Skip to main content
Glama
eneskavas

agy-mcp

by eneskavas
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript

agy-mcp

An MCP server that lets Claude Code drive agy (Google's Antigravity CLI) as a tool — for a second opinion, or to actually execute a plan.

Why

Claude Code writes the plan; agy (a separate model/agent) either reviews it (agy_ask) or executes it (agy_execute) in its own isolated git worktree. Session state (which agy conversation maps to which of our sessions) is kept in a small SQLite database, so both tools support multi-turn conversations.

Related MCP server: agy MCP Server

Tools

  • agy_ask(prompt, session_id?, conversation_id?, workspace?) — Read-only. Runs agy in --mode plan (it cannot edit files). Pass session_id to continue a conversation this server started, or conversation_id to adopt an existing agy CLI conversation (e.g. one you started in your own terminal — this does not work for Antigravity IDE conversations, which use a separate store).

  • agy_execute(plan, session_id?, conversation_id?, workspace?) — Hands agy full write access (--dangerously-skip-permissions) inside a fresh git worktree, never the real working tree. Changes are auto-committed to a branch (agy/<short-id>) so they survive even if the worktree is later removed — unless the pre-commit secret scan blocks it (see below). Disabled unless AGY_MCP_ALLOW_EXECUTE=1 is set in the server's environment.

  • agy_list_sessions() — Lists all known sessions with status, workspace, and worktree path.

  • agy_close_session(session_id, remove_worktree?) — Closes a session. By default the worktree/branch are left on disk for manual review; remove_worktree: true deletes the worktree (irreversible for anything not committed).

Setup

npm install
npm run build

Register it with Claude Code (e.g. in ~/.claude.json, alongside your other mcpServers):

"agy-mcp": {
  "type": "stdio",
  "command": "node",
  "args": ["/absolute/path/to/agy_mcp/dist/index.js"],
  "env": { "AGY_MCP_ALLOW_EXECUTE": "1" }
}

Omit AGY_MCP_ALLOW_EXECUTE to keep agy_execute disabled and only allow agy_ask (read-only).

Safety notes

agy_execute isolates the git working tree (via a worktree) but does not sandbox the filesystem or network — see PILOT_TEST_REPORT.md for the audit that drove the current mitigations:

  • child process env is allowlisted (PATH, HOME, TMPDIR, LANG, LC_ALL only — no inherited secrets)

  • a pre-commit scan blocks commits containing likely secrets (AWS/GitHub/Slack key shapes, private key headers, .env-style filenames) and leaves the worktree untouched for manual review

  • new-conversation creation is serialized server-wide to avoid a conversation-id race

  • ask and execute sessions can't be resumed across each other

  • a timed-out agy process (and its subprocess tree) is killed, not left orphaned

None of this replaces running agy_execute in a disposable, credential-free, egress-restricted environment for anything beyond low-stakes local use — see the report's "Conditional pilot controls" for the full checklist.

Requirements

  • Node.js ≥ 22.5 (uses the built-in node:sqlite)

  • The agy CLI on PATH (override with AGY_BIN), already authenticated

  • Git (for agy_execute's worktree isolation)

Available Tools

4 tools
agy_askA

Ask agy (Antigravity CLI) a question or for a second opinion. Read-only: agy runs in --mode plan and cannot edit files. Pass session_id to continue a prior conversation with full context; omit it to start a new one. Alternatively pass conversation_id to adopt an existing agy CLI conversation (e.g. one you started in your own terminal) that this server didn't create — note this only works for agy CLI conversations, not Antigravity IDE ones.

ParametersJSON Schema
NameRequiredDescriptionDefault
promptYesThe question or prompt to send to agy
workspaceNoDirectory to run agy in when starting a new session (defaults to cwd)
session_idNoExisting session id to continue, omit to start a new session
conversation_idNoAdopt an existing agy CLI conversation UUID instead of starting a new one. Ignored if session_id is set.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description carries full burden. It discloses the --mode plan limitation, inability to edit files, session continuation semantics, and the critical constraint that conversation_id only works for CLI conversations, not IDE ones. This is thorough and trustworthy.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: purpose, safety/read-only, and parameter usage. Front-loaded and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given four parameters, no annotations, and no output schema, the description covers purpose, safety, and parameter interplay adequately. It doesn't describe return format, but for a chat tool that's acceptable and not a critical gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with basic descriptions, but the tool description adds relational semantics: session_id continues context, omitting starts new, conversation_id adopts external CLI sessions, and conversation_id is ignored when session_id is present. This goes beyond the schema's individual property descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Ask') and resource ('agy (Antigravity CLI)'), clearly distinguishing this as the question/consultation tool. It explicitly notes read-only behavior, which sets it apart from the sibling execute tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear guidance on when to use session_id versus conversation_id, and when to omit them. The read-only caveat implies use for questions rather than actions, but it doesn't explicitly name agy_execute as the alternative for modifications.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_close_sessionA

Close a session. By default this only marks it closed and leaves any worktree/branch on disk for manual review; pass remove_worktree=true to also delete the worktree (irreversible, discards any uncommitted changes in it).

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes
remove_worktreeNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing side effects. It explicitly mentions that the default keeps the worktree for manual review and that remove_worktree=true is irreversible and discards uncommitted changes, which is critical for an agent to avoid data loss.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no fluff. The purpose is front-loaded, and the conditional behavior is clearly structured without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 params, no output schema), the description covers all essential aspects: default behavior, destructive option, and irreversibility. No missing context that would impede correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has no descriptions (0% coverage), so the description adds meaning beyond the schema. It explains the effect of remove_worktree and its default, while session_id is implicitly required and self-evident from the tool's purpose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Close a session.' It uses a specific verb-resource combination and naturally differentiates from siblings like agy_list_sessions, agy_ask, and agy_execute by focusing on the closing action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use the tool and how to choose the parameter: it explains the default behavior (marks closed, leaves worktree) and instructs when to pass remove_worktree=true for deletion. This effectively covers both usage and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_executeA

Hand a plan/sprint to agy (Antigravity CLI) to execute with full file-write permissions. Runs inside an isolated git worktree (never the real working tree) so changes can be reviewed before merging. Pass session_id to continue a prior execute session in its existing worktree; omit it to start a new one. Alternatively pass conversation_id to adopt an existing agy CLI conversation (e.g. one you started in your own terminal) into a fresh worktree — note this only works for agy CLI conversations, not Antigravity IDE ones. Requires AGY_MCP_ALLOW_EXECUTE=1 in the server's environment.

ParametersJSON Schema
NameRequiredDescriptionDefault
planYesThe plan or task description for agy to execute
workspaceNoGit repo root to branch a worktree from when starting a new session (defaults to cwd)
session_idNoExisting execute-session id to continue, omit to start a new one
conversation_idNoAdopt an existing agy CLI conversation UUID instead of starting a new one. Ignored if session_id is set.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses critical behaviors: full file-write permissions, isolated git worktree (never the real working tree), the prerequisite of AGY_MCP_ALLOW_EXECUTE=1, and the caveat that conversation adoption only works for CLI conversations, not Antigravity IDE ones. With no annotations provided, the description fully carries the transparency burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is five sentences long, but each sentence contributes distinct and necessary information: purpose, worktree isolation, session modes, adoption caveat, and environment requirement. It is appropriately sized given the tool's complexity, though not as concise as a two-sentence summary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and no annotations, the description is quite thorough, covering operation, isolation, session lifecycle, and prerequisites. The main gap is the lack of information about what the tool returns (e.g., session ID or worktree path), which would be valuable for the agent to know.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all parameters, but the description adds behavioral meaning beyond the schema: it clarifies that session_id continues in an existing worktree, conversation_id adopts an existing conversation into a fresh worktree, and notes that conversation_id is ignored if session_id is set. It doesn't add extra semantics for plan or workspace, so the added value is partial.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the purpose: 'Hand a plan/sprint to agy (Antigravity CLI) to execute with full file-write permissions.' It uses a specific verb (execute) and resource (agy CLI), and the worktree isolation detail distinguishes it from sibling tools like agy_ask, agy_list_sessions, and agy_close_session.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool: pass a plan to execute, and explains how to continue a session with session_id, start fresh, or adopt a CLI conversation with conversation_id. However, it does not explicitly contrast with sibling tools like agy_ask, relying on the file-write permission to imply the distinction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_list_sessionsA

List known agy sessions (both ask and execute) with their status, workspace, and worktree path.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the full burden. It states the operation is a list and specifies the returned data (status, workspace, worktree path), which is transparent for a read-only tool, though it does not explicitly mention side effects or limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with the verb 'List', no filler words, and efficiently conveys scope and output.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description fully explains the purpose and return fields. It does not over-explain but is sufficient for an agent to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameters, so the baseline is 4. The description adds no parameter semantics because none exist, but it clarifies the scope of the listing (both ask and execute).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' and identifies the resource as 'known agy sessions', explicitly including 'both ask and execute'. It also enumerates the returned fields (status, workspace, worktree path), which distinguishes it clearly from siblings like agy_ask, agy_execute, and agy_close_session.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates this is a read-only listing operation, implying use when sessions need to be inspected. It does not explicitly name alternatives or exclusions, but the sibling tool names make the differentiation obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.0
    • First observedagy_ask
    • First observedagy_close_session
    • First observedagy_execute
    • First observedagy_list_sessions
Deploy Server
One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.5/5.0

Scored across 4 tools

Disambiguation5/5

Each tool has a clear, distinct purpose: ask is read-only Q&A, execute is write-capable task execution in an isolated worktree, list_sessions enumerates sessions, and close_session terminates them. There is no meaningful overlap; even ask and execute are sharply differentiated by their mode and permissions.

Naming Consistency4/5

All tools share the agy_ prefix and use imperative verbs, but agy_ask and agy_execute omit an explicit object while agy_list_sessions and agy_close_session include one. The pattern is predictable and readable, with only a minor inconsistency in verb-phrase structure.

Tool Count5/5

Four tools is on the lean side but appropriate for a focused server that wraps agy CLI session management. Each tool covers a distinct operation (ask, execute, list, close), so none feel redundant or missing.

Completeness4/5

The tool set covers the full session lifecycle: start an ask or execute session, continue one via session_id, list all sessions, and close/delete them. Minor gaps exist (no dedicated 'get session details' tool, no way to modify a session's plan), but list_sessions provides sufficient visibility and the ask/execute tools accept session_id to continue, so agents can work around these.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers