mcp-agents 0.6.6 → 0.8.0

package/README.md

@@ -1,6 +1,6 @@
 # mcp-agents
 
-MCP server that wraps AI CLI tools — [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Gemini CLI](https://github.com/google-gemini/gemini-cli), and [Codex CLI](https://github.com/openai/codex) — so any MCP client can call them as tools.
+MCP server that wraps AI CLI tools — [Claude Code](https://docs.anthropic.com/en/docs/claude-code), [Antigravity CLI](https://antigravity.google/) (`agy`), and [Codex CLI](https://github.com/openai/codex) — so any MCP client can call them as tools.
 
 ## Prerequisites
 
@@ -10,7 +10,7 @@ MCP server that wraps AI CLI tools — [Claude Code](https://docs.anthropic.com/
 | CLI | Install |
 |-----|---------|
 | `claude` | [Claude Code docs](https://docs.anthropic.com/en/docs/claude-code) |
-| `gemini` | `npm install -g @anthropic-ai/gemini-cli` |
+| `agy` | [Google Antigravity](https://antigravity.google/) |
 | `codex` | `npm install -g @openai/codex` |
 
 Only the CLI you select with `--provider` needs to be present.
@@ -37,9 +37,6 @@ mcp-agents
 # Specific provider
 mcp-agents --provider claude
 mcp-agents --provider gemini
-
-# Optional: enable Gemini sandbox mode
-mcp-agents --provider gemini --sandbox true
 ```
 
 The server speaks [JSON-RPC over stdio](https://modelcontextprotocol.io/docs/concepts/transports#stdio). It prints `[mcp-agents] ready (provider: <name>)` to stderr when it's listening.
@@ -50,8 +47,8 @@ Each `--provider` flag maps to a single exposed tool:
 
 | Provider | Tool name | CLI command |
 |----------|-----------|-------------|
-| `claude` | `claude_code` | `claude -p --output-format json` |
-| `gemini` | `gemini` | `gemini [-s] -p <prompt>` |
+| `claude` | `claude_code` | `claude --model claude-opus-4-8 --effort xhigh -p --output-format json` |
+| `gemini` | `gemini` | `agy --sandbox -p <prompt>` |
 | `codex` | *(pass-through)* | `codex mcp-server` |
 
 ### `claude_code` parameters
@@ -61,20 +58,21 @@ Each `--provider` flag maps to a single exposed tool:
 | `prompt` | `string` | yes | The prompt to send to Claude Code |
 | `timeout_ms` | `integer` | no | Timeout in ms (default: 300 000 / 5 minutes) |
 
-Any additional `tools/call` arguments are ignored (for example `model` or `model_reasoning_effort`).
+Any additional `tools/call` arguments are ignored (for example `model`, `effort`, or `config`).
 
-Claude calls run with `--output-format json`; the server parses the JSON payload and returns the assistant `result` text (or an MCP error if `is_error=true`).
+Claude is pinned to `claude-opus-4-8` at effort `xhigh`; callers cannot change the model or effort per call. Calls run with `--output-format json`; the server parses the JSON payload and returns the assistant `result` text (or an MCP error if `is_error=true`).
 
 ### `gemini` parameters
 
 | Parameter | Type | Required | Description |
 |-----------|------|----------|-------------|
-| `prompt` | `string` | yes | The prompt to send to Gemini CLI |
-| `sandbox` | `boolean` | no | Run in sandbox mode (`-s` flag, default: false) |
+| `prompt` | `string` | yes | The prompt to send to the Antigravity CLI (`agy`) |
 | `timeout_ms` | `integer` | no | Timeout in ms (default: 300 000 / 5 minutes) |
 
 Any additional `tools/call` arguments are ignored (for example `model` or `model_reasoning_effort`).
 
+`agy` always runs with `--sandbox` (terminal restrictions enabled); there is no per-call sandbox toggle.
+
 ### `codex` (pass-through)
 
 The codex provider passes through to Codex's native MCP server (`codex mcp-server`)
@@ -91,17 +89,18 @@ or Gemini during bridge calls.
 Hardcoded defaults: `sandbox_mode=read-only`, `approval_policy=never`,
 `features.multi_agent=false`.
 
-Startup flags set server-wide defaults for the native Codex MCP server. Per-call overrides still work through the native `codex` tool schema, for example:
+Startup flags (`--model`, `--model_reasoning_effort`) set the model and effort for the native Codex MCP server. Per-call `model` and `config` arguments are stripped from `tools/call` before they reach Codex, so a client cannot override the pinned model/effort (or the read-only/never sandbox config) for a single call. For example, this request:
 
 ```json
 {
   "prompt": "Review this diff",
-  "config": {
-    "model_reasoning_effort": "medium"
-  }
+  "model": "gpt-5.5-codex",
+  "config": { "model_reasoning_effort": "medium" }
 }
 ```
 
+is forwarded to Codex as `{ "prompt": "Review this diff" }`. Change the model or effort at server startup instead.
+
 ## Integration with Claude Code
 
 Add entries to your project's `.mcp.json` (requires `npm i -g mcp-agents`):
@@ -121,19 +120,6 @@ Add entries to your project's `.mcp.json` (requires `npm i -g mcp-agents`):
 }
 ```
 
-Optional Gemini sandbox mode in `.mcp.json`:
-
-```json
-{
-  "mcpServers": {
-    "gemini": {
-      "command": "mcp-agents",
-      "args": ["--provider", "gemini", "--sandbox", "true"]
-    }
-  }
-}
-```
-
 Override codex defaults at server startup:
 
 ```json
@@ -147,7 +133,7 @@ Override codex defaults at server startup:
 }
 ```
 
-The startup default can still be overridden for a single Codex tool call by passing `config.model_reasoning_effort` to the native `codex` tool.
+The model and effort are fixed at server startup. Per-call `model` and `config` arguments sent to the native `codex` tool are stripped before reaching Codex, so they cannot override the startup defaults.
 
 Because the bridge runs in an isolated Codex home, inherited MCP servers from your normal
 `~/.codex/config.toml` are intentionally unavailable inside bridged Codex sessions.
@@ -188,15 +174,6 @@ args = ["--provider", "gemini"]
 tool_timeout_sec = 300
 ```
 
-Optional Gemini sandbox mode in Codex config:
-
-```toml
-[mcp_servers.gemini]
-command = "mcp-agents"
-args = ["--provider", "gemini", "--sandbox", "true"]
-tool_timeout_sec = 300
-```
-
 Then in a Codex session you can call the `claude_code` or `gemini` tools, which shell out to the respective CLIs.
 
 ## Development

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-agents",
-  "version": "0.6.6",
+  "version": "0.8.0",
   "description": "MCP server that wraps AI CLI tools (Claude Code, Gemini CLI, Codex CLI) for use by any MCP client",
   "type": "module",
   "bin": {
@@ -27,7 +27,12 @@
   },
   "author": "Thomas Witt",
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0"
+    "@modelcontextprotocol/sdk": "^1.29.0"
+  },
+  "overrides": {
+    "fast-uri": "^3.1.2",
+    "hono": "^4.12.22",
+    "ip-address": "^10.2.0"
   },
   "engines": {
     "node": ">=18"

package/server.js

@@ -29,6 +29,11 @@ const VERSION = JSON.parse(
 const DEFAULT_TIMEOUT_MS = 300_000;
 const DEFAULT_CODEX_MODEL = "gpt-5.5";
 const DEFAULT_CODEX_MODEL_REASONING_EFFORT = "xhigh";
+const DEFAULT_CLAUDE_MODEL = "claude-opus-4-8";
+const DEFAULT_CLAUDE_EFFORT = "xhigh";
+// tools/call argument keys stripped from the codex pass-through so callers
+// cannot override the pinned model/effort (or the read-only/never config).
+const CODEX_STRIPPED_TOOL_ARGS = ["model", "config"];
 const MAX_BUFFER_BYTES = 10 * 1024 * 1024;
 const CLAUDE_EMPTY_OUTPUT_MAX_ATTEMPTS = 2;
 const SIGNAL_CODES = { SIGHUP: 1, SIGINT: 2, SIGTERM: 15 };
@@ -44,18 +49,28 @@ const CLI_BACKENDS = {
     command: "claude",
     toolName: "claude_code",
     description:
-      "Run Claude Code CLI with a prompt (via stdin). Supports prompt + optional timeout_ms only; other arguments are ignored.",
+      `Run Claude Code CLI with a prompt (via stdin), pinned to ${DEFAULT_CLAUDE_MODEL} at effort ${DEFAULT_CLAUDE_EFFORT}. Supports prompt + optional timeout_ms only; other arguments (model/effort/config) are ignored.`,
     stdinPrompt: true,
-    buildArgs: () => ["--no-session-persistence", "-p", "--output-format", "json"],
+    buildArgs: () => [
+      "--model",
+      DEFAULT_CLAUDE_MODEL,
+      "--effort",
+      DEFAULT_CLAUDE_EFFORT,
+      "--no-session-persistence",
+      "-p",
+      "--output-format",
+      "json",
+    ],
     extraProperties: {},
   },
   gemini: {
-    command: "gemini",
+    command: "agy",
     toolName: "gemini",
     description:
-      "Run Gemini CLI with a prompt. Always runs in sandbox mode with --approval-mode=plan.",
+      "Run the Antigravity CLI (`agy`, Google's Gemini-backed agent) with a prompt. Always runs in --sandbox mode (terminal restrictions enabled).",
     stdinPrompt: false,
-    buildArgs: (prompt) => ["-s", "--approval-mode=plan", "-p", prompt],
+    isolateCwd: true,
+    buildArgs: (prompt) => ["--sandbox", "-p", prompt],
     extraProperties: {},
   },
   codex: {
@@ -209,6 +224,7 @@ function parseArgs() {
  * @param {{
  *   timeoutMs?: number,
  *   stdinData?: string,
+ *   cwd?: string,
  *   onSpawn?: (childInfo: { pid?: number, killGroup: () => void }) => void,
  *   onSettled?: (pid?: number) => void,
  * }} [opts]
@@ -217,6 +233,7 @@ function parseArgs() {
 function runCli(command, args, opts = {}) {
   const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const stdinData = opts.stdinData;
+  const cwd = opts.cwd;
   const onSpawn = opts.onSpawn;
   const onSettled = opts.onSettled;
   const startedAt = Date.now();
@@ -229,6 +246,7 @@ function runCli(command, args, opts = {}) {
     let settled = false;
 
     const child = spawn(command, args, {
+      cwd,
       detached: true,
       stdio: ["pipe", "pipe", "pipe"],
       env: { ...process.env, NO_COLOR: "1" },
@@ -307,6 +325,18 @@ function runCli(command, args, opts = {}) {
   });
 }
 
+/**
+ * Create a fresh, empty working directory under the OS temp dir for an
+ * agentic CLI. Agentic CLIs (e.g. agy/Antigravity) treat their cwd as a
+ * workspace and write project files into it; running them here keeps them
+ * from mutating whatever directory the MCP server was started in.
+ * @param {string} provider
+ * @returns {string}
+ */
+function createIsolatedWorkdir(provider) {
+  return mkdtempSync(join(tmpdir(), `mcp-agents-${provider}-`));
+}
+
 /**
  * Resolve the source Codex home used by the parent process.
  * @returns {string}
@@ -367,7 +397,45 @@ function createIsolatedCodexHome({ model, modelReasoningEffort }) {
 }
 
 /**
- * Spawn codex mcp-server as a pass-through, piping stdio directly.
+ * Filter a single newline-delimited JSON-RPC message on its way to the codex
+ * pass-through. Strips per-call model/config overrides from `tools/call` so the
+ * client cannot escape the pinned model/effort (or the read-only/never config).
+ * Non-`tools/call` and unparseable lines are returned byte-for-byte unchanged so
+ * the MCP framing is preserved.
+ * @param {string} line
+ * @returns {string}
+ */
+function filterCodexToolCall(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return line;
+
+  let msg;
+  try {
+    msg = JSON.parse(trimmed);
+  } catch {
+    return line; // not JSON (e.g. partial/keepalive) — pass through untouched
+  }
+
+  const args =
+    msg && typeof msg === "object" && msg.method === "tools/call"
+      ? msg.params?.arguments
+      : null;
+  if (!args || typeof args !== "object") return line;
+
+  const stripped = CODEX_STRIPPED_TOOL_ARGS.filter((key) => key in args);
+  if (stripped.length === 0) return line;
+
+  for (const key of stripped) delete args[key];
+  logErr(
+    `[mcp-agents] codex passthrough: ignoring per-call overrides: ${stripped.join(", ")}`,
+  );
+  return JSON.stringify(msg);
+}
+
+/**
+ * Spawn codex mcp-server as a pass-through. stdout/stderr flow straight back to
+ * the client, but the client's stdin is intercepted line-by-line so per-call
+ * model/config overrides are stripped before reaching codex.
  * @param {{ model?: string, modelReasoningEffort?: string }} opts
  */
 function runCodexPassthrough({ model, modelReasoningEffort }) {
@@ -409,13 +477,34 @@ function runCodexPassthrough({ model, modelReasoningEffort }) {
 
   const child = spawn("codex", args, {
     env: { ...process.env, CODEX_HOME: isolatedCodexHome },
-    stdio: ["inherit", "inherit", "pipe"],
+    // stdin is piped (not inherited) so we can strip per-call overrides;
+    // stdout stays inherited so codex responses reach the client untouched.
+    stdio: ["pipe", "inherit", "pipe"],
   });
 
   child.stderr.on("data", (chunk) => {
     logErr(`[codex] ${chunk.toString().trimEnd()}`);
   });
 
+  // Pump client stdin -> codex stdin, splitting on newlines (MCP stdio framing)
+  // so each JSON-RPC message can be filtered before forwarding.
+  child.stdin.on("error", () => {}); // ignore EPIPE if codex exits early
+  let stdinBuf = "";
+  process.stdin.on("data", (chunk) => {
+    stdinBuf += chunk.toString("utf8");
+    let nl;
+    while ((nl = stdinBuf.indexOf("\n")) !== -1) {
+      const line = stdinBuf.slice(0, nl);
+      stdinBuf = stdinBuf.slice(nl + 1);
+      child.stdin.write(`${filterCodexToolCall(line)}\n`);
+    }
+  });
+  process.stdin.on("error", () => {});
+  process.stdin.on("end", () => {
+    if (stdinBuf.length > 0) child.stdin.write(filterCodexToolCall(stdinBuf));
+    child.stdin.end();
+  });
+
   for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
     process.once(sig, () => {
       child.kill(sig);
@@ -628,10 +717,12 @@ async function main() {
     const cliArgs = backend.stdinPrompt
       ? backend.buildArgs(extraOpts)
       : backend.buildArgs(prompt, extraOpts);
+    let isolatedWorkdir;
     const buildCliOpts = (attemptTimeoutMs) => (
       {
         timeoutMs: attemptTimeoutMs,
         ...(backend.stdinPrompt ? { stdinData: prompt } : {}),
+        ...(isolatedWorkdir ? { cwd: isolatedWorkdir } : {}),
         onSpawn: ({ pid, killGroup }) => {
           if (!pid) return;
           activeChildren.set(pid, killGroup);
@@ -653,6 +744,24 @@ async function main() {
         };
       }
 
+      if (backend.isolateCwd) {
+        try {
+          isolatedWorkdir = createIsolatedWorkdir(providerName);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          logErr(`[mcp-agents] failed to create isolated workdir: ${msg}`);
+          return {
+            content: [
+              {
+                type: "text",
+                text: `Failed to prepare isolated working directory: ${msg}`,
+              },
+            ],
+            isError: true,
+          };
+        }
+      }
+
       const startedAt = Date.now();
       const maxAttempts = providerName === "claude"
         ? CLAUDE_EMPTY_OUTPUT_MAX_ATTEMPTS
@@ -738,6 +847,14 @@ async function main() {
         isError: true,
       };
     } finally {
+      if (isolatedWorkdir) {
+        try {
+          rmSync(isolatedWorkdir, { recursive: true, force: true });
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          logErr(`[mcp-agents] failed to clean isolated workdir: ${msg}`);
+        }
+      }
       activeRequests -= 1;
       maybeFinalizeShutdown();
     }