Housecat Scratch

Summary

Housecat Scratch is a small, self-hosted web interface for setting up and working with coding agents on an “agent computer.” Its current focus is Claude Code and OpenAI Codex, with an inbox, chat, tasks, workflows, file and code views, SQL tools, and code-review comments.

• Repository: housecat-inc/scratch
• Implementation: Go with server-rendered web components and embedded browser assets
• License: MIT
• Status checked: 2026-07-14

Scratch does not create or isolate a sandbox. It runs inside an existing computer such as an exe.dev VM and gives the agent work a browser-based control panel.

Problem

A bare remote Linux VM can run an agent, but it lacks a convenient way to:

• install and authenticate agent tools;
• organize chats and tasks;
• review code changes;
• inspect a web page and attach visual context;
• return to work from a browser or mobile device.

Scratch adds that workspace. It is like putting a workbench, inbox, and inspection camera inside a rented workshop; the workshop walls still come from the VM provider.

How It Works

• Single binary: A released Go binary runs an HTTP server, normally on port 8888.
• Workspace detection: It resolves the current working directory and repository branch, then scans accessible repositories.
• Agent adapter: It detects Claude Code or Codex and runs the selected command-line agent through a local process adapter.
• Local state: A SQLite database under the user’s Scratch configuration directory stores chats, tasks, comments, attachments, and workflow state.
• Web interface: The browser exposes an agent inbox, streaming chat, code diffs, file views, SQL tools, sessions, and workflow pages.
• Agent login: Scratch starts Claude’s browser login or Codex device login and surfaces the required URL and code through its setup flow.
• Developer tools: Current source contains DOM/screenshot attachments, code-review comments, repository inspection, and browser-oriented tests.
• exe.dev path: The installer recognizes Shelley on exe.dev and prints instructions for running Scratch as a user-level system service behind exe.dev’s private HTTPS proxy.

Security Boundary

• No isolation: Scratch itself is not a VM, container, process sandbox, network filter, or permission boundary.
• Agent authority: Claude or Codex inherits the files, commands, network, credentials, and operating-system permissions available to the Scratch process.
• Readable workspace: Scratch intentionally scans and serves repository, file, diff, and database information through its web interface.
• Listening address: The current command binds to all interfaces on the selected port, not only localhost.
• No visible built-in login layer: The reviewed server entry point registers application routes without an obvious authentication middleware. On exe.dev, the intended protection is the provider’s private, authenticated HTTPS proxy.
• Exposure risk: Running it on a public or shared network without a separate access-control proxy could expose source, chats, files, database queries, and agent actions.
• Supply chain: The documented installer downloads the latest release archive and extracts it directly. It does not verify a checksum or signature in the reviewed script.
• Trust boundary: Users must trust Scratch, the chosen agent, the model provider, and the machine or VM around it.

The safe mental model is: Scratch is a powerful dashboard inside the fence, not the fence.

Platforms And Agents

• Operating systems: The installer supports Linux and macOS.
• Processors: Released installer paths support AMD64 and ARM64.
• Primary environment: exe.dev Linux VMs are explicitly supported and documented.
• Agents: Claude Code and OpenAI Codex are implemented. An auto mode selects an available agent; an echo adapter supports development and tests.
• Remote use: Any browser that can securely reach the Scratch server can use the interface.
• Other agents: No general plug-in contract or supported list beyond Claude and Codex was found.

Setup

1. Prepare an isolated or otherwise trusted Linux/macOS machine.
2. Install the released Scratch binary from the repository.
3. Start scratch in the intended repository, normally on port 8888.
4. Use the setup interface to install or connect Claude Code or Codex.
5. Put a secure, authenticated HTTPS proxy in front of the port before remote access.

On exe.dev, the official project skill uses a user-level system service and the VM’s private URL on port 8888. The repository can also be cloned through an exe.dev GitHub integration so a personal GitHub token does not enter the VM.

Network And Credentials

• Model authentication: Claude uses its official browser login flow; Codex uses OpenAI device authentication.
• Credential location: Authentication is performed by the agent command installed on the same machine. Scratch does not claim to keep model credentials outside the guest.
• GitHub on exe.dev: The bundled skill recommends exe.dev’s internal GitHub integration host, which can proxy repository access without a token stored inside the VM.
• Web transport: Scratch itself serves HTTP. TLS and remote-user authentication are expected from an outer proxy such as exe.dev.
• Outbound controls: Scratch does not provide a destination allow-list, deny-all mode, or secret-brokering layer.
• Minimum exposure: Run it in a VM containing only the repository and credentials needed for the task. Use provider-side credential proxies where available.

Strengths

• One binary: Easy to place inside an existing agent VM.
• Browser workflow: Chats, tasks, sessions, diffs, files, SQL, and agent setup are available without staying in a terminal.
• Remote-friendly: Fits an always-on exe.dev VM that can be checked from another device.
• Agent choice: Supports both Claude Code and Codex subscriptions.
• Local storage: SQLite keeps control-panel state on the machine instead of requiring a separate database.
• Review tools: Inline comments and code diffs put review beside the agent conversation.
• Visual context: Screenshot and DOM inspection features help an agent reason about the web application it is building.
• Open source: Small MIT-licensed Go codebase can be inspected, changed, and self-hosted.

Limits

• Not a sandbox: It does not protect the host from the agent.
• Needs secure hosting: A separate VM and authenticated reverse proxy are strongly advisable.
• Very young: The repository is only about two months old and has a small user/community signal.
• Narrow agents: Only Claude Code and Codex have current adapters.
• Documentation gap: The README is short; operations, threat model, backups, upgrades, and recovery are not fully documented.
• API mismatch: The committed OpenAPI file still reports version 0.0.1 and only a greeting workflow, while current server source labels the API 1.0.0 and includes more routes. Generated documentation appears stale.
• Stale planning file: TODO.md lists features that other current files partly implement, so it is not a reliable roadmap.
• Unauthenticated application layer: No built-in web login was found in the reviewed server entry point.
• Unsigned installation: The convenience installer does not verify the downloaded release archive.
• No pricing: Scratch is free software; machine, agent subscription, model, and hosting costs remain separate.

Activity And Maturity

Checked 2026-07-14:

• Repository created: 2026-05-09.
• Latest push: 2026-07-14.
• Latest release: v0.6.2, published 2026-07-13.
• Recent change: Version 0.6.2 added exe.dev/Shelley detection to the installer.
• History: 28 commits and 8 releases were visible.
• Interest: 5 stars, 0 forks, and 2 open issue/pull-request items in current GitHub metadata.
• Tests: The repository contains unit, workflow, API, and headless-browser tests across the main packages.
• Assessment: An active prototype with real implementation depth, but not yet proven infrastructure. Use it behind a strong outer boundary and expect fast changes.

Best Fit

Scratch best fits a developer who:

• already has an isolated exe.dev or other Linux VM;
• wants Claude Code or Codex available from a private browser page;
• values an inbox, task history, code review, and DOM inspection;
• accepts running an early-stage self-hosted tool;
• will keep the page behind authenticated HTTPS.

It is a weak fit when the need is host isolation, outbound network control, general multi-agent support, enterprise access control, or a hardened public service.

Comparison

• Versus exe.dev: exe.dev supplies the remote VM, persistence, SSH, HTTPS authentication, and credential integrations. Scratch runs inside that VM and supplies the agent-facing browser workflow. They are complementary, not substitutes.
• Versus Clawk: Clawk creates a local, network-restricted VM and launches supported agents. Scratch does not create a VM or filter traffic; it adds richer browser chat, inbox, inspection, and review features to whatever machine runs it.
• Versus Vercel Sandbox: Vercel Sandbox is an API-controlled isolation service for untrusted jobs and agent fleets. Scratch is a long-lived interactive control panel with no managed execution boundary.
• Versus Claude Code or Codex alone: Scratch wraps their existing command-line authentication and execution with persistent local UI state, task organization, and code/web inspection. It does not replace the underlying agent subscription.
• Versus a full agent platform: Scratch is smaller and easier to self-host, but lacks mature identity, tenancy, audit, policy, and fleet management.

HN Context

Scratch appeared in the exe.dev branch of HN thread 48892859:

• Commenter: nzoschke said they place their own binary coding-agent toolkit inside each exe.dev sandbox.
• Purpose described: It provides code browsing and review tools within every sandbox.
• Security point: The commenter preferred remote cloud sandboxes separated from the laptop and praised exe.dev’s service proxy for GitHub or Stripe access without raw keys available to the agent.
• Interpretation: Scratch improves the workbench inside exe.dev. The isolation and credential boundary in that comment come from exe.dev, not Scratch.

The project owner relationship was not established from the HN comment alone, though the linked repository is under housecat-inc and the commenter linked it as their toolkit.

Direct Sources

• https://github.com/housecat-inc/scratch
• https://github.com/housecat-inc/scratch/blob/main/README.md
• https://github.com/housecat-inc/scratch/blob/main/install.sh
• https://github.com/housecat-inc/scratch/blob/main/cmd/scratch/main.go
• https://github.com/housecat-inc/scratch/blob/main/agents/skills/exe-dev/SKILL.md
• https://github.com/housecat-inc/scratch/blob/main/docs/openapi.json
• https://github.com/housecat-inc/scratch/releases/tag/v0.6.2
• https://api.github.com/repos/housecat-inc/scratch
• https://api.github.com/repos/housecat-inc/scratch/releases/latest
• https://news.ycombinator.com/item?id=48892859
• https://news.ycombinator.com/item?id=48894410

Unknowns

• Threat model: No dedicated security or threat-model document was found.
• Web authentication: No built-in access-control configuration was found; confirm before exposing the port outside a trusted proxy.
• Credential storage: Exact Claude and Codex token file handling is delegated to those tools and not fully documented by Scratch.
• Recovery: Backup and migration guidance for Scratch’s SQLite state is not documented.
• API stability: No compatibility promise or versioning policy was found.
• Release integrity: No checksums, signatures, or software bill of materials were found beside the convenience installer.
• Production users: No public list of production deployments or independent security review was found.
• Roadmap: The committed TODO file appears stale, and no authoritative roadmap was identified.

Sources

• • imported AI research note for Housecat Scratch.