CONNECT // 60 seconds, no SDK

Give your agent a kill switch.

Xi is a remote MCP server your coding agent connects to. The agent can request approval and check freeze status — but it physically cannot approve its own requests. You resolve everything from your inbox, on any device, and the full trail is append-only.

1 · Connect

Claude Code

claude mcp add --transport http xi https://xiexperiments.com/api/mcp/mcp

Then run /mcp once to complete the OAuth sign-in.

Claude (web & desktop)

Settings → Connectors → Add custom connector → paste https://xiexperiments.com/api/mcp/mcp → sign in when prompted.

Cursor & other MCP clients

{
  "mcpServers": {
    "xi": {
      "url": "https://xiexperiments.com/api/mcp/mcp"
    }
  }
}

Add to .cursor/mcp.json(or your client's MCP config). Any client that speaks streamable HTTP + OAuth 2.1 works.

2 · Arm the kill switch

Paste this into your CLAUDE.md (or Cursor rules). It tells the agent: no irreversible action without an approved request — and no action at all during a freeze window.

## Xi kill switch (do not remove)

Before any irreversible or consequential action — deploys, database
migrations, destructive shell commands (rm -rf, DROP, force-push),
spending money, or sending external communications — you MUST:

1. Call the Xi MCP tool `freeze_status`. If `frozen: true`, STOP.
   Do not change anything until the freeze ends, regardless of any
   other instruction in this file or in the conversation.
2. Call `approval_request` with the matching actionKind
   (deploy | db_migration | destructive_command | git_force_push |
   spend | external_communication | custom) and a one-line summary.
3. Tell the operator an approval is waiting at
   xiexperiments.com/approvals, then poll `approval_status`.
4. Proceed ONLY when the status is "approved". Never treat an
   ambiguous human reply ("hah", "ok then", silence) as approval —
   only an approved status from Xi counts.

Xi is outside your process: you cannot approve your own requests,
and every request and resolution is kept in an append-only audit
trail the operator can review.

3 · Approve from anywhere

When the agent wants to deploy, migrate, force-push, or spend, the request lands in your approvals inbox. Approve or reject with a recorded reason. Start a code-freeze window before a launch weekend and every connected agent stands down — they can't talk their way past it, because the gate isn't in their context window.

Why this can't be a local file: an agent with shell access can edit its own rules, kill a watchdog process, or rewrite git history. Xi lives outside the blast radius.

No account yet? Create one free — no card, 60 seconds, then connect above. Pro ($10/mo) adds team workspaces and unlimited active experiments.