The Mental Model

Zwischen puts a second AI between your coding agent and its actions. Every tool call the agent makes passes through Zwischen's hooks before and after execution. The reviewer watches this stream of events in real time and decides — for each one — whether to pass, block, or intervene.

The pieces

The agent is Claude Code — the AI coding assistant doing the actual work in your session.

The reviewer (Frank) is a separate AI model watching the agent's event stream. It runs on a different model from the agent — you choose which one. The reviewer has its own context window, its own system prompt, and its own conversation with the Zwischen server.

The client is the zwischen Python package installed on your machine. It runs as Claude Code hooks and a local daemon. The client streams events to the Zwischen server and enforces the reviewer's decisions locally.

The server hosts the reviewer's brain — the prompts, evaluation logic, and enforcement protocol. The server manages the reviewer's AI session and returns enforcement decisions to the client.

What the reviewer sees

The reviewer receives a live event stream from your Claude Code session:

• Tool calls — every tool the agent invokes (Read, Bash, Edit, Grep, etc.), with configurable output visibility
• Proposed file writes — Edit and Write calls intercepted before they touch disk
• Pre-reviewed tool calls — tools configured for pre-review (e.g., Bash, PowerShell) reviewed before execution
• User prompts — what you ask the agent to do
• Stop attempts — when the agent tries to end its turn
• Tool failures — errors and interrupted operations

What the reviewer does

For each event, the reviewer issues a determination:

• Pass — the event is fine, let it through
• Block — the event is problematic, stop the agent
• Release — lift a previous block (after the agent disputes or the user intervenes)

Blocks are enforced locally by the client. The agent cannot bypass them — it can only dispute them through the message_adversary tool or wait for the user to intervene via /z direct.

The key difference

This is not a code review tool that grades finished work. The reviewer is watching the session unfold and can intervene while work is still in progress. A bad file write gets rejected before it hits disk. A dangerous shell command gets blocked before it runs. An agent that tries to stop too early gets forced to continue.

The reviewer is adversarial by design — it exists to catch things the agent would otherwise get away with.