crypdick

Sudoplz — AI skill for Claude Code

AI community

Give Claude Code, Cursor, and other AI coding agents the ability to run sudo with case-by-case GUI approval.

How to install Sudoplz

This entry records only its repository, not the path inside it, so there is no exact command to give. Open crypdick/sudoplz and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Sudoplz does

Give Claude Code, Cursor, and other AI coding agents the ability to run sudo with case-by-case GUI approval. Passwords encrypted with your SSH key; no passwordless sudo required.

Alternatives in AI

Part 4 — Generate AGENTS.md And AI Agent Configuration Files — I'll help you create the instruction files that will guide your AI coding assistant to build your MVP 2.1k ★
PRD: Agent Builder — Create Your Own Sub-Agent — Your ecosystem, your rules 1.9k ★
Qiaomu Markdown Proxy — Fetch any URL as clean Markdown via proxy services (r.jina.ai / defuddle.md) or built-in scripts 426 ★

README

sudoplz

Give Claude Code, Cursor, and other AI coding agents the ability to run `sudo` — with case-by-case GUI approval, no passwordless sudo, no `/etc/sudoers` allowlists.

Your sudo password is encrypted to your SSH public key and only decrypted after you approve a dialog showing the exact command about to run. Deny the dialog and nothing happens.

![Sudo approval dialog showing a command about to run, with Deny and Allow buttons](assets/screenshot.png)

Why

Coding agents can't handle interactive terminal prompts. Ask Claude Code to run `sudo apt install foo` and you get `sudo: Authentication failed`. The common workarounds all have problems:

Passwordless sudo gives the agent — and anything else running as your user — unrestricted root.
/etc/sudoers allowlists require predicting every command the agent will ever need. No case-by-case review.
Manual copy-paste is tedious and breaks the agent's flow.

`sudoplz` plugs into `sudo -A`, so the agent runs `sudo -A `, you see a dialog with the exact command, and you click Allow or Deny. Works for any command without pre-declaring what's permitted.

This threat model assumes a personal workstation with an encrypted disk and a passphrase-protected SSH key. Not appropriate for shared or production systems.

Installation

Use traditional sudo, not sudo-rs. sudo-rs doesn't support askpass. Check with sudo --version — it should say "Sudo version 1.x.x". If you're on sudo-rs, switch:
```
sudo update-alternatives --install /usr/bin/sudo sudo /usr/bin/sudo.ws 100
sudo update-alternatives --config sudo   # pick sudo.ws
```
Make sure you have an Ed25519 or RSA SSH key. ECDSA and DSA keys are not supported.
Install system dependencies:
- `age` — required for SSH-backed password storage and TOTP. sudo pacman -S age / sudo apt install age / brew install age.
- zenity on Linux — provides the GUI approval dia