One agent supervises workers across 5 terminal backends
The 18.1 MB checkout puts one coding agent between you and a group of worker agents. The supervisor turns a request into ship or scout tasks, starts each worker in a separate Git worktree, watches durable status files, and returns a pull request, approved local merge, or research report. The current backend list covers tmux, Herdr, Zellij, Orca, and cmux. You can watch or type into each worker's terminal, which is useful when autonomy needs inspection rather than a hidden job queue.
Our measured checkout had 552 files, about 281,006 lines of source, and occupied 18.1 MB. Much of the product is policy and coordination: AGENTS.md defines the supervisor, shell scripts manage sessions and worktrees, and local directories hold fleet state. There is no application binary to install. Starting a supported agent inside the cloned repository activates the instructions, so prompt interpretation and the selected harness are part of the runtime.
Eight primary harness choices do not behave identically
Our 552-file checkout documents 8 primary choices when pi-signed is counted separately: Claude Code, Grok, Pi, its signed wrapper, Oh My Pi, Codex, OpenCode, and Cursor Agent CLI. Claude, Grok, and Pi are the co-primary recommendations. Their supervision mechanisms differ. Claude uses a Stop hook, Grok uses background notifications, Pi loads tracked extensions, and Codex uses bounded foreground checkpoints. Cursor must run interactively because its headless mode lacks the documented turn-end hook.
That adapter work is where failures become hard to diagnose. Open issue 4360 reports that an idle OpenCode worker with an empty-looking composer can be classified as holding pending operator text. Firstmate then leaves the message in its inbox and keeps skipping the doorbell. A supervisor that cannot reliably wake a finished worker may leave completed work unseen. Anyone standardizing on one harness should test send, stop, restart, and recovery paths for that exact adapter before dispatching real changes.
What happened when we ran it
Our sandbox installed 35 Python packages in 16 seconds, adding 37 MB on disk. The build step completed in 4 seconds. The run used commit ecfe071 in a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, and no secrets. Pip-audit reported 0 known vulnerabilities in the installed packages. Those numbers describe the lab's detected Python environment, while the project itself is mainly shell scripts and instruction files.
The test command failed with exit code 5 after 5 seconds. Pytest collected no tests and printed no tests ran in 0.03s, leaving 0 passed and 0 failed of 0. The checkout did contain a tests directory, so the result means our generic pytest step did not discover its shell-heavy suite. It does not say Firstmate's own test runner failed, and it gives us no passing product test result for this commit.
A 37 MB lab install leaves most of the toolchain outside the count
Our 37 MB lab result covers the detected Python environment, while the README's visible quick start starts elsewhere: authenticate gh, clone the repository, enter the directory, and launch an agent. The configuration guide lists a larger operating environment. Every home needs Node, Git, authenticated GitHub CLI, no-mistakes 1.46.0 or newer, and several axi utilities. The backend adds tmux, Herdr, Zellij, Orca, or cmux; most choices also use treehouse for worktrees.
Our 35-package result therefore should not be read as the total Firstmate setup. Coding-agent subscriptions or provider credentials must already work in the destination terminal. Git pushes need usable SSH or HTTPS authentication, and remote secondmates need an SSH-reachable host. The worker environment allowlist can narrow inherited variable names. The documentation explicitly says it cannot stop same-user processes from reading credential files, which rules out treating worker panes as a security boundary.
Three project modes control landing, while worker authority still matters
Inside the 18.1 MB checkout, each project chooses among 3 delivery modes: no-mistakes, direct-PR, or local-only. An optional +yolo flag changes merge autonomy. The supervisor stays read-only over project code outside named guarded operations; workers make changes in isolated worktrees and follow the configured landing authority. This structure reduces branch collisions and keeps the human's merge decision visible. It does not determine whether a generated change is correct or whether a worker should have had access to the repository.
Claude users should read the permission section before the first 281,006-line fleet run. With no local override, Firstmate launches Claude workers using --dangerously-skip-permissions; setting the mode to auto chooses Claude's permission classifier instead. Invalid values refuse the spawn. That is refreshingly explicit documentation, but the default is a serious choice. Combine narrow repository credentials, protected branches, review gates, and a deliberately selected permission mode before allowing several workers to operate at once.
A September 13 push comes with 1,321 open issues and pull requests
GitHub recorded 5,630 stars and a push on September 13, 2026. Search results showed 447 open issues and 874 open pull requests, matching the repository's 1,321 combined open-item count. The same-day updates prove active work, but the queue is extraordinary for a repository created in June 2026. GitHub's latest-release endpoint returned no release. Pin a reviewed commit instead of treating the default branch as a stable distribution channel.
Two open reports touch the supervision contract directly. Issue 4354 says self-update changes trusted script bytes and can leave already armed process watches rejecting their actions. Issue 4360 describes OpenCode wake delivery that never reaches an idle worker. Firstmate is unusually candid about these boundaries, and its docs are deeper than its clone command suggests. The 0-test pytest result still leaves buyers responsible for running the project's shell test path and rehearsing recovery on the exact harness and backend they plan to use.