Skip to main content
Glama

IAF Agent Bridge

MCP server that lets Codex, Claude Code, or another stdio host send work to Cursor Agent and continue the same Cursor session until the requested work is done.

The bridge carries the prompt, the session, and Cursor's reply. The supervisor decides what happens next. Cursor does the implementation.

delegate returns only after that Cursor turn is finished. A message that says the work is complete does not end the call while Cursor is still running tools, sub-agents, or a follow-up. Cursor keeps control of that internal work. The supervisor sees one result, then chooses CONTINUE, COMPLETE, or BLOCKED.

Status: npm iaf-agent-bridge@1.1.0 is the current public package. GitHub Release v1.1.0 matches it. v1.0.2, v1.0.1, and v1.0.0 remain published. The Official MCP Registry entry is io.github.francescoveryra-dot/iaf-agent-bridge version 1.1.0.

CI npm GitHub Release License: MIT Node

Supervisor (Codex, Claude Code, or another MCP host)
        |
        | MCP over stdio
        v
IAF Agent Bridge
        |
        | ACP over stdio
        v
Cursor Agent
        |
        v
Your repository

Cursor Agent is the only production executor. Codex and Claude Code are supervisors. Do not install this server into the Cursor MCP config of a repository that Cursor itself is editing. That loop is refused.

What you can do

  • Start a Cursor session from an MCP host and resume it with sessionId.

  • Let ordinary development continue without approving every tool call.

  • Reject force-push, history rewrite, destructive SQL, deletes outside the project, and secret staging unless you explicitly set IAF_PERMISSION_MODE=allow-all.

  • Use a Master Prompt when the repository has one. A repository without one works normally.

Related MCP server: Cursor Delegate

Prerequisites

  • Node.js 20 or newer. Running the test suite needs Node.js 22.

  • The Cursor CLI on your PATH as agent.

  • agent login completed on that machine.

No OpenAI API key is required for the local stdio server.

Personal Private mode is separate from the local stdio server. You create your own Secure MCP Tunnel and restricted runtime key. npx iaf-agent-bridge setup chatgpt --project my-project=/absolute/path stores that alias locally, and npx iaf-agent-bridge chatgpt listens on a socket that only your user can open. IAF does not host a relay. Calling delegate from normal ChatGPT requires that workspace to expose Full MCP write tools. A tested ChatGPT Plus account did not. The bridge does not detect the plan. Details: docs/remote-chat.md.

Install

Channel

Status

How

npm

AVAILABLE

npx -y iaf-agent-bridge@1.1.0

Official MCP Registry

AVAILABLE

io.github.francescoveryra-dot/iaf-agent-bridge 1.1.0

Cursor plugin

DIRECT INSTALL AVAILABLE

agent plugin marketplace add https://github.com/francescoveryra-dot/IAF-Agent-Bridge.git

Cursor Marketplace

SUBMITTED — PENDING REVIEW

Not a public install yet. Direct install remains agent plugin marketplace add https://github.com/francescoveryra-dot/IAF-Agent-Bridge.git.

Claude Code

DIRECT INSTALL AVAILABLE

claude plugin marketplace add francescoveryra-dot/IAF-Agent-Bridge then claude plugin install iaf-agent-bridge@iaf-agent-bridge

GitHub Copilot CLI

DIRECT INSTALL AVAILABLE

copilot plugin marketplace add francescoveryra-dot/IAF-Agent-Bridge then copilot plugin install iaf-agent-bridge@iaf-agent-bridge

Codex / ChatGPT GitHub plugin

DIRECT INSTALL AVAILABLE

codex plugin marketplace add https://github.com/francescoveryra-dot/IAF-Agent-Bridge.git --ref main then codex plugin add iaf-agent-bridge@iaf-agent-bridge

OpenAI plugin directory

NOT APPLICABLE for this local server

The public directory reviews a hosted HTTPS MCP endpoint. This bridge runs on your machine and talks to your local Cursor CLI.

VS Code MCP gallery

NOT LISTED

VS Code browses the GitHub MCP registry. This server is in the Official MCP Registry and is not in that gallery. Add it with npx -y iaf-agent-bridge.

Manual MCP configuration remains the fallback. See docs/installation.md and docs/hosts.md.

Quick start

git clone https://github.com/francescoveryra-dot/IAF-Agent-Bridge.git
cd IAF-Agent-Bridge
npm install
npm run build
node dist/cli.js doctor

doctor should show the Cursor executable and Authenticated: true. It does not print your account.

Point an MCP host at the published package:

command: npx
args:    ["-y", "iaf-agent-bridge@1.1.0"]

A source checkout can use node and dist/cli.js after npm run build. Then ask the supervisor to implement the work with Cursor and to call delegate again with the returned sessionId while requested work remains.

Install by host

Host

How

Detail

Codex

Plugin manifest in this repo, or config.toml

docs/hosts.md

Claude Code

claude mcp add or the plugin in .claude-plugin/

docs/hosts.md

Cursor

Plugin manifest for marketplace submission. Do not use it to delegate from Cursor to Cursor.

docs/marketplaces.md

Any stdio MCP client

node + dist/cli.js

docs/installation.md

npm install (npx -y iaf-agent-bridge) installs 1.1.0. See docs/installation.md and docs/release.md.

Tools

Tool

Use

delegate

Send a prompt. Pass sessionId to continue the same Cursor conversation.

cancel

Stop an in-flight turn. The session can still be resumed.

doctor

Check Node, the bridge, the Cursor CLI, and authentication.

Example follow-up: the first delegate returns "sessionId": "...". The next call uses that id and a prompt that names what is still missing.

How the supervisor should behave

Read result as if you had pasted Cursor's reply into the conversation. Then choose one state:

  • CONTINUE when requested work remains and Cursor can still do it. This is the normal result. Plans, TODOs, mocks, and missing layers are CONTINUE.

  • COMPLETE when the requested work is actually present.

  • BLOCKED only for a real external decision, secret, or irreversible authorization.

The bridge does not demand a new lint run, end-to-end suite, or coverage gate after every turn. Details: docs/supervisor-loop.md.

If the repository contains MASTER_PROMPT.md or the other project files listed in docs/supervisor-loop.md, the first result names them. If it does not, nothing is created.

Configuration and troubleshooting

Environment variables: docs/configuration.md.

If doctor says Cursor was not found, install the CLI and open a new shell. If it says not authenticated, run agent login. More cases: docs/troubleshooting.md.

Security

The bridge can ask Cursor to edit the workspace you name and to run commands there. Read SECURITY.md and docs/security-model.md.

Report vulnerabilities privately: Security advisories. Do not open a public issue that contains a token, a credential, or a working exploit.

Contributing

CONTRIBUTING.md. Issues and pull requests are welcome. Support routes are in SUPPORT.md.

License

MIT. See LICENSE.

Available Tools

3 tools
cancelA
DestructiveIdempotent

Cancel an in-flight Cursor turn by sessionId. Status is cancelled, killed, not-running (the turn ended and the session can still be resumed), or not-found.

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNoAfter a short grace period, kill the Cursor process if the turn is still running.
sessionIdYesSession id returned by delegate.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true, and readOnlyHint=false, so safety is covered. The description adds value beyond them by enumerating result states and clarifying that not-running means the turn ended while the session can still be resumed — non-obvious outcome semantics, especially valuable since no output schema exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: the action front-loaded, then the terse outcome enumeration. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter mutation tool with full annotation coverage and no output schema, the description covers action, target, and all four possible result states. The only gap is any note on preconditions (e.g., what happens if the session is not found) beyond the status word itself.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters carry their own descriptions, including the force grace-period behavior, so the schema does the heavy lifting. The description only echoes sessionId ('by sessionId') and adds nothing about the force parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (cancel), resource (an in-flight Cursor turn), and the keying parameter (sessionId). It is clearly distinguishable from siblings delegate and doctor, though it never explicitly contrasts itself with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'in-flight Cursor turn' implies the precondition for use, and the status list hints at outcomes, but there is no explicit when-to-use/when-not-to-use guidance or reference to alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delegateA
Destructive

Send a prompt to Cursor Agent and wait until that Cursor turn is terminal, including tool work and any sub-agent follow-up Cursor performs before it stops. Returns Cursor's reply and the sessionId to reuse. A second call for a session that is still running is rejected. You decide CONTINUE, COMPLETE, or BLOCKED. Do not shell out to the agent binary.

ParametersJSON Schema
NameRequiredDescriptionDefault
fastNoRequest Cursor's fast tier. Leave false unless the user asks. Higher cost.
modeNoagent implements. plan asks Cursor to produce a plan and stop. ask is for a read-oriented question. The mode is an instruction to Cursor.agent
modelNoOptional Cursor model id. Omit to keep Cursor's current default.
effortNoExact effort value advertised by the selected model. Invalid values fail before the prompt and name the accepted set.
promptYesNatural prompt for Cursor. Sent as written. Point at files and project documents instead of pasting them.
contextNoContext-window option when the model advertises one, such as 272k or 1m. Omit unless the user asks.
sessionIdNoResume this Cursor session. Omit to start one. Use the sessionId from the previous result for follow-up work.
workspaceYesExisting project directory Cursor will work in. Must not be the home directory or filesystem root.
contextFilesNoFiles to attach. Text becomes resource links. Images (png, jpg, gif, webp, under 5MB) are sent inline when Cursor accepts them. Missing files are warnings, not failures.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructive/openWorld/non-idempotent, so the safety profile is covered. The description adds substantial non-obvious behavior: the call blocks until the turn is terminal, it encompasses tool work and sub-agent follow-up, concurrent calls on a running session are rejected, and the reply plus sessionId come back. It does not spell out that the agent may modify files, but the blocking and concurrency semantics are genuinely informative.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Five tight sentences with zero filler, and the core blocking behavior plus return contract are front-loaded before the caveats. Every sentence carries a distinct, useful fact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description correctly discloses the return shape (Cursor's reply and the reusable sessionId). Combined with full schema coverage, an agent has what it needs to invoke the tool. The one loose end is the unexplained 'You decide CONTINUE, COMPLETE, or BLOCKED', which is opaque without further context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% across all 9 parameters, so the schema already carries defaults, enums, and constraints. The description adds little parameter-level detail beyond noting the sessionId is meant for reuse, which the schema also states. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action (send a prompt to Cursor Agent) and a specific resource/session model, and states the blocking contract: it waits until the Cursor turn is terminal, including tool work and sub-agent follow-up. It also distinguishes itself from the wrong approach ('Do not shell out to the agent binary'), so an agent can tell this apart from the sibling cancel/doctor tools without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives real usage context: omit sessionId to start a session, reuse the returned sessionId for follow-up, and a second call against a still-running session is rejected. It also steers away from shelling out to the agent binary. It stops short of explicitly comparing itself to the cancel and doctor siblings, so it is strong but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

doctorA
Read-onlyIdempotent

Report Node, bridge version, Cursor CLI discovery, authentication state without secrets, and an optional ACP handshake.

ParametersJSON Schema
NameRequiredDescriptionDefault
deepNoOpen a short ACP session to verify Cursor can start. This creates an empty Cursor session.
workspaceNoOptional project directory to validate and scan for project context files.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered without the description. The description adds one genuinely useful behavior claim — auth state is reported 'without secrets' — but says nothing about cost, latency, or the fact that the optional ACP handshake spins up a session (that detail lives only in the schema).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that lists the checks in a scannable order with no filler. It is slightly dense as a laundry list, but every clause names a distinct diagnostic area, so nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-parameter diagnostic tool with no output schema, the description usefully enumerates what will be reported, which effectively previews the return contents. The main remaining gap is not explaining the format or granularity of the report, but the coverage is otherwise adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both 'deep' and 'workspace' are fully documented in the schema, and the baseline is 3. The description only loosely gestures at the 'deep' parameter via 'an optional ACP handshake' and never mentions the workspace scan, adding little beyond structured data.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Report') and enumerates exactly what is reported: Node and bridge versions, Cursor CLI discovery, auth state, and an ACP handshake. This is clearly a diagnostics tool, distinguishable in intent from the sibling 'delegate' and 'cancel' actions, though it never explicitly contrasts itself with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied — the list of checks signals 'run this to troubleshoot or verify your setup' — but there is no explicit statement of when to call it, when a deep run is warranted, or how it relates to the sibling tools. An agent can infer the context but is given no routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv1.0.0
    • First observedcancel
    • First observeddelegate
    • First observeddoctor

TDQS

A3.9/5.0

Scored across 3 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: delegate runs a Cursor turn, cancel aborts an in-flight turn, and doctor reports environment/diagnostic state. There is no overlap in verbs or resources, so misselection is essentially impossible.

Naming Consistency5/5

All three tools use a consistent single-verb, lowercase naming convention (delegate, cancel, doctor). The pattern is uniform and readable throughout.

Tool Count4/5

Three tools is a lean but defensible surface for a delegation bridge covering run, abort, and diagnose. It is slightly thin, since there is no explicit session-listing or status-inspection tool, but nothing feels redundant.

Completeness4/5

The core lifecycle is covered: start a turn (delegate), stop one (cancel), and verify the environment (doctor), with sessionId reuse enabling resume. Minor gaps exist around listing/inspecting existing sessions and reading history without re-delegating.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Enables MCP clients like Claude Code and Codex to delegate coding tasks to Cursor's CLI agent, which implements changes in the workspace and returns clean, structured results for review.
    3
    133 npm
    4
    MIT
  • A
    license
    A
    quality
    B
    maintenance
    Enables MCP clients like Codex to delegate coding tasks to DeepSeek Harness, reusing the same Web-visible session for feedback and keeping the conversation in the Harness Web UI.
    10
    1
    MIT
  • A
    license
    B
    quality
    B
    maintenance
    Enables any MCP host to delegate work to multiple coding-agent CLIs such as Codex, Claude Code, and Antigravity as subagents, preserving native sessions and supporting team-based supervision and agent-to-agent messaging.
    17
    638 npm
    Apache 2.0