Getting Started Open-Core

Go from zero to your first blocked tool call in under 5 minutes.

┌─────────────┐    ┌──────────────┐    ┌──────────────────┐
│  Your IDE /  │───▶│ Intutic      │───▶│  LLM Provider    │
│  AI Agent    │◀───│ Proxy :4000  │◀───│  (OpenAI, etc.)  │
└─────────────┘    └──────┬───────┘    └──────────────────┘
                          │
                   ┌──────▼───────┐
                   │ Control Plane│
                   │    :3001     │
                   └──────────────┘

Every LLM request from your AI agent flows through Intutic's local proxy, where SOPs (Standard Operating Procedures) evaluate each tool call in real time and return one of four verdicts: BYPASS, ENHANCE, HIJACK, or KILL.

Prerequisites

Requirement	Version
Node.js	18 or later
npm	10 or later
AI coding agent	Any of the 18 supported harnesses (Cursor, Claude Code, Aider, Windsurf, Antigravity, etc.)

Step 1 — Install the CLI

npm install -g @intutic/cli

Verify:

intutic --version
# 1.1.3

Alternative package managers

# pnpm
pnpm add -g @intutic/cli

# yarn
yarn global add @intutic/cli

Step 2 — Log in

intutic login

You'll be prompted for your email and password. On success:

╭─ Intutic — Authentication ─╮
Control plane: https://api.intutic.ai

✔ Authenticated as you@company.com
  Workspace: ws_k8x9m2p4
  Role: admin

Your credentials are stored at ~/.intutic/credentials.json (mode 0600), with the API key backed by your system keychain when available.

API key authentication

For CI or headless environments, authenticate with an API key (must start with vk_):

intutic login --api-key vk_your_key_here

Local development

Point at a local control plane with --dev:

intutic login --dev

This uses http://localhost:3001 instead of the hosted API.

Step 3 — Initialize your workspace

From your project root (must contain a .git/ directory or package.json):

intutic init

This auto-detects every AI harness in your project and writes a local config file at ~/.intutic/config.json.

╭─ Intutic — Workspace Initialization ─╮
✔ Workspace root: /home/dev/my-project

Detecting AI harnesses...

  ✔ cursor       → .cursorrules
  ✔ claude-code  → CLAUDE.md
  ○ windsurf     (not detected)
  ○ aider        (not detected)
  ...

✔ Detected 2 harnesses
✔ Authenticated as you@company.com

Would you like to install Git sync hooks (post-commit, post-checkout)? [Y/n]:
✔ Workspace initialized.

Local development

Register against a local control plane:

intutic init --dev

Step 4 — Connect and start the daemon

Start the sync daemon:

intutic connect

This starts the LiteLLM-Rust proxy on port 4000, opens a WebSocket for real-time config updates, and begins filesystem watching for drift detection.

╭─ Intutic — Sync Daemon ─╮
  Workspace: ws_k8x9m2p4
  Control Plane: https://api.intutic.ai
  Poll Interval: 30s
  Harnesses: cursor, claude-code

Starting sync daemon... (Ctrl+C to stop)

Port 4000 is free. Spawning managed proxy gateway...
✔ Managed proxy gateway process spawned.
[sync] Config v3 — 5 SOPs synced

What connect does under the hood

1. Spawns the LiteLLM-Rust proxy on port 4000 — all LLM traffic routes through it
2. Opens a WebSocket for real-time config updates from the control plane
3. Watches the filesystem for harness config drift — auto-reverts unauthorized changes
4. Runs a 30-second poll loop as a secondary fallback (configurable with --interval)
5. Syncs any offline traces accumulated while the daemon was stopped
6. Writes harness-specific config (e.g., .cursor/rules/intutic.mdc for Cursor, pre-tool-use hooks for Claude Code)

Background options

intutic connect --interval 10000   # 10-second poll interval
intutic connect --dev              # Local control plane

For a persistent system service that starts on login, see intutic daemon install.

Step 5 — Trigger your first block

Open your AI agent and ask it to do something a default SOP would catch:

"Delete all files in /tmp"

The proxy intercepts the tool call, evaluates it against your SOPs, and returns a KILL verdict — the destructive action never executes.

┌─────────────────────────────────────────────────────┐
│  KILL — SOP: filesystem-safety                      │
│                                                     │
│  Blocked: rm -rf /tmp/*                             │
│  Reason: Recursive deletion outside project root    │
│          is prohibited by filesystem-safety SOP.    │
│                                                     │
│  Session: ses_7x2k9m    Trace: tr_p4n8q1            │
└─────────────────────────────────────────────────────┘

Step 6 — View your trace

Check the trace from the command line:

intutic traces list --limit 5

ID           Harness       Timestamp             Tool Calls  Verdicts           Status
tr_p4n8q1    cursor        2026-07-04 07:30:01   1           KILL: 1            blocked
tr_m3k7n2    cursor        2026-07-04 07:28:44   3           BYPASS: 3          complete

Drill into the blocked trace:

intutic traces inspect tr_p4n8q1

Or check your full system status in another terminal:

intutic status

╭─ Intutic — Workspace Status ─╮
  Auth: ✔ you@company.com (ws_k8x9m2p4)
  Workspace root: /home/dev/my-project
  Harnesses: cursor ✔, claude-code ✔
  Daemon: running (PID 48291)
  Last sync: 12s ago
  SOPs: 5 active

What's next?

Topic	Description
How It Works	Understand the proxy → policy engine → verdict pipeline
SOPs	Write and customize your own Standard Operating Procedures
Enforcement Actions	Deep dive into BYPASS, ENHANCE, HIJACK, and KILL
Dashboard	Explore the web-based governance dashboard
Integrations	Detailed setup guides for all 18 harnesses
CLI Reference	Complete command reference for @intutic/cli