Claude Code × Antigravity + Codex + Copilot + Cursor + Grok + Kimi — MCP Bridge

Drive six external coding CLIs — Google's Antigravity (Gemini 3.6 Flash), OpenAI Codex, the GitHub Copilot CLI, Cursor, and the two experimental newcomers Grok Build and Kimi Code — as sub-agents inside Claude Code. Text answers, image generation, real repo work, and parallel swarms, on quota you already pay for.

One MCP server, six backends — four verified, two experimental. It exposes Google Antigravity, OpenAI Codex, the GitHub Copilot CLI, Cursor, and now xAI's Grok Build and Moonshot's Kimi Code to Claude Code as clean MCP tools so you can delegate work to a different model family mid-task — without leaving your terminal, and on the subscriptions you already have. Each backend is independent: install one, or all six.

• 🛰️ Antigravity (agy, Gemini 3.6 Flash High). Fast, cheap tool-calling — and the only backend with an image model. Its headless print mode (agy -p) historically had a stdout bug: it wrote the answer to the controlling terminal instead of its stdout, so anything capturing stdout got nothing (and, under a TUI, agy's text leaked into the host's prompt). agy 1.0.15 fixed this on Windows — -p now writes the clean answer to stdout — so the bridge prefers stdout and falls back to reading agy's own transcript files only when stdout is empty (older agy, non-Windows, or --sandbox runs). It still detaches agy from the terminal so older versions can't leak.
• 🤖 Codex (codex exec, OpenAI). A strong reasoner for real code/repo work. It writes its final message straight to a file the bridge asks for (no scraping), supports model selection, and has a real, enforced sandbox.
• 🐙 Copilot (copilot -p, GitHub). GitHub's agentic coder. Stdout-native like Codex (-s prints just the answer), with model selection (--model), a best-effort tool/path permission knob, and a deterministic resume mechanism (the bridge sets each session's UUID itself).
• ✳️ Cursor (cursor-agent -p, Cursor). Cursor's agentic coder, with the widest model menu — GPT, Claude, Grok, and Composer via --model (validated against cursor-agent models). Stdout-native like Codex/Copilot (--output-format text prints just the answer), an agent-enforced sandbox (read-only via --mode ask), and a deterministic resume mechanism (the bridge mints each chat's id itself via create-chat). No image model.
• 🧪 Grok Build (grok -p, xAI) — EXPERIMENTAL. xAI's terminal coding agent, and the only backend besides Codex with a real OS sandbox — though only on Linux/macOS. Stdout-native (--output-format json returns the answer and the session id), with -r resume, streaming-json for watch mode, and full swarm support. Never verified end-to-end — see below.
• 🌙 Kimi Code (kimi -p, Moonshot) — EXPERIMENTAL. Moonshot's terminal coding agent (Kimi K2 family). Stdout-native (--output-format text), resumes per working directory (-c). No sandbox — print mode auto-executes every tool, like Antigravity. Never verified end-to-end — see below.

They share the same niceties: a *_continue to resume a thread, a live "watch" window to see the agent work, a unified agent_swarm that runs many tasks in parallel across all backends at once, and *_status diagnostics that spend no quota. (Kimi is the one exception: no watch or swarm support yet — see Experimental backends.)

[!IMPORTANT] Grok Build and Kimi Code ship unverified, and I need your help. I don't have a Grok or Kimi subscription, so no authenticated round-trip has ever run against either backend. Everything up to each CLI's auth wall is verified live — flag surface, error shapes, model list, on-disk layout — but everything behind it comes from vendor docs and could be wrong. If you have either subscription, one issue from the verification template is the single most useful contribution you can make. Even confirming one checkbox helps. Full detail →

[!WARNING] This runs unsandboxed code with your privileges. agy -p auto-executes its tools (read/write files, run shell commands, reach the network) with no usable approval gate — its --sandbox blocks only shell commands, leaving file writes and network egress wide open. codex exec also runs autonomously, but its sandbox flag (default read-only) is a real, enforced boundary. copilot -p runs headless with --allow-all-tools; its sandbox maps to best-effort tool/path permissions (read-only denies the local write/shell tools) — safer than agy, but not an OS sandbox like Codex's. cursor-agent -p runs headless with --trust (and --force for writes); its sandbox is agent-enforced (read-only = --mode ask, which makes the write/shell tools unavailable) — best-effort like Copilot, not an OS sandbox. grok -p runs headless with --always-approve; its sandbox maps to a real OS profile (Landlock/Seatbelt) — but only on Linux and macOS, and on Windows grok silently continues without enforcement, so read-only there rests on an agent-enforced tool allowlist. kimi -p has no sandbox at all and auto-executes every tool, like agy. In all six cases the workspace argument is a starting context, not a security boundary. Only use these with trusted prompts on trusted content; for real isolation, run the bridge inside a container or VM. Full details →

Why you'd want this

The backends at a glance

The bridge normalizes every CLI into the same shape, but they differ where it matters. Pick per task. The four verified backends first; the two experimental ones follow.

🧪 The two experimental backends — and how you can help

Grok Build and Kimi Code are wired in exactly like the other four, with one honest difference: no authenticated round-trip has ever run against either. I don't have a SuperGrok / X Premium+ subscription or a Kimi plan, so I cannot prove they answer. They ship anyway because a bridge nobody can install is a bridge nobody can verify — and because the parts that usually rot are already pinned down.

What is verified live (each CLI installed, run, and observed — just never logged in):

What is NOT verified — everything behind the auth wall:

• the happy-path answer itself: Grok's json envelope (text / sessionId) and Kimi's stdout answer;
• that -r / -c really restore context;
• Grok's streaming-json event stream, which watch mode renders;
• whether Grok's sandbox profiles behave as documented (and note: auth is checked before --sandbox and -m are validated, so a bad value can't even be observed while logged out — which is why the bridge validates both client-side).

[!NOTE] Deliberately scoped out for Kimi: agent_swarm and watch support. Both would depend on Kimi's stream-json envelope, and adding an unverified dependency on top of an unverified backend is how you get two bugs that mask each other. Grok gets both, because its stream format is documented in detail and its error events were observed live.

How to help

If you have either subscription, please open a verification issue. The template is a checklist — tick only what you actually saw. The first box ("a fresh ask returned a real answer") is worth more than all the others combined, and takes about a minute:

# 1. Does the setup look right? (spends no quota)
#    -> call grok_status / kimi_status from Claude Code
# 2. Does it answer?
#    -> call grok_ask("say hi") / kimi_ask("say hi")
# 3. If it fails, does the raw CLI fail the same way?
grok -p "say hi" --output-format json
kimi -p "say hi" --output-format text

That last command is the one I can't run from here, and it's what separates "the bridge is wrong" from "the CLI changed". Partial reports are welcome; so is a plain "it didn't work, here's the error".

How it works

All six backends run headless and one-shot per call; the bridge's job is to get a clean answer out of each and hand it to Claude Code as a plain string.

flowchart LR
    A([Claude Code]) -- "MCP tool call" --> B["bridge<br/>(server.py)"]
    B -- "antigravity_*" --> C[agy -p]
    B -- "codex_*" --> D[codex exec]
    B -- "copilot_*" --> E[copilot -p]
    B -- "cursor_*" --> F[cursor-agent -p]
    C -- "json / stream-json (1.1.8+)<br/>else stdout or transcript.jsonl / .db" --> B
    D -- "output-last-message file" --> B
    E -- "stdout (-s silent)" --> B
    F -- "stdout (--output-format text)" --> B
    B -- "plain text" --> A

Antigravity. On agy 1.1.8+ the bridge asks for structured output and reads a contractual field instead of guessing: plain calls use --output-format json and return its response, while watch mode uses --output-format stream-json and rebuilds the answer from the stream's terminal result event (the same shape the Cursor bridge already used). Both also carry a conversation_id, which the bridge records so antigravity_continue pins exactly the thread it last ran in that workspace.

Older agy has no such flag, so the original path stays: on 1.0.15+ (Windows) agy -p writes its clean answer to stdout and the bridge returns that; on older agy — or non-Windows, or a --sandbox run — stdout is empty and the bridge falls back to agy's own transcript at:

~/.gemini/antigravity-cli/brain/<conv-id>/.system_generated/logs/transcript.jsonl

For that fallback it locates the conversation via cache/last_conversations.json (falling back to the newest brain/ directory touched since launch), streams the transcript, and returns the final source=MODEL, status=DONE, type=PLANNER_RESPONSE entry — the answer, minus the intermediate tool-calling steps (or the SQLite .db agy dual-writes, when no JSONL exists). This fallback still runs on 1.1.8+ whenever a run yields no result, so nothing depends on the structured path alone.

Codex. codex exec is well-behaved: the bridge passes -o/--output-last-message <file> and codex writes its final message straight there — no scraping. Continue works by capturing the session id from codex's own rollout files (~/.codex/sessions/.../rollout-*.jsonl) and resuming with codex exec resume <id>, falling back to the newest on-disk session for that cwd after a server restart.

Copilot. copilot -p "<prompt>" -s runs a prompt non-interactively and prints the clean final answer to stdout — the bridge reads it there, no scraping. It runs headless with --allow-all-tools --no-ask-user --no-auto-update (so it never blocks on a prompt), and disables copilot's flaky builtin GitHub-API MCP by default for predictable latency (COPILOT_GITHUB_MCP=1 re-enables it). Continue is deterministic: copilot's --session-id <uuid> both sets a new session's id and resumes an existing one, so the bridge generates the UUID itself, pins it to the workspace, and resumes that exact session — falling back after a restart to the newest on-disk session (~/.copilot/session-state/<id>/workspace.yaml) whose recorded cwd matches.

Cursor. cursor-agent -p --output-format text --trust "<prompt>" runs a prompt non-interactively and writes the clean final answer straight to stdout — the bridge reads it there, no scraping (--trust trusts the workspace so it never blocks on a prompt). Continue is deterministic and race-free: cursor-agent create-chat mints a fresh chat and prints its id, so the bridge mints the id itself, pins it to the workspace, and resumes that exact chat with -p --resume <chatId> — no rollout-scraping. After a restart it falls back to the newest on-disk chat under ~/.cursor/chats/<md5(workspace)>/<chat-id>/ whose meta.json cwd matches (the chat-dir hash is itself md5 of the workspace path).

Set up in 60 seconds

Prerequisites — install whichever backend(s) you want, and sign in once each:

• Antigravity: install agy and sign in to Antigravity once (via the IDE or agy -i).
• Codex: install codex and run codex login once (ChatGPT account or API key).
• Copilot: install copilot (npm i -g @github/copilot, or winget install GitHub.Copilot) and run copilot then /login once (or set a COPILOT_GITHUB_TOKEN/GH_TOKEN env var).
• Cursor: install cursor-agent (curl https://cursor.com/install -fsSL | bash) and run cursor-agent login once (or set a CURSOR_API_KEY env var).

You don't need all six — the tools for a missing CLI simply report "not found" via their *_status tool.

Recommended — no clone, you control updates

With uv installed, register the bridge straight from PyPI under mcpServers in ~/.claude.json — no path to hardcode, no git pull to remember:

"agent-intern": {
  "command": "uvx",
  "args": ["agent-intern"]
}

uvx pins to the version it first caches and does not auto-upgrade, so you never run an update you didn't choose — important, since the bridge runs unsandboxed code: a surprise (or compromised) release can't execute until you opt in. When the startup check warns that a newer release is out, upgrade deliberately and restart Claude Code:

uvx agent-intern@latest      # fetch + run the newest release (refreshes uv's cache)

[!TIP] Prefer hands-off auto-updates? Put "args": ["agent-intern@latest"] in the config instead — every launch runs the newest release. Convenient, but it pulls new code without asking each time.

From source

Clone it instead if you want to hack on the bridge or pin a local copy:

git clone https://github.com/SinanTufekci/agent-intern.git
cd agent-intern
pip install fastmcp
python test_smoke.py        # 4 real round-trips (ask, continue, image, swarm) — prints four PASS lines

[!NOTE] The smoke test costs a tiny bit of quota and takes ~30–60 s. It exercises the Antigravity path.

Then point Claude Code at the absolute path to server.py under mcpServers in ~/.claude.json:

"agent-intern": {
  "command": "python",
  "args": ["C:\\path\\to\\server.py"]
}

"agent-intern": {
  "command": "python3",
  "args": ["/path/to/server.py"]
}

Restart Claude Code. Twenty-one tools appear, each prefixed mcp__agent-intern__:

• Antigravity (5): antigravity_ask, antigravity_continue, antigravity_image, antigravity_image_swarm, antigravity_status
• Codex (3): codex_ask, codex_continue, codex_status
• Copilot (3): copilot_ask, copilot_continue, copilot_status
• Cursor (3): cursor_ask, cursor_continue, cursor_status
• Grok (3, experimental): grok_ask, grok_continue, grok_status
• Kimi (3, experimental): kimi_ask, kimi_continue, kimi_status
• Shared (1): agent_swarm — fans a list of tasks out across five backends in one run (everything but Kimi)

The single-prompt tools — Antigravity, Codex, Copilot, Cursor, and Grok — take a watch=true flag for the live browser view (Watch mode). Kimi has no watch mode yet.

[!NOTE] Your client learns how to use the bridge on its own. The server ships MCP instructions — a short routing guide (when to reach for each tool, which backend to pick, and to pass workspace so the sub-agent has repo context) that a client like Claude Code injects into the model's context on connect, as an "MCP Server Instructions" block. So the host model knows how and when to drive these tools without you explaining them — you can just ask for the result.

"Use antigravity_ask to summarize the README of this repo in three bullets." → Claude routes the prompt through the bridge, agy reads the file under the workspace root, and the answer comes back as a plain string. Swap in codex_ask, copilot_ask, or cursor_ask to have GPT, Copilot, or Cursor do the same.

Tools

🛰️ Antigravity

🤖 Codex

🐙 Copilot

✳️ Cursor

🧪 Grok Build (experimental — unverified)

🌙 Kimi Code (experimental — unverified)

🐝 Shared

workspace defaults to the MCP server's current working directory. Point it at a real project dir for context-aware answers — every backend gives the model access to files under that root (Codex, Copilot, and Cursor honoring their sandbox).

antigravity_image forces agy to save to an explicit absolute path — without one, agy falls back to its own scratch dir (~/.gemini/antigravity-cli/scratch/). It then corrects the file extension to match the real bytes: agy's image model picks the format itself (JPEG for photo-like images, PNG for flat graphics), so a requested out.png may come back as out.jpg. The returned path always reflects the true format.

🤖 Codex bridge — the well-behaved sibling

codex exec writes its final message to a file the bridge asks for via -o/--output-last-message, so the answer comes back without any scraping (where agy needed a transcript workaround before 1.0.15 fixed its stdout). Three things make Codex worth reaching for over Antigravity:

• Real sandbox. sandbox accepts read-only (default — reads and answers, writes nothing), workspace-write (may edit files under the workspace), or danger-full-access (no sandbox — avoid). Unlike agy's no-op --sandbox, codex's -s actually enforces this. codex exec has no interactive approval gate, so this flag is your safety boundary — opt into write access deliberately.
• Model selection works. model maps to codex's -m. (agy's --model works in print mode too as of 1.0.16; every backend now exposes the same model knob, except Kimi, which has no list to validate against.)
• Stronger reasoning. Codex is a coding agent, not an image model — there's no codex_image. Its strength is reasoning and real code/repo work; hand it the jobs that need a heavier model.

Auth. Uses your existing Codex login (ChatGPT account or API key). Run codex login once; check with codex_status. No new keys for the bridge to manage.

[!WARNING] codex exec runs the model as an autonomous agent with no interactive approval gate. The sandbox flag (default read-only) is the real boundary, but workspace-write / danger-full-access let it modify files — and a swarm runs N agents at once. Only use it with trusted prompts on trusted content.

🐙 Copilot bridge — GitHub's agentic coder

The GitHub Copilot CLI (copilot, from @github/copilot) is stdout-native like Codex: copilot -p "<prompt>" -s runs a prompt non-interactively and prints just the final answer to stdout, so the bridge reads it there — no scraping. What makes it worth reaching for:

• Model selection. model maps to copilot's --model; auto lets Copilot pick. Unlike the agy and cursor tools, the bridge can't validate this — copilot exposes no non-interactive model list — and the working set is account-dependent: on a Copilot Pro account here, auto worked while gpt-5.3-codex, claude-sonnet-4.6, and even GitHub's own --help example gpt-5.4 were all rejected as "not available". So omit model (account default) or pass auto unless you know your plan's ids; an unavailable one errors immediately with copilot's message, costing a call.
• Deterministic, race-free continue. copilot's --session-id <uuid> both sets a new session's id and resumes an existing one, so the bridge generates the UUID itself and pins it to the workspace — no rollout-scraping. After a restart it falls back to the newest on-disk session (~/.copilot/session-state/<id>/workspace.yaml) whose recorded cwd matches.
• Fast by default. Runs with --allow-all-tools --no-ask-user --no-auto-update, and disables copilot's builtin GitHub-API MCP (--disable-builtin-mcps) because its flaky HTTP connect can stall a call up to ~60 s. Set COPILOT_GITHUB_MCP=1 to keep it (for Copilot's issue/PR/repo tools).

Sandbox is best-effort, not enforced. Unlike Codex's OS sandbox, copilot's boundary is tool/path permissions. The sandbox knob maps to copilot flags for a uniform cross-backend field:

• read-only (default) — auto-approves tools so it runs headless, then denies the local write and shell tools (--deny-tool). Best-effort: it is not an OS sandbox, and network/MCP tools can still act. For a hard read-only boundary, use codex_ask instead.
• workspace-write — writes allowed, but file access stays confined to the workspace (no --allow-all-paths).
• danger-full-access — --allow-all (tools + all paths + all URLs). Avoid.

Auth. Uses your existing Copilot login — run copilot then /login once (stored in the OS credential store), or set COPILOT_GITHUB_TOKEN/GH_TOKEN/GITHUB_TOKEN for headless use. Check with copilot_status. If copilot isn't on PATH (the winget install can land off a stale PATH), set COPILOT_BIN to its full path — e.g. %LOCALAPPDATA%\Microsoft\WinGet\Packages\GitHub.Copilot_*\copilot.exe.

[!WARNING] copilot -p runs the model as an autonomous agent with --allow-all-tools (required to run headless). Its sandbox is best-effort tool/path permissions, not an OS sandbox — safer than agy, weaker than Codex's read-only. Only use it with trusted prompts on trusted content.

✳️ Cursor bridge — the widest model menu

Cursor's agent CLI (cursor-agent, from cursor.com/cli) is stdout-native like Codex and Copilot: cursor-agent -p --output-format text --trust "<prompt>" runs a prompt non-interactively and writes just the final answer to stdout, so the bridge reads it there — no scraping (--trust trusts the workspace so it won't block on a prompt). What makes it worth reaching for:

• The widest model menu. model maps to cursor's --model (e.g. auto, gpt-5.2, claude-opus-4-8-high, composer-2.5, cursor-grok-4.5-high) — GPT, Claude, Grok, and Composer in one place, ~190 ids at the time of writing. cursor bakes the effort and speed axes into the id (…-low / -high / -xhigh / -max, each with a -fast twin), and also accepts a bracket form on the family base, e.g. claude-opus-4-8[context=1m,effort=high]. The bridge validates against cursor-agent models and rejects a typo up front (like agy), accepting either an exact id or a family base. Omit model to use your Cursor account default. cursor reshuffles this list often — run cursor-agent models (or cursor_status) rather than trusting an example here.
• Deterministic, race-free continue. cursor-agent create-chat mints a fresh chat and prints its id, and -p --resume <chatId> resumes that exact chat — so the bridge mints the id itself, pins it to the workspace, and resumes deterministically (no rollout-scraping, same idea as Copilot's self-set session id). After a restart it falls back to the newest on-disk chat under ~/.cursor/chats/<md5(workspace)>/<chat-id>/ whose meta.json cwd matches (the chat-dir hash is itself md5 of the workspace path).

Sandbox is agent-enforced, not an OS sandbox. Like Copilot, cursor's boundary is which tools the agent can reach, not an OS jail. The sandbox knob maps to cursor's mode/force flags for a uniform cross-backend field:

• read-only (default) — --mode ask: the write and shell tools are unavailable, so cursor analyzes and answers but makes no edits (verified: it refuses to write files). Agent-enforced and best-effort — it is not an OS sandbox. For a hard read-only boundary, use codex_ask instead.
• workspace-write — --force: edits and commands allowed, file access rooted at --workspace.
• danger-full-access — --force --sandbox disabled (OS sandbox off). Avoid.

(Cursor also exposes an OS-level --sandbox enabled/disabled; the bridge drives the uniform field via mode/force.)

Auth. Uses your existing Cursor login — run cursor-agent login once (OS credential store), or set CURSOR_API_KEY for headless use. Check with cursor_status. If cursor-agent isn't reliably on PATH (the installer drops a cursor-agent.CMD shim a bare name can't launch on Windows), set CURSOR_BIN to its full path — mirrors the AGY_BIN/CODEX_BIN/COPILOT_BIN overrides.

[!WARNING] cursor-agent -p runs the model as an autonomous agent with --trust (and --force when writes are allowed). Its sandbox is agent-enforced (read-only makes the write/shell tools unavailable), not an OS sandbox — safer than agy, weaker than Codex's read-only. Only use it with trusted prompts on trusted content.

🧪 Grok Build bridge — a real sandbox, on two of three platforms

[!WARNING] EXPERIMENTAL — never verified end-to-end. Everything below the "Auth" line is confirmed against a live grok 1.0.3; the answer path is not. See Experimental backends, and please report what you find.

xAI's Grok Build (grok, installed with curl -fsSL https://x.ai/cli/install.sh | bash, or irm https://x.ai/cli/install.ps1 | iex on Windows) is stdout-native like Codex/Copilot/Cursor: grok -p "<prompt>" --output-format json runs a prompt non-interactively and writes a single JSON result object to stdout. What makes it interesting:

• It's open source. xai-org/grok-build publishes the actual CLI source, so this bridge's flag surface was read off the real clap definitions rather than inferred from docs — then confirmed against grok --help. That's a much stronger footing than a docs-derived bridge, and it caught a live discrepancy: xAI's own headless docs use -m grok-build in their examples, but the real default on 1.0.3 is grok-4.5.
• The answer carries its own session id. --output-format json returns {"text": …, "sessionId": …, "usage": …}, so the bridge pins that id and