IAF Agent Bridge
IAF Agent Bridge lets an MCP host delegate work to Cursor Agent, continue the same Cursor session, cancel turns, and run diagnostics.
Send a prompt to Cursor Agent for a workspace and wait until the Cursor turn is terminal, returning Cursor's reply and a sessionId.
Reuse the sessionId to continue the same Cursor conversation for follow-up work.
Set mode (agent, plan, ask), optional model, effort, context window, and fast tier.
Attach up to 20 context files; text becomes resource links and images are sent inline when accepted.
Cancel an in-flight Cursor turn by sessionId, optionally forcing process kill after a grace period.
Run doctor to check Node, bridge version, Cursor CLI discovery, authentication state, and optionally do an ACP handshake or scan a workspace.
Let the supervisor decide CONTINUE, COMPLETE, or BLOCKED based on Cursor's result.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@IAF Agent Bridgedelegate to Cursor: add retry logic to the upload handler, continue until done"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
IAF Agent Bridge
MCP server that lets Codex, Claude Code, or another stdio host send work to Cursor Agent and continue the same Cursor session until the requested work is done.
The bridge carries the prompt, the session, and Cursor's reply. The supervisor decides what happens next. Cursor does the implementation.
delegate returns only after that Cursor turn is finished. A message that says the work is complete does not end the call while Cursor is still running tools, sub-agents, or a follow-up. Cursor keeps control of that internal work. The supervisor sees one result, then chooses CONTINUE, COMPLETE, or BLOCKED.
Status: npm iaf-agent-bridge@1.1.0 is the current public package. GitHub Release v1.1.0 matches it. v1.0.2, v1.0.1, and v1.0.0 remain published. The Official MCP Registry entry is io.github.francescoveryra-dot/iaf-agent-bridge version 1.1.0.
Supervisor (Codex, Claude Code, or another MCP host)
|
| MCP over stdio
v
IAF Agent Bridge
|
| ACP over stdio
v
Cursor Agent
|
v
Your repositoryCursor Agent is the only production executor. Codex and Claude Code are supervisors. Do not install this server into the Cursor MCP config of a repository that Cursor itself is editing. That loop is refused.
What you can do
Start a Cursor session from an MCP host and resume it with
sessionId.Let ordinary development continue without approving every tool call.
Reject force-push, history rewrite, destructive SQL, deletes outside the project, and secret staging unless you explicitly set
IAF_PERMISSION_MODE=allow-all.Use a Master Prompt when the repository has one. A repository without one works normally.
Related MCP server: Cursor Delegate
Prerequisites
Node.js 20 or newer. Running the test suite needs Node.js 22.
The Cursor CLI on your
PATHasagent.agent logincompleted on that machine.
No OpenAI API key is required for the local stdio server.
Personal Private mode is separate from the local stdio server. You create your own Secure MCP Tunnel and restricted runtime key. npx iaf-agent-bridge setup chatgpt --project my-project=/absolute/path stores that alias locally, and npx iaf-agent-bridge chatgpt listens on a socket that only your user can open. IAF does not host a relay. Calling delegate from normal ChatGPT requires that workspace to expose Full MCP write tools. A tested ChatGPT Plus account did not. The bridge does not detect the plan. Details: docs/remote-chat.md.
Install
Channel | Status | How |
npm | AVAILABLE |
|
Official MCP Registry | AVAILABLE | |
Cursor plugin | DIRECT INSTALL AVAILABLE |
|
Cursor Marketplace | SUBMITTED — PENDING REVIEW | Not a public install yet. Direct install remains |
Claude Code | DIRECT INSTALL AVAILABLE |
|
GitHub Copilot CLI | DIRECT INSTALL AVAILABLE |
|
Codex / ChatGPT GitHub plugin | DIRECT INSTALL AVAILABLE |
|
OpenAI plugin directory | NOT APPLICABLE for this local server | The public directory reviews a hosted HTTPS MCP endpoint. This bridge runs on your machine and talks to your local Cursor CLI. |
VS Code MCP gallery | NOT LISTED | VS Code browses the GitHub MCP registry. This server is in the Official MCP Registry and is not in that gallery. Add it with |
Manual MCP configuration remains the fallback. See docs/installation.md and docs/hosts.md.
Quick start
git clone https://github.com/francescoveryra-dot/IAF-Agent-Bridge.git
cd IAF-Agent-Bridge
npm install
npm run build
node dist/cli.js doctordoctor should show the Cursor executable and Authenticated: true. It does not print your account.
Point an MCP host at the published package:
command: npx
args: ["-y", "iaf-agent-bridge@1.1.0"]A source checkout can use node and dist/cli.js after npm run build. Then ask the supervisor to implement the work with Cursor and to call delegate again with the returned sessionId while requested work remains.
Install by host
Host | How | Detail |
Codex | Plugin manifest in this repo, or | |
Claude Code |
| |
Cursor | Plugin manifest for marketplace submission. Do not use it to delegate from Cursor to Cursor. | |
Any stdio MCP client |
|
npm install (npx -y iaf-agent-bridge) installs 1.1.0. See docs/installation.md and docs/release.md.
Tools
Tool | Use |
| Send a prompt. Pass |
| Stop an in-flight turn. The session can still be resumed. |
| Check Node, the bridge, the Cursor CLI, and authentication. |
Example follow-up: the first delegate returns "sessionId": "...". The next call uses that id and a prompt that names what is still missing.
How the supervisor should behave
Read result as if you had pasted Cursor's reply into the conversation. Then choose one state:
CONTINUE when requested work remains and Cursor can still do it. This is the normal result. Plans, TODOs, mocks, and missing layers are CONTINUE.
COMPLETE when the requested work is actually present.
BLOCKED only for a real external decision, secret, or irreversible authorization.
The bridge does not demand a new lint run, end-to-end suite, or coverage gate after every turn. Details: docs/supervisor-loop.md.
If the repository contains MASTER_PROMPT.md or the other project files listed in docs/supervisor-loop.md, the first result names them. If it does not, nothing is created.
Configuration and troubleshooting
Environment variables: docs/configuration.md.
If doctor says Cursor was not found, install the CLI and open a new shell. If it says not authenticated, run agent login. More cases: docs/troubleshooting.md.
Security
The bridge can ask Cursor to edit the workspace you name and to run commands there. Read SECURITY.md and docs/security-model.md.
Report vulnerabilities privately: Security advisories. Do not open a public issue that contains a token, a credential, or a working exploit.
Contributing
CONTRIBUTING.md. Issues and pull requests are welcome. Support routes are in SUPPORT.md.
License
MIT. See LICENSE.
Available Tools
3 toolscancelADestructiveIdempotent
Cancel an in-flight Cursor turn by sessionId. Status is cancelled, killed, not-running (the turn ended and the session can still be resumed), or not-found.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | After a short grace period, kill the Cursor process if the turn is still running. | |
| sessionId | Yes | Session id returned by delegate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true, and readOnlyHint=false, so safety is covered. The description adds value beyond them by enumerating result states and clarifying that not-running means the turn ended while the session can still be resumed — non-obvious outcome semantics, especially valuable since no output schema exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences: the action front-loaded, then the terse outcome enumeration. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter mutation tool with full annotation coverage and no output schema, the description covers action, target, and all four possible result states. The only gap is any note on preconditions (e.g., what happens if the session is not found) beyond the status word itself.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and both parameters carry their own descriptions, including the force grace-period behavior, so the schema does the heavy lifting. The description only echoes sessionId ('by sessionId') and adds nothing about the force parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (cancel), resource (an in-flight Cursor turn), and the keying parameter (sessionId). It is clearly distinguishable from siblings delegate and doctor, though it never explicitly contrasts itself with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'in-flight Cursor turn' implies the precondition for use, and the status list hints at outcomes, but there is no explicit when-to-use/when-not-to-use guidance or reference to alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delegateADestructive
Send a prompt to Cursor Agent and wait until that Cursor turn is terminal, including tool work and any sub-agent follow-up Cursor performs before it stops. Returns Cursor's reply and the sessionId to reuse. A second call for a session that is still running is rejected. You decide CONTINUE, COMPLETE, or BLOCKED. Do not shell out to the agent binary.
| Name | Required | Description | Default |
|---|---|---|---|
| fast | No | Request Cursor's fast tier. Leave false unless the user asks. Higher cost. | |
| mode | No | agent implements. plan asks Cursor to produce a plan and stop. ask is for a read-oriented question. The mode is an instruction to Cursor. | agent |
| model | No | Optional Cursor model id. Omit to keep Cursor's current default. | |
| effort | No | Exact effort value advertised by the selected model. Invalid values fail before the prompt and name the accepted set. | |
| prompt | Yes | Natural prompt for Cursor. Sent as written. Point at files and project documents instead of pasting them. | |
| context | No | Context-window option when the model advertises one, such as 272k or 1m. Omit unless the user asks. | |
| sessionId | No | Resume this Cursor session. Omit to start one. Use the sessionId from the previous result for follow-up work. | |
| workspace | Yes | Existing project directory Cursor will work in. Must not be the home directory or filesystem root. | |
| contextFiles | No | Files to attach. Text becomes resource links. Images (png, jpg, gif, webp, under 5MB) are sent inline when Cursor accepts them. Missing files are warnings, not failures. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive/openWorld/non-idempotent, so the safety profile is covered. The description adds substantial non-obvious behavior: the call blocks until the turn is terminal, it encompasses tool work and sub-agent follow-up, concurrent calls on a running session are rejected, and the reply plus sessionId come back. It does not spell out that the agent may modify files, but the blocking and concurrency semantics are genuinely informative.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five tight sentences with zero filler, and the core blocking behavior plus return contract are front-loaded before the caveats. Every sentence carries a distinct, useful fact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly discloses the return shape (Cursor's reply and the reusable sessionId). Combined with full schema coverage, an agent has what it needs to invoke the tool. The one loose end is the unexplained 'You decide CONTINUE, COMPLETE, or BLOCKED', which is opaque without further context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across all 9 parameters, so the schema already carries defaults, enums, and constraints. The description adds little parameter-level detail beyond noting the sessionId is meant for reuse, which the schema also states. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action (send a prompt to Cursor Agent) and a specific resource/session model, and states the blocking contract: it waits until the Cursor turn is terminal, including tool work and sub-agent follow-up. It also distinguishes itself from the wrong approach ('Do not shell out to the agent binary'), so an agent can tell this apart from the sibling cancel/doctor tools without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives real usage context: omit sessionId to start a session, reuse the returned sessionId for follow-up, and a second call against a still-running session is rejected. It also steers away from shelling out to the agent binary. It stops short of explicitly comparing itself to the cancel and doctor siblings, so it is strong but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
doctorARead-onlyIdempotent
Report Node, bridge version, Cursor CLI discovery, authentication state without secrets, and an optional ACP handshake.
| Name | Required | Description | Default |
|---|---|---|---|
| deep | No | Open a short ACP session to verify Cursor can start. This creates an empty Cursor session. | |
| workspace | No | Optional project directory to validate and scan for project context files. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered without the description. The description adds one genuinely useful behavior claim — auth state is reported 'without secrets' — but says nothing about cost, latency, or the fact that the optional ACP handshake spins up a session (that detail lives only in the schema).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that lists the checks in a scannable order with no filler. It is slightly dense as a laundry list, but every clause names a distinct diagnostic area, so nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-parameter diagnostic tool with no output schema, the description usefully enumerates what will be reported, which effectively previews the return contents. The main remaining gap is not explaining the format or granularity of the report, but the coverage is otherwise adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'deep' and 'workspace' are fully documented in the schema, and the baseline is 3. The description only loosely gestures at the 'deep' parameter via 'an optional ACP handshake' and never mentions the workspace scan, adding little beyond structured data.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Report') and enumerates exactly what is reported: Node and bridge versions, Cursor CLI discovery, auth state, and an ACP handshake. This is clearly a diagnostics tool, distinguishable in intent from the sibling 'delegate' and 'cancel' actions, though it never explicitly contrasts itself with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied — the list of checks signals 'run this to troubleshoot or verify your setup' — but there is no explicit statement of when to call it, when a deep run is warranted, or how it relates to the sibling tools. An agent can infer the context but is given no routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v1.0.0- First observed
cancel - First observed
delegate - First observed
doctor
TDQS
Scored across 3 tools
Each tool has a clearly distinct purpose: delegate runs a Cursor turn, cancel aborts an in-flight turn, and doctor reports environment/diagnostic state. There is no overlap in verbs or resources, so misselection is essentially impossible.
All three tools use a consistent single-verb, lowercase naming convention (delegate, cancel, doctor). The pattern is uniform and readable throughout.
Three tools is a lean but defensible surface for a delegation bridge covering run, abort, and diagnose. It is slightly thin, since there is no explicit session-listing or status-inspection tool, but nothing feels redundant.
The core lifecycle is covered: start a turn (delegate), stop one (cancel), and verify the environment (doctor), with sessionId reuse enabling resume. Minor gaps exist around listing/inspecting existing sessions and reading history without re-delegating.
Maintenance
Related MCP Connectors
- DazbenchOAuthapp.dazbench
Task management your AI agents can actually run. One line becomes a context-ready task over MCP.
Persistent memory and cross-session learning for AI coding assistants (hosted remote MCP).
- QuallaaOAuthcom.quallaa
Talk to your public-facing AI from any MCP client — Claude, ChatGPT, Cursor, Cline, Windsurf.
Real-time chat for AI agents. Claude Code, Cursor, Cline and Codex join channels over MCP.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients like Claude Code to delegate coding tasks to the local Cursor Agent CLI, with persistent per-workspace sessions that resume across calls.12 npmMIT
- AlicenseAqualityAmaintenanceEnables MCP clients like Claude Code and Codex to delegate coding tasks to Cursor's CLI agent, which implements changes in the workspace and returns clean, structured results for review.3133 npm4MIT
- AlicenseAqualityBmaintenanceEnables MCP clients like Codex to delegate coding tasks to DeepSeek Harness, reusing the same Web-visible session for feedback and keeping the conversation in the Harness Web UI.101MIT
- AlicenseBqualityBmaintenanceEnables any MCP host to delegate work to multiple coding-agent CLIs such as Codex, Claude Code, and Antigravity as subagents, preserving native sessions and supporting team-based supervision and agent-to-agent messaging.17638 npmApache 2.0