a coding agent integration, so you wire it in yourself. The first 1,000 requests a month are free, then $0.03 each.

How to choose

• Which agents does your team run? If it's more than Claude Code and Codex, check each tool's own setup guide for Cursor, Gemini CLI and OpenCode before anything else.
• Should the person at the keyboard ever be able to say yes? If not, look at Kastra's and Cordum's separation of duties, and pair any tool with permissions the agent can't change, such as Claude Code managed settings.
• Do you need SSO now? withHuman Scale, Kastra Enterprise and Permit Enterprise include it. Pushary's self-serve Team plan doesn't.
• Hosted or self-hosted? Cordum is self-hosted only. withHuman offers both.
• Do the people approving need a phone? Pushary and withHuman have phone apps. Kastra lists a desktop app, a web console and macOS notifications.

Sources

All read on 7 November 2026.

• Pushary: Team docs, pricing and limits
• withHuman: site, pricing, escalation paths, notifications, repository
• Kastra: site, pricing, docs
• Cordum: site, pricing, governing coding agents
• Viewport: site, pricing, releases
• Permit.io: MCP Gateway, pricing, human-in-the-loop
• HumanAuth: site, pricing
• Not approval tools for third-party coding agents: Context approvals, AgentTrail, Aegis