Drive four external coding CLIs — Google's Antigravity (Gemini 3.6 Flash), OpenAI Codex, the GitHub Copilot CLI, and Cursor — as sub-agents inside Claude Code. Text answers, image generation, real repo work, and parallel swarms, on quota you already pay for. One MCP server, four backends. It exposes Google Antigravity, OpenAI Codex, the GitHub Copilot CLI, and Cursor to Claude Code as clean MCP to
npx mdskills install SinanTufekci/agent-intern@SinanTufekci? Sign in with GitHub to claim this listing.Bridges four major AI coding CLIs as MCP tools with robust multi-backend orchestration and parallel execution
Drive four external coding CLIs — Google's Antigravity (Gemini 3.6 Flash), OpenAI Codex, the GitHub Copilot CLI, and Cursor — as sub-agents inside Claude Code. Text answers, image generation, real repo work, and parallel swarms, on quota you already pay for.
One MCP server, four backends. It exposes Google Antigravity, OpenAI Codex, the GitHub Copilot CLI, and Cursor to Claude Code as clean MCP tools so you can delegate work to a different model family mid-task — without leaving your terminal, and on the subscriptions you already have. Each backend is independent: install one, two, three, or all four.
agy, Gemini 3.6 Flash High). Fast, cheap tool-calling — and the only
backend with an image model. Its headless print mode (agy -p) historically had a stdout bug:
it wrote the answer to the controlling terminal instead of its stdout, so anything capturing
stdout got nothing (and, under a TUI, agy's text leaked into the host's prompt). agy 1.0.15 fixed
this on Windows — -p now writes the clean answer to stdout — so the bridge prefers stdout and
falls back to reading agy's own transcript files only when stdout is empty (older agy, non-Windows,
or --sandbox runs). It still detaches agy from the terminal so older versions can't leak.codex exec, OpenAI). A strong reasoner for real code/repo work. It writes its final
message straight to a file the bridge asks for (no scraping), supports model selection, and has
a real, enforced sandbox.copilot -p, GitHub). GitHub's agentic coder. Stdout-native like Codex (-s
prints just the answer), with model selection (--model), a best-effort tool/path
permission knob, and a deterministic resume mechanism (the bridge sets each session's UUID itself).cursor-agent -p, Cursor). Cursor's agentic coder, with the widest model menu —
GPT, Claude, Grok, and Composer via --model (validated against cursor-agent models). Stdout-native
like Codex/Copilot (--output-format text prints just the answer), an agent-enforced sandbox
(read-only via --mode ask), and a deterministic resume mechanism (the bridge mints each chat's id
itself via create-chat). No image model.All four share the same niceties: a *_continue to resume a thread, a live "watch" window
to see the agent work, a unified agent_swarm that runs many tasks in parallel across
all backends at once, and *_status diagnostics that spend no quota.
Warning:
This runs unsandboxed code with your privileges.
agy -pauto-executes its tools (read/write files, run shell commands, reach the network) with no usable approval gate — its--sandboxblocks only shell commands, leaving file writes and network egress wide open.codex execalso runs autonomously, but itssandboxflag (defaultread-only) is a real, enforced boundary.copilot -pruns headless with--allow-all-tools; itssandboxmaps to best-effort tool/path permissions (read-only denies the local write/shell tools) — safer than agy, but not an OS sandbox like Codex's.cursor-agent -pruns headless with--trust(and--forcefor writes); itssandboxis agent-enforced (read-only =--mode ask, which makes the write/shell tools unavailable) — best-effort like Copilot, not an OS sandbox. In all four cases theworkspaceargument is a starting context, not a security boundary. Only use these with trusted prompts on trusted content; for real isolation, run the bridge inside a container or VM. Full details →
| 🧠 Second opinion | Ask a different model family — Gemini or GPT — mid-task without switching tools. |
| 🎨 Image generation | Have Gemini draw an image and get the saved file back — no extra API key or image tool. |
| 🛠️ Real coding sub-agent | Hand a focused repo task to Codex with a real workspace-write sandbox. |
| 💸 Cheap delegation | Burn Antigravity / Codex quota on grunt work instead of Claude tokens. |
| 🐝 Parallel fan-out | Run N tasks at once, mixing Gemini and Codex workers in a single swarm. |
| 📁 Cross-repo reads | Point a worker at another project directory and let it read/answer there. |
| 🔌 Zero new auth | Piggybacks the logins you already did — no keys for the bridge to manage. |
The bridge normalizes all four CLIs into the same shape, but they differ where it matters. Pick per task:
🛰️ Antigravity (agy) | 🤖 Codex (codex exec) | 🐙 Copilot (copilot -p) | ✳️ Cursor (cursor-agent -p) | |
|---|---|---|---|---|
| Model | Selectable via model (agy's --model); Gemini 3.6 Flash (High) default (see Model & auth) | Selectable via model (codex's -m) | Selectable via model (--model) | Selectable via model (--model), validated against cursor-agent models |
| Best at | Fast, cheap tool-calling; quick answers | Heavier reasoning; real code/repo work | Agentic coding; real code/repo work | Agentic coding; wide model menu (GPT/Claude/Grok/Composer) |
| Image generation | ✅ antigravity_image (+ antigravity_image_swarm) | ❌ no image model | ❌ no image model | ❌ no image model |
| Sandbox | ❌ no real boundary (--sandbox blocks only shell) | ✅ real, enforced: read-only / workspace-write / danger-full-access | ⚠️ best-effort: tool/path permissions (read-only denies write/shell) — not an OS sandbox | ⚠️ agent-enforced: mode/force (read-only = --mode ask, write/shell tools unavailable) — not an OS sandbox |
| How the answer is read | --output-format json on agy 1.1.8+ (stream-json when watching); else stdout, else scraped from transcript.jsonl | Written to a file via -o/--output-last-message | stdout (-s silent mode) | stdout (--output-format text) |
| Continue mechanism | Pins the workspace's conversation id (--conversation) | Resumes the session id (codex exec resume ) | Resumes a self-set session UUID (--session-id) | Mints a chat id (create-chat) and resumes it (--resume ) |
| Auth | OS credential store (AI Pro session) | codex login (ChatGPT account or API key) | OS credential store (copilot login) or a GitHub token env | cursor-agent login (OS credential store) or CURSOR_API_KEY |
| In a swarm | Runs with an isolated HOME to avoid state races | Fresh one-shot — needs no isolation | Fresh one-shot — needs no isolation | Fresh one-shot — needs no isolation |
All four backends run headless and one-shot per call; the bridge's job is to get a clean answer out of each and hand it to Claude Code as a plain string.
flowchart LR
A([Claude Code]) -- "MCP tool call" --> B["bridge
(server.py)"]
B -- "antigravity_*" --> C[agy -p]
B -- "codex_*" --> D[codex exec]
B -- "copilot_*" --> E[copilot -p]
B -- "cursor_*" --> F[cursor-agent -p]
C -- "json / stream-json (1.1.8+)
else stdout or transcript.jsonl / .db" --> B
D -- "output-last-message file" --> B
E -- "stdout (-s silent)" --> B
F -- "stdout (--output-format text)" --> B
B -- "plain text" --> A
Antigravity. On agy 1.1.8+ the bridge asks for structured output and reads a contractual
field instead of guessing: plain calls use --output-format json and return its response, while
watch mode uses --output-format stream-json and rebuilds the answer from the stream's
terminal result event (the same shape the Cursor bridge already used). Both also carry a
conversation_id, which the bridge records so antigravity_continue pins exactly the thread it
last ran in that workspace.
Older agy has no such flag, so the original path stays: on 1.0.15+ (Windows) agy -p writes its
clean answer to stdout and the bridge returns that; on older agy — or non-Windows, or a --sandbox
run — stdout is empty and the bridge falls back to agy's own transcript at:
~/.gemini/antigravity-cli/brain//.system_generated/logs/transcript.jsonl
For that fallback it locates the conversation via cache/last_conversations.json (falling back to the
newest brain/ directory touched since launch), streams the transcript, and returns the final
source=MODEL, status=DONE, type=PLANNER_RESPONSE entry — the answer, minus the intermediate
tool-calling steps (or the SQLite .db agy dual-writes, when no JSONL exists). This fallback still
runs on 1.1.8+ whenever a run yields no result, so nothing depends on the structured path alone.
Codex. codex exec is well-behaved: the bridge passes -o/--output-last-message and
codex writes its final message straight there — no scraping. Continue works by capturing the session
id from codex's own rollout files (~/.codex/sessions/.../rollout-*.jsonl) and resuming with
codex exec resume , falling back to the newest on-disk session for that cwd after a server
restart.
Copilot. copilot -p "" -s runs a prompt non-interactively and prints the clean final
answer to stdout — the bridge reads it there, no scraping. It runs headless with --allow-all-tools --no-ask-user --no-auto-update (so it never blocks on a prompt), and disables copilot's flaky
builtin GitHub-API MCP by default for predictable latency (COPILOT_GITHUB_MCP=1 re-enables it).
Continue is deterministic: copilot's --session-id both sets a new session's id and
resumes an existing one, so the bridge generates the UUID itself, pins it to the workspace, and
resumes that exact session — falling back after a restart to the newest on-disk session
(~/.copilot/session-state//workspace.yaml) whose recorded cwd matches.
Cursor. cursor-agent -p --output-format text --trust "" runs a prompt non-interactively
and writes the clean final answer straight to stdout — the bridge reads it there, no scraping
(--trust trusts the workspace so it never blocks on a prompt). Continue is deterministic and
race-free: cursor-agent create-chat mints a fresh chat and prints its id, so the bridge mints the
id itself, pins it to the workspace, and resumes that exact chat with -p --resume — no
rollout-scraping. After a restart it falls back to the newest on-disk chat under
~/.cursor/chats/// whose meta.json cwd matches (the chat-dir hash is
itself md5 of the workspace path).
Prerequisites — install whichever backend(s) you want, and sign in once each:
agy and sign in to Antigravity once (via the IDE or agy -i).codex and run codex login once (ChatGPT account or API key).copilot (npm i -g @github/copilot, or winget install GitHub.Copilot)
and run copilot then /login once (or set a COPILOT_GITHUB_TOKEN/GH_TOKEN env var).cursor-agent (curl https://cursor.com/install -fsSL | bash) and run
cursor-agent login once (or set a CURSOR_API_KEY env var).You don't need all four — the tools for a missing CLI simply report "not found" via their *_status
tool.
With uv installed, register the bridge straight from
PyPI under mcpServers in ~/.claude.json — no
path to hardcode, no git pull to remember:
"agent-intern": {
"command": "uvx",
"args": ["agent-intern"]
}
uvx pins to the version it first caches and does not auto-upgrade, so you never run an update you didn't choose — important, since the bridge runs unsandboxed code: a surprise (or compromised) release can't execute until you opt in. When the startup check warns that a newer release is out, upgrade deliberately and restart Claude Code:
uvx agent-intern@latest # fetch + run the newest release (refreshes uv's cache)
Tip:
Prefer hands-off auto-updates? Put
"args": ["agent-intern@latest"]in the config instead — every launch runs the newest release. Convenient, but it pulls new code without asking each time.
Clone it instead if you want to hack on the bridge or pin a local copy:
git clone https://github.com/SinanTufekci/agent-intern.git
cd agent-intern
pip install fastmcp
python test_smoke.py # 4 real round-trips (ask, continue, image, swarm) — prints four PASS lines
Note:
The smoke test costs a tiny bit of quota and takes ~30–60 s. It exercises the Antigravity path.
Then point Claude Code at the absolute path to server.py under mcpServers in ~/.claude.json:
WindowsmacOS / Linux
"agent-intern": {
"command": "python",
"args": ["C:\\path\\to\\server.py"]
}
"agent-intern": {
"command": "python3",
"args": ["/path/to/server.py"]
}
Restart Claude Code. Fifteen tools appear, each prefixed mcp__agent-intern__:
antigravity_ask, antigravity_continue, antigravity_image,
antigravity_image_swarm, antigravity_statuscodex_ask, codex_continue, codex_statuscopilot_ask, copilot_continue, copilot_statuscursor_ask, cursor_continue, cursor_statusagent_swarm — fans a list of tasks out across all four backends in one runThe single-prompt tools — Antigravity, Codex, Copilot, and Cursor — take a watch=true flag
for the live browser view (Watch mode).
Note:
Your client learns how to use the bridge on its own. The server ships MCP instructions — a short routing guide (when to reach for each tool, which backend to pick, and to pass
workspaceso the sub-agent has repo context) that a client like Claude Code injects into the model's context on connect, as an "MCP Server Instructions" block. So the host model knows how and when to drive these tools without you explaining them — you can just ask for the result.
"Use antigravity_ask to summarize the README of this repo in three bullets." → Claude routes the prompt through the bridge, agy reads the file under the workspace root, and the answer comes back as a plain string. Swap in
codex_ask,copilot_ask, orcursor_askto have GPT, Copilot, or Cursor do the same.
| Tool | Purpose |
|---|---|
antigravity_ask(prompt, workspace?, model?, timeout_s?=180, watch?=false) | Start a new Antigravity conversation. model selects the model (agy's --model, e.g. "claude-sonnet-4-6"); validated against agy models, defaults to your settings.json model. watch=true opens the live browser view (Watch mode). |
antigravity_continue(prompt, workspace?, model?, timeout_s?=180, watch?=false) | Continue the conversation rooted at workspace (pinned by id). agy's model is per-invocation, so model can differ from the original ask. watch=true opens the live view. |
antigravity_image(prompt, output_path?, workspace?, timeout_s?=240, watch?=false) | Generate an image; saves the file (extension corrected to the real bytes) and returns its path + format/size. watch=true streams progress and shows the image inline. |
antigravity_image_swarm(prompts, output_paths?, workspaces?, max_concurrency?=4, timeout_s?=240, watch?=false) | Generate several images in parallel (one worker per prompt). |
antigravity_status() | Setup diagnostics: the bridge's own version + whether a newer release is available, plus agy version/compat, state dirs, and newest-transcript readability. Spends no quota. |
| Tool | Purpose |
|---|---|
codex_ask(prompt, workspace?, sandbox?="read-only", model?, timeout_s?=180, watch?=false) | Start a new Codex session. sandbox is a real boundary (see Codex bridge); model selects the model (-m). watch=true opens the live view, streaming codex's steps from its --json event stream. |
codex_continue(prompt, workspace?, timeout_s?=180, watch?=false) | Continue the Codex session rooted at workspace — resumes the exact session id, falling back to the newest on-disk session for that cwd after a server restart. The resumed session keeps its original sandbox and model. watch=true opens the live view. |
codex_status() | Setup diagnostics: codex version, login status (codex login status), sessions dir. Spends no quota. |
| Tool | Purpose |
|---|---|
copilot_ask(prompt, workspace?, sandbox?="read-only", model?, timeout_s?=180, watch?=false) | Start a new Copilot session. sandbox maps to copilot's tool/path permissions (best-effort, not an OS sandbox — see Copilot bridge); model selects the model (--model). watch=true opens the live view, streaming copilot's steps from its --output-format json event stream. |
copilot_continue(prompt, workspace?, sandbox?="read-only", timeout_s?=180, watch?=false) | Continue the Copilot session rooted at workspace — resumes the exact self-set session id, falling back to the newest on-disk session for that cwd after a restart. Unlike Codex, sandbox applies here too (copilot re-applies permissions each turn). watch=true opens the live view. |
copilot_status() | Setup diagnostics: copilot version, an auth hint (no login status command exists, so best-effort), session-state dir. Spends no quota. |
| Tool | Purpose |
|---|---|
cursor_ask(prompt, workspace?, sandbox?="read-only", model?, timeout_s?=180, watch?=false) | Start a new Cursor chat. sandbox maps to cursor's mode/force flags (agent-enforced, not an OS sandbox — see Cursor bridge); model selects the model (--model, validated against cursor-agent models). watch=true opens the live view, streaming cursor's steps from its --output-format stream-json event stream. |
cursor_continue(prompt, workspace?, sandbox?="read-only", timeout_s?=180, watch?=false) | Continue the Cursor chat rooted at workspace — resumes the exact chat id the bridge minted (create-chat + --resume), falling back to the newest on-disk chat for that cwd after a restart. watch=true opens the live view. |
cursor_status() | Setup diagnostics: the bridge's own version + whether a newer release is available, plus cursor version and login status (cursor-agent status). Spends no quota. |
| Tool | Purpose |
|---|---|
agent_swarm(tasks, max_concurrency?=4, timeout_s?=180, watch?=false) | Run several tasks in parallel across all four backends — each task names its backend (antigravity, codex, copilot, or cursor) plus a prompt (an optional model for any backend, and sandbox for Codex/Copilot/Cursor). Every answer comes back in one block; watch=true opens the live dashboard (Swarm). |
workspace defaults to the MCP server's current working directory. Point it at a real project dir
for context-aware answers — every backend gives the model access to files under that root (Codex,
Copilot, and Cursor honoring their sandbox).
antigravity_image forces agy to save to an explicit absolute path — without one, agy
falls back to its own scratch dir (~/.gemini/antigravity-cli/scratch/). It then
corrects the file extension to match the real bytes: agy's image model picks the
format itself (JPEG for photo-like images, PNG for flat graphics), so a requested
out.png may come back as out.jpg. The returned path always reflects the true
format.
codex exec writes its final message to a file the bridge asks for via -o/--output-last-message,
so the answer comes back without any scraping (where agy needed a transcript workaround before 1.0.15
fixed its stdout). Three things make Codex worth reaching for over Antigravity:
sandbox accepts read-only (default — reads and answers, writes nothing),
workspace-write (may edit files under the workspace), or danger-full-access (no sandbox —
avoid). Unlike agy's no-op --sandbox, codex's -s actually enforces this. codex exec has no
interactive approval gate, so this flag is your safety boundary — opt into write access
deliberately.model maps to codex's -m. (agy's --model works in print mode too
as of 1.0.16; all four backends now expose the same model knob.)codex_image. Its
strength is reasoning and real code/repo work; hand it the jobs that need a heavier model.Auth. Uses your existing Codex login (ChatGPT account or API key). Run codex login once; check
with codex_status. No new keys for the bridge to manage.
Warning:
codex execruns the model as an autonomous agent with no interactive approval gate. Thesandboxflag (defaultread-only) is the real boundary, butworkspace-write/danger-full-accesslet it modify files — and a swarm runs N agents at once. Only use it with trusted prompts on trusted content.
The GitHub Copilot CLI (copilot, from @github/copilot) is stdout-native like Codex:
copilot -p "" -s runs a prompt non-interactively and prints just the final answer to
stdout, so the bridge reads it there — no scraping. What makes it worth reaching for:
model maps to copilot's --model; auto lets Copilot pick. Unlike the agy
and cursor tools, the bridge can't validate this — copilot exposes no non-interactive model
list — and the working set is account-dependent: on a Copilot Pro account here, auto worked
while gpt-5.3-codex, claude-sonnet-4.6, and even GitHub's own --help example gpt-5.4 were all
rejected as "not available". So omit model (account default) or pass auto unless you know your
plan's ids; an unavailable one errors immediately with copilot's message, costing a call.--session-id both sets a new session's
id and resumes an existing one, so the bridge generates the UUID itself and pins it to the
workspace — no rollout-scraping. After a restart it falls back to the newest on-disk session
(~/.copilot/session-state//workspace.yaml) whose recorded cwd matches.--allow-all-tools --no-ask-user --no-auto-update, and disables
copilot's builtin GitHub-API MCP (--disable-builtin-mcps) because its flaky HTTP connect can stall
a call up to ~60 s. Set COPILOT_GITHUB_MCP=1 to keep it (for Copilot's issue/PR/repo tools).Sandbox is best-effort, not enforced. Unlike Codex's OS sandbox, copilot's boundary is
tool/path permissions. The sandbox knob maps to copilot flags for a uniform cross-backend field:
read-only (default) — auto-approves tools so it runs headless, then denies the local
write and shell tools (--deny-tool). Best-effort: it is not an OS sandbox, and network/MCP
tools can still act. For a hard read-only boundary, use codex_ask instead.workspace-write — writes allowed, but file access stays confined to the workspace (no
--allow-all-paths).danger-full-access — --allow-all (tools + all paths + all URLs). Avoid.Auth. Uses your existing Copilot login — run copilot then /login once (stored in the OS
credential store), or set COPILOT_GITHUB_TOKEN/GH_TOKEN/GITHUB_TOKEN for headless use. Check
with copilot_status. If copilot isn't on PATH (the winget install can land off a stale PATH),
set COPILOT_BIN to its full path — e.g.
%LOCALAPPDATA%\Microsoft\WinGet\Packages\GitHub.Copilot_*\copilot.exe.
Warning:
copilot -pruns the model as an autonomous agent with--allow-all-tools(required to run headless). Itssandboxis best-effort tool/path permissions, not an OS sandbox — safer than agy, weaker than Codex'sread-only. Only use it with trusted prompts on trusted content.
Cursor's agent CLI (cursor-agent, from cursor.com/cli) is stdout-native
like Codex and Copilot: cursor-agent -p --output-format text --trust "" runs a prompt
non-interactively and writes just the final answer to stdout, so the bridge reads it there — no
scraping (--trust trusts the workspace so it won't block on a prompt). What makes it worth reaching
for:
model maps to cursor's --model (e.g. auto, gpt-5.2,
claude-opus-4-8-high, composer-2.5, cursor-grok-4.5-high) — GPT, Claude, Grok, and Composer in
one place, ~190 ids at the time of writing. cursor bakes the effort and speed axes into the id
(…-low / -high / -xhigh / -max, each with a -fast twin), and also accepts a bracket form on
the family base, e.g. claude-opus-4-8[context=1m,effort=high]. The bridge validates against
cursor-agent models and rejects a typo up front (like agy), accepting either an exact id or a
family base. Omit model to use your Cursor account default. cursor reshuffles this list often —
run cursor-agent models (or cursor_status) rather than trusting an example here.cursor-agent create-chat mints a fresh chat and prints its
id, and -p --resume resumes that exact chat — so the bridge mints the id itself, pins it
to the workspace, and resumes deterministically (no rollout-scraping, same idea as Copilot's
self-set session id). After a restart it falls back to the newest on-disk chat under
~/.cursor/chats/// whose meta.json cwd matches (the chat-dir hash is
itself md5 of the workspace path).Sandbox is agent-enforced, not an OS sandbox. Like Copilot, cursor's boundary is which tools the
agent can reach, not an OS jail. The sandbox knob maps to cursor's mode/force flags for a uniform
cross-backend field:
read-only (default) — --mode ask: the write and shell tools are unavailable, so
cursor analyzes and answers but makes no edits (verified: it refuses to write files). Agent-enforced
and best-effort — it is not an OS sandbox. For a hard read-only boundary, use codex_ask
instead.workspace-write — --force: edits and commands allowed, file access rooted at --workspace.danger-full-access — --force --sandbox disabled (OS sandbox off). Avoid.(Cursor also exposes an OS-level --sandbox enabled/disabled; the bridge drives the uniform field via
mode/force.)
Auth. Uses your existing Cursor login — run cursor-agent login once (OS credential store), or
set CURSOR_API_KEY for headless use. Check with cursor_status. If cursor-agent isn't reliably on
PATH (the installer drops a cursor-agent.CMD shim a bare name can't launch on Windows), set
CURSOR_BIN to its full path — mirrors the AGY_BIN/CODEX_BIN/COPILOT_BIN overrides.
Warning:
cursor-agent -pruns the model as an autonomous agent with--trust(and--forcewhen writes are allowed). Itssandboxis agent-enforced (read-only makes the write/shell tools unavailable), not an OS sandbox — safer than agy, weaker than Codex'sread-only. Only use it with trusted prompts on trusted content.
Pass watch=true to any single-prompt tool — antigravity_ask, antigravity_continue,
antigravity_image, codex_ask, codex_continue, copilot_ask, copilot_continue, cursor_ask,
or cursor_continue — to watch
the agent work live in a little chat-style browser window called Agent Intern. The agent
still runs headless; alongside it the bridge serves a tiny page on 127.0.0.1 and opens it in a
small, chromeless app window that renders the exchange as a conversation: your prompt shows as a
chat bubble, the agent's live steps stream in a collapsible "thinking" trace — its planner narration
(▸), the real commands it runs ($), and completions (✓), read live (from agy's
--output-format stream-json on 1.1.8+ — its transcript on older agy — or codex's / copilot's JSON
event stream, or cursor's --output-format stream-json) — and the final
answer arrives as a Markdown card (and, for
antigravity_image with watch=true, the generated image shown inline). A *_continue run
opens with the prior turns of the conversation shown as history, so it reads as one ongoing
thread rather than a blank new window. (A watched cursor_continue is the exception — Cursor stores
its transcript in an opaque SQLite blob, so its window opens without visible prior-turn history.)
text ask / continue (agy, codex, copilot, or cursor) antigravity_image — image inline
Real captures — the agent runs headless while the Agent Intern window renders the exchange as a chat conversation: your prompt as a CLAUDE bubble, live steps (▸ narration · $ commands · ✓ completions) in a collapsible trace, then the final Markdown answer or inline image.
--app mode) for the
windowed look; falls back to a normal browser window. If nothing can open, the run
still completes and returns normally.AGY_WATCH_WINDOW_SIZE (e.g. AGY_WATCH_WINDOW_SIZE=480,700)
to resize the window; default is 560,760. Press Enter / Esc in the window to
close it.codex_ask and a
copilot_ask at once) each stream into their own view and never clobber each other.
If you closed the window, the next run opens a fresh one. Set AGY_WATCH_ALWAYS_NEW=1
to force a new window every time.*_continue run seeds the window with
the conversation's prior turns, read from each backend's own session store (agy's
transcript, codex's rollout, copilot's events.jsonl; Cursor's store is opaque, so a watched
cursor_continue opens without visible history). The swarm's per-worker detail
window uses the same chat design for its one task.agent_swarm fans a list of tasks out to workers that run truly
concurrently (capped at max_concurrency, default 4), then returns every
worker's result in one block. Each task names its own backend, so a single
swarm can mix Antigravity (Gemini), Codex, Copilot, and Cursor workers — hand the
reasoning-heavy jobs to Codex, Copilot, or Cursor and the quick ones to Gemini, all at
once. Good for independent sub-tasks: summarise N files, ask the same question
about N repos, fix N bugs. (antigravity_image_swarm stays separate — it
generates N images, and only agy has an image model.)
agent_swarm(tasks=[
{"backend": "antigravity", "prompt": "Summarise src/auth.py in 2 bullets."},
{"backend": "codex", "prompt": "Find and fix the failing test in tests/",
"sandbox": "workspace-write", "workspace": "./repo"},
{"backend": "copilot", "prompt": "Explain what src/api.py exposes.",
"sandbox": "read-only", "workspace": "./repo"},
{"backend": "cursor", "prompt": "Draft a docstring for src/utils.py.",
"model": "auto", "workspace": "./repo"},
])
agent_swarm(..., watch=true) — one row per worker (with a backend badge); the done/total bar climbs as workers finish. Click a row (or ↑/↓ then ↵) to pop that agent into its own window.
How it stays correct under concurrency. The single-agent agy tools serialize
through a lock because agy rewrites last_conversations.json on every call, so
concurrent runs sharing one state dir would race. The swarm sidesteps this: each
agy worker runs with its own isolated HOME/USERPROFILE, so agy's
brain/, cache/, and last_conversations.json never collide — no lock needed.
Auth still works because agy reads it from the OS credential store, not from
~/.gemini (verified on agy 1.0.9). Codex, Copilot, and Cursor workers need no such
isolation — each is a fresh one-shot (codex exec with its own -o file; copilot -p with its own self-set session id; cursor-agent -p with its own minted chat id). Each worker's cwd is its real workspace,
so file access is unchanged. Measured ~2.8× speedup at 3 agy workers (the AI Pro
backend does not serialize per-account); higher max_concurrency trades
quota/rate-limit pressure for wall-clock.
backend (antigravity/codex/copilot/cursor) and prompt
are required; workspace defaults to the server cwd; sandbox and model apply
to Codex, Copilot, and Cursor (ignored for Antigravity). Swarm workers are
one-shot — there is no *_continue for a swarm worker's session.watch=true — opens a thin live Agent Swarm dashboard (one row per
worker, with a backend badge, repo, prompt, and latest step). Click a row
to pop that agent into its own window streaming its full step log.Warning:
A swarm launches N unsandboxed agents at once — N× the prompt-injection "lethal trifecta" surface of a single call (see Security). Only use it with trusted prompts on trusted content. Codex workers honor their enforced
sandbox; Copilot and Cursor workers honor their best-effortsandbox; Antigravity workers have no real boundary.
| 🛰️ Antigravity | 🤖 Codex | 🐙 Copilot | ✳️ Cursor | |
|---|---|---|---|---|
| Model | Selectable via the model argument (agy's --model, e.g. "gemini-3.1-pro-high", "claude-sonnet-4-6"); omit to use the "model" field in agy's settings.json (gemini-3.6-flash-high by default as of 1.1.6). agy 1.1.5 replaced the old human labels with these slugs — the old "Gemini 3.1 Pro (High)" form no longer works. Switching model in -p used to hang (through ~1.0.14) but is fixed as of 1.0.16. An unknown model was silently ignored through 1.1.1 and hard-fails in -p as of 1.1.2; either way the bridge validates it against agy models and rejects a typo up front. Flash High is speed-optimized for cheap tool-calling; pick a bigger model for heavier work. | Selectable via the model argument (codex's -m). codex does not hang on a switch, so model choice is a first-class knob. | Selectable via the model argument (--model, e.g. gpt-5.3-codex, claude-sonnet-4.6, auto); omit for your account default. An unavailable model errors immediately. | Selectable via the model argument (--model, e.g. gpt-5.2, sonnet-4-thinking, auto, or parameterized ids like claude-opus-4-8[context=1m]); a wide GPT/Claude/Grok/Composer menu, validated against cursor-agent models (a typo is rejected up front). Omit for your Cursor account default. |
| Auth | Piggybacks whatever credential store agy uses on your OS (Windows Credential Manager, macOS Keychain, libsecret on Linux — the bridge never touches it directly). Log in once; every call silent-auths on the same AI Pro quota you already pay for. | Uses your existing Codex login — ChatGPT account or API key. Run codex login once; verify with codex_status. | Uses your existing Copilot login — run copilot then /login once (OS credential store), or set COPILOT_GITHUB_TOKEN/GH_TOKEN/GITHUB_TOKEN. Verify with copilot_status. | Uses your existing Cursor login — run cursor-agent login once (OS credential store), or set CURSOR_API_KEY. Verify with cursor_status. |
All four backends run the model as an autonomous agent. The difference is whether you get a real boundary: Codex enforces one, Copilot and Cursor offer best-effort ones, Antigravity offers none.
agy -p executes its own tools — reading and writing files, running shell commands, reaching
the network — with no approval gate. Through agy 1.1.2 that was simply how print mode worked,
with no opt-out at all. As of 1.1.3 it is a choice the bridge makes: agy finally gates headless
tool calls, and the bridge deliberately opts out with --dangerously-skip-permissions, because a
gated -p can do no useful work (it soft-denies even a plain file read, and print mode has no way
to prompt). The posture below is therefore unchanged — assume every call runs arbitrary code with
your privileges. Re-verified empirically on agy 1.0.9 / Windows, with the 1.1.3 amendment noted:
--dangerously-skip-permissions — that flag was a no-op for -p through 1.1.2. As of 1.1.3
it is load-bearing: without it every tool-using call is soft-denied, and the bridge now always
passes it (it must precede -p, whose value is the prompt). There is still no agy flag that
makes print mode both safe and useful.toolPermission=request-review), but it
still does not gate print-mode execution — a fresh -p run created a file outside the
workspace with no prompt. agy 1.0.12 reshuffled how that permission config merges (per-project
files under ~/.gemini/config/projects/ now take precedence over
~/.gemini/antigravity-cli/settings.json), and 1.0.13 made "Always Approve" rule matching
strict (non-regex) by default with a regex: opt-in and relaxed its redirection checks — but
those are config/interactive-approval changes, they add no print-mode approval gate, and the
bridge reads none of it.--sandbox is not a usable boundary. agy 1.0.6 fixed its propagation into -p (the 1.0.6/1.0.7
changelog calls this "sandbox isolation correctly enforced") and it now does block terminal/
shell command execution — but re-verified on 1.0.9 that it leaves the write_to_file tool and
network wide open: under --sandbox the model still wrote a file outside its workspace. agy
1.0.9 hardened the sandbox's command path (stricter exact-match command checks; .git added to
its dangerous-paths list), but none of that closes the out-of-workspace write_to_file hole. On
top of that, a --sandbox run whose blocked terminal command halts it writes no JSONL
transcript (only the SQLite .db, re-confirmed on 1.0.9). The bridge can now read that .db,
but still never passes --sandbox — it's no boundary, with file writes and network left open.codex exec also has no interactive approval gate, but its sandbox flag is a genuine boundary
that codex enforces:
read-only (default) — reads and answers; writes nothing. Safe for untrusted questions on
trusted content.workspace-write — may edit files under the workspace. Opt in deliberately, per task.danger-full-access — no sandbox at all. Avoid.Because there's no approval prompt, the flag you pass is the safety decision — choose it per call.
copilot -p runs headless with --allow-all-tools (required — otherwise it blocks on per-tool
permission prompts). Its sandbox maps to copilot's tool/path permission flags, which are a
real-ish but not enforced boundary:
read-only (default) — auto-approves tools to run headless, then denies the local write
and shell tools (--deny-tool). Blocks local file edits and command execution, but it is not
an OS sandbox: other tools (including network/MCP) can still act. Weaker than Codex's read-only.workspace-write — writes allowed, but file access stays confined to the workspace (no
--allow-all-paths).danger-full-access — --allow-all (tools + all paths + all URLs). Avoid.For a hard read-only boundary, prefer codex_ask.
cursor-agent -p runs headless with --trust (and --force when writes are allowed). Its sandbox
maps to cursor's mode/force flags — an agent-enforced, not OS-level, boundary:
read-only (default) — --mode ask: the local write and shell tools are unavailable,
so cursor analyzes and answers but makes no edits (verified: it refuses to write files). Like
Copilot, this is agent-enforced and not an OS sandbox. Weaker than Codex's read-only.workspace-write — --force: edits and commands allowed, file access rooted at --workspace.danger-full-access — --force --sandbox disabled (OS sandbox off). Avoid.For a hard read-only boundary, prefer codex_ask.
workspace argument is only a starting context, not a security boundary — Antigravity
can and does act outside it; Codex is bounded by its enforced sandbox; Copilot by its best-effort
tool/path permissions; Cursor by its agent-enforced mode/force.read-only.The bridge itself does only cross-platform filesystem reads under ~/.gemini/antigravity-cli/,
~/.codex/, ~/.copilot/, and ~/.cursor/ — no private APIs, no token theft. The risk above is
entirely in what the sub-agents are allowed to do.
Is this against Google's / OpenAI's / GitHub's / Cursor's Terms of Service?
It runs the official agy, codex, copilot, and cursor-agent CLIs under your own logins — no
private APIs, no token theft, no quota abuse. It just bridges what the CLIs already do. That said, your
AI Pro / Antigravity, OpenAI / Codex, GitHub Copilot, and Cursor ToS apply, and you're responsible for
staying within them.
Do I need all four CLIs?
No. Each backend is independent — install only the CLI(s) you want. The tools for a missing backend
report "not found" via their *_status tool (antigravity_status / codex_status /
copilot_status / cursor_status) and never crash the server.
When should I use Antigravity vs Codex vs Copilot vs Cursor?
Use Antigravity for fast, cheap tool-calling, quick answers, and image generation (it's the
only backend with an image model) — and it now lets you pick the model too (agy's --model). Use
Codex for heavier reasoning, real code/repo work, or when you want a real, enforced
workspace-write sandbox. Use Copilot for agentic coding on your GitHub Copilot plan, or as a
second coding opinion alongside Codex — noting its sandbox is best-effort, not enforced. Use
Cursor for agentic coding on a Cursor plan, or when you want the widest model menu —
GPT, Claude, Grok, and Composer, all via model — noting its sandbox is agent-enforced, like
Copilot's. All four let you choose a model; in a swarm you can mix all four. See
The four backends at a glance.
Will it break when agy updates?
Less likely now. As of agy 1.0.15 the bridge prefers agy's stdout on the happy path (1.0.15
fixed the print-mode stdout bug on Windows — -p now writes the clean answer there), which removes
its dependence on agy's undocumented transcript schema for normal runs. It still falls back to
reading the JSONL transcript, or the SQLite .db agy dual-writes, when stdout is empty (older agy,
non-Windows, or --sandbox runs) — so a schema change would only bite that fallback path. Re-verified
working on 1.0.15 (stdout answer clean under tool use; transcript/.db fallback intact; live ask
round-trip + antigravity_status diagnostics pass). Still, if you rely on the fallback, pin a
known-good agy version.
Which model does Antigravity use — can I pick it?
Yes. Pass model to antigravity_ask/antigravity_continue (or per task in agent_swarm) — it maps
to agy's --model, taking any slug from agy models (e.g. "gemini-3.1-pro-high",
"claude-sonnet-4-6"). Omit it to use the "model" field in agy's settings.json, which
defaults to gemini-3.6-flash-high as of agy 1.1.6 — speed-optimized for cheap tool-calling.
agy 1.1.5 renamed every model, replacing the old human labels ("Gemini 3.1 Pro (High)") with
stable slugs (gemini-3.1-pro-high) — the old form is no longer accepted, so pass slugs. agy 1.1.6
then added the gemini-3.6-flash family and moved the default to it. The full list, re-checked live
on 1.1.8 and unchanged since 1.1.6:
gemini-3.6-flash-low|medium|high, gemini-3.5-flash-low|medium|high, gemini-3.1-pro-low|high,
claude-sonnet-4-6, claude-opus-4-6-thinking, gpt-oss-120b-medium. Note the slug bakes in the
reasoning effort, which is why the flash and pro models appear once per level.
agy 1.0.5 added --model, but through ~1.0.14 switching to a different model in -p hung the
call, so earlier bridge versions stayed single-model. Re-verified on agy 1.0.16 that the hang is
fixed — a Claude model answers as Anthropic Claude, a Gemini model as Gemini, each in seconds. One
caveat the bridge handles for you: agy silently ignores an unknown model (it falls back to the
default with no error), so the bridge validates your slug against agy models and rejects a typo up
front.
Can it generate images?
Yes — that's the antigravity_image tool, on the Antigravity backend. agy's print mode generates
real images on your AI Pro quota; antigravity_image drives it, saves the file to a path you choose
(or a timestamped default in your workspace), fixes the extension to match the real bytes (agy picks
JPEG or PNG itself), and returns the path. Verified on agy 1.0.9 / Windows. Codex has no image
model — it's a coding agent.
Does it cost extra money?
No. It uses the same quota you already pay for — AI Pro for Antigravity, your Codex plan for Codex, your GitHub Copilot plan for Copilot, your Cursor plan for Cursor. The smoke test spends a negligible amount.
Does it stream responses?
The final answer is request/response — the CLIs return it all at once, so the tools return when the
agent finishes (each call typically takes 10–30 s; Copilot's reasoning models can run longer). If you
want to watch the agent work as it goes,
pass watch=true to any single-prompt tool: it opens the Agent Intern browser window and
live-streams the agent's steps — see Watch mode. It's coarse (a handful of steps, not
token-by-token), and the returned value is identical to the non-watch call.
Can I run several calls at once?
The single-agent tools are serialized inside the server: agy rewrites last_conversations.json
on every call, so concurrent runs sharing one state dir would race and could return the wrong
conversation. A threading.Lock makes extra requests queue rather than race. (On agy 1.1.8+ the
bridge also records the conversation_id agy reports for each run and prefers it when pinning a
continue, so that resolution no longer depends on the shared file — but the lock stays, since agy's
state dir is still shared and a fresh server process starts with nothing recorded.)
For real parallelism use agent_swarm — each agy worker runs in its own isolated state
dir (and Codex/Copilot/Cursor workers need none), so they don't race and the lock isn't needed (~2.8×
at 3 workers). That's the supported way to run many calls at once, across any backend.
--output-format flag (text | json | stream-json). The existing text path
was confirmed live on 1.1.8 first (ask, pinned continue, and --model all clean), then the bridge
switched its plain ask/continue calls to --output-format json, because reading a contractual
response field beats trusting the layout of bare text. The real prize is the conversation_id
agy returns with it: the bridge records it and pins a later antigravity_continue to exactly the
conversation it last ran in that workspace, instead of inferring it from last_conversations.json
— shared state agy rewrites for every session, including your own interactive TUI work in the same
folder. Practical difference: antigravity_continue now resumes the bridge's own thread, where
before it could land on a conversation you'd since started in the Antigravity TUI. Older agy is
unaffected — the flag is version-gated (pre-1.1.8 has no such flag), and any non-JSON stdout falls
back to the previous text path, so a silently-ignored flag degrades instead of crashing.
VERIFIED_AGY_VERSION → (1, 1, 8). Not adopted: --json-schema (works; nothing here needs it).
Nothing else in 1.1.7/1.1.8 reaches the bridge — the rest is interactive-TUI, plugin-hook, and
MCP-client work.--output-format stream-json and consume agy's typed
init / step_update / result events straight off stdout. Verified before the rewrite that they
arrive incrementally (a 17 s run spread its 18 events over 12.4 s), and confirmed live that a
watched run's step count grows while agy works. The stream carries the real command as a nested
object (the transcript stored tool args JSON-encoded inside a string), streaming text fragments,
and a conversation_id — so a watched run now pins later continues just like a plain one. This
retires the timer-based transcript polling, which matters beyond tidiness: agy has announced JSONL
is being replaced by SQLite, and watch was the last path that would have broken when it goes.
Pre-1.1.8 agy keeps the original transcript path, re-verified live.response is
the whole turn; the old transcript scrape returned only the last planner response. Identical for a
single-step ask, different for a chatty multi-step one (one measured run: 297 chars vs 128, the
full answer ending in the old one). The full turn is now returned on every path — response is
agy's own contract for what the turn produced, and the old last-step rule silently dropped content
whenever the model did the work and then closed with a short "Done."gemini-3.6-flash family
to agy models and moved the settings.json default to Gemini 3.6 Flash (High); the default
path and --model gemini-3.6-flash-high both round-tripped clean, and the JSONL + SQLite read paths
still match agy's unchanged conversation schema. Its one bridge-adjacent fix — print mode now
surfacing the real conversation-creation error instead of a misleading "no active conversation" —
only improves the diagnostic the bridge already reads on failure. Everything else (Markdown custom
agents, /copy and /codesearch polish, background-task hardening) is interactive-TUI or
client-side work that doesn't reach the bridge. Docs-only: the model list and default examples now
name the 1.1.6 slugs, and the guard test advertises gemini-3.6-flash-high against the live list.model values now fail. 1.1.5
replaced agy's human-readable model labels with stable slugs, and agy models reports only those:
"Gemini 3.1 Pro (High)" is now gemini-3.1-pro-high, and the Claude entries are
claude-sonnet-4-6 and claude-opus-4-6-thinking (the mapping is not 1:1 — check
agy models, or antigravity_status, for the current eight). Since the bridge validates model against
agy models, an old label is rejected up front with the valid list — you lose the call, not
your money, and never silently run on the wrong model. Pass slugs and you're fine. Nothing in the
bridge's machinery needed changing (validation was always format-agnostic — which is exactly why
the entire test suite stayed green while every documented example went stale), so this release is
docs plus one new test that checks the models we advertise against the live agy models list.
Everything else in 1.1.5 is interactive-TUI, MCP-client, or background-task work that doesn't reach
the bridge; its new --effort flag is a second axis we don't pass, because the slug already pins
the effort variant.-p now honors your persisted settings.json policies (permissions, file access, sandbox
mode, auto-execution, artifact review) instead of blanket-denying. --dangerously-skip-permissions
still overrides those policies, so the flag stays load-bearing and stays exactly where it is —
re-verified live against a workspace deliberately absent from trustedWorkspaces, with a
permissions.allow list naming neither file nor command access: a workspace file read returned the
right contents, and a terminal command and a file write both executed. Worth knowing: that flag is
now the only thing between a bridge call and your own settings.json policy, and dropping it would
get you whatever that file says rather than 1.1.3's deny-everything. 1.1.4 also stopped /btw
side-questions from leaking into the conversation list as duplicates carrying the parent's title —
that list is what conversation pinning reads, so one way to resume the wrong thread is gone.last_conversations.json (still keyed by workspace path),
the brain/.../transcript.jsonl path, the transcript schema, and the -p/-c/--print-timeout
flags are all unchanged; a live antigravity_ask + conversation-pinned antigravity_continue
round-trip returns clean over stdout and antigravity_status diagnostics pass. 1.1.3 broke and
the bridge fixed the one thing that mattered: headless -p no longer auto-approves tool calls,
it soft-denies them (print mode cannot prompt), so without a flag even "read pyproject.toml
and report the version" returned nothing — exit 0, empty stdout, the reason only on stderr. The
bridge now passes --dangerously-skip-permissions on every agy path, which restores file writes,
terminal commands and workspace reads (a live bridge round-trip reads this repo's real version
again). The flag must precede -p, whose value is the prompt — otherwise the flag becomes
the prompt and the task is silently dropped. 1.1.2 also made an unresolvable --model hard-fail
in -p instead of silently falling back to the settings.json default (the bridge's validate_model
still rejects a typo up front, without spending a call). 1.1.0's execution-mode system
(--mode, request-review) remains a no-op for the bridge: -p is spawned with DEVNULL stdin, so
that interactive gate never engages. --sandbox behavior is likewise unchanged (blocks the
terminal, not file writes). The print-mode stdout path (fixed on 1.0.15, Windows) still
applies; the transcript stays the fallback.codex exec, -o/--output-last-message,
codex exec resume, the --json event stream, and the ~/.codex/sessions/.../rollout-*.jsonl
layout the continue path reads are all in place; a live codex_ask round-trip + codex_status
pass. (Bumped from the 0.141.0 baseline: flags, session layout and the round-trip all re-verified
unchanged.)copilot -p -s (clean stdout answer), --session-id
set-then-resume, --model, --output-format json (watch stream), and the
~/.copilot/session-state//workspace.yaml layout the continue fallback reads are all in place;
live copilot_ask / copilot_continue round-trips + a mixed agent_swarm pass. (Bumped from
1.0.68: 1.0.69 adds a --resume convenience flag the bridge doesn't need; --session-id still
both sets a fresh id and resumes it — re-verified live, ACK then codeword recall.)cursor-agent -p --output-format text --trust (clean
stdout answer), create-chat + -p --resume , --model (validated against cursor-agent models), --output-format stream-json (watch stream), and the
~/.cursor/chats///meta.json layout the continue fallback reads are all in
place; live cursor_ask / cursor_continue round-trips + a mixed agent_swarm pass. (2026.07.09
is installed and cursor_status — found, logged in, chats dir — passes with flags/layout intact; a
fresh live round-trip was deferred, Cursor usage limit reached.)-p wrote its answer to the controlling terminal,
not stdout; under a TUI that text leaked into the host's prompt (seen on 1.0.9). 1.0.15 fixed this
on Windows (stdout now carries the answer), but the bridge still spawns agy detached
(CREATE_NO_WINDOW / a new POSIX session), which prevents the leak on older/other platforms and is
harmless on 1.0.15+..db per conversation; on the fallback
path, when the JSONL transcript is absent (already true for --sandbox runs, and the announced
future default) _read_response falls back to reading the .db, verified to match across 100+
conversations. See the FAQ.-p now prints the clean answer to stdout in a non-TTY
subprocess (Windows), so the bridge prefers stdout and only scrapes the transcript when stdout is
empty (older agy, non-Windows, or --sandbox). (Codex and Copilot never had this problem — both
are stdout-native.)watch=true to any single-prompt tool to open the
Agent Intern window and watch the agent work live (coarse steps; image shown inline).
Best-effort and cross-platform; see Watch mode.--sandbox blocks only shell commands, so it's no boundary and the bridge
never passes it. Codex's sandbox is real and enforced — use it; default read-only.
Copilot's sandbox is best-effort (tool/path denials, not an OS sandbox); default read-only.
Cursor's sandbox is agent-enforced (mode/force; read-only = --mode ask makes write/shell
unavailable, not an OS sandbox); default read-only. See Security.agy 1.0.0+ on PATH (state-file layout re-verified on 1.0.15) and an active Antigravity / AI Pro sessioncodex on PATH and logged in (codex login) — verified on codex-cli 0.144.1copilot on PATH and logged in (copilot → /login, or a COPILOT_GITHUB_TOKEN/GH_TOKEN env) — verified on copilot 1.0.69cursor-agent on PATH and logged in (cursor-agent login, or a CURSOR_API_KEY env) — verified on cursor-agent 2026.07.08Each backend is independent — install only the CLI(s) you plan to use; the other tools simply report "not found" via their *_status tool.
Tip:
If
agyisn't reliably onPATH(e.g. a new terminal or reboot drops it on Windows), set theAGY_BINenv var to its full path and the bridge will use that instead of"agy"— e.g.AGY_BIN=%LOCALAPPDATA%\agy\bin\agy.exe. Likewise, setCODEX_BINifcodexisn't reliably onPATH(the native Windows installer puts it under%LOCALAPPDATA%\Programs\OpenAI\Codex\bin\), andCOPILOT_BINifcopilotisn't (the winget install lands under%LOCALAPPDATA%\Microsoft\WinGet\Packages\GitHub.Copilot_*\copilot.exe). Finally, setCURSOR_BINifcursor-agentisn't reliably onPATH(the installer drops acursor-agent.CMDshim a bare name can't launch on Windows).
The bridge uses only cross-platform Python (Path.home(), subprocess) and reads paths under
~/.gemini/antigravity-cli/, ~/.codex/, ~/.copilot/, and ~/.cursor/, which the CLIs write the
same way on every OS. Developed and verified on Windows; macOS and Linux should work unmodified
provided the CLIs run there. If you test it on those platforms, please open an issue / PR to confirm.
@fallout and the Japanese developer community for featuring this project and providing invaluable feedback!
💡 Path Resolution Fix: Thanks to their community's real-world testing, we identified and resolved a Windows PATH edge case where the MCP server inherits a stale
PATHat startup and can't findagy. TheAGY_BINenvironment-variable fallback was implemented directly inspired by their report!
MIT. Do whatever you want with it.
Install via CLI
npx mdskills install SinanTufekci/agent-internClaude Code × Antigravity + Codex + Copilot + Cursor — MCP Bridge is a free, open-source AI agent skill. Drive four external coding CLIs — Google's Antigravity (Gemini 3.6 Flash), OpenAI Codex, the GitHub Copilot CLI, and Cursor — as sub-agents inside Claude Code. Text answers, image generation, real repo work, and parallel swarms, on quota you already pay for. One MCP server, four backends. It exposes Google Antigravity, OpenAI Codex, the GitHub Copilot CLI, and Cursor to Claude Code as clean MCP to
Install Claude Code × Antigravity + Codex + Copilot + Cursor — MCP Bridge with a single command:
npx mdskills install SinanTufekci/agent-internThis downloads the skill files into your project and your AI agent picks them up automatically.
Claude Code × Antigravity + Codex + Copilot + Cursor — MCP Bridge works with Claude Code, Claude Desktop, Cursor, Vscode Copilot, Windsurf, Continue Dev, Gemini Cli, Amp, Roo Code, Goose. Skills use the open SKILL.md format which is compatible with any AI coding agent that reads markdown instructions.