--json.
If your harness speaks MCP natively, connect the MCP server directly instead — you get typed tool schemas and the client can surface confirmation prompts itself.
Why this is safe
The guardrails live in the CLI, not in the prompt. An autonomous agent cannot spend credits, mint a magic link or delete a contact without passing a flag that encodes a deliberate decision:
Without them the command exits non-zero with an explanation, which the agent can relay to the user instead of guessing.
Brief the agent
Three commands print the shared operating knowledge, no connection needed:ringee prompt into your agent’s system message gives it the same rules the Claude skills and the ChatGPT app follow — which tool maps to which action, the prospect → contact → session → outcome → follow-up flow, and when to stop and ask.
A typical loop
1
Resolve before acting
2
Do the work
3
Stop at sensitive steps
Ask the user, then pass the flag:
4
Check exit codes
Sensitive commands exit non-zero when the confirmation flag is missing. Treat that as “ask the human”, not as a bug to work around.
Build on the agent layer directly
If you are writing TypeScript instead of shelling out, use@ringee-io/agent — the package the CLI itself is built on. It contains no business logic: it validates input, talks to the MCP, and shares the catalog, flows, prompts and rules.
Next steps
Claude skills and apps
Ready-made
/ringee commands for Claude and ChatGPTSafety model
What the server enforces regardless of the client

