AgentBridge MCP

A stdio TypeScript MCP server that delegates bounded coding tasks to a server-side agent loop. It persists tasks and conversations in SQLite, exposes compact task receipts, and keeps file access and command execution inside a guarded workspace.

Current version: 0.1.1. See CHANGELOG.md for release history; every change updates both the version and changelog.

Install and run

npm.cmd install
npm.cmd run build
$env:AGENTBRIDGE_WORKSPACE = "D:\workplace\my-project"
$env:AGENTBRIDGE_API_KEY = "<server-side key>"
$env:AGENTBRIDGE_API_BASE = "https://api.openai.com/v1" # OpenAI-compatible endpoint
$env:AGENTBRIDGE_MODEL = "gpt-4.1-mini"
npm.cmd start

MCP client configuration:

{
  "mcpServers": {
    "agentbridge": {
      "command": "node",
      "args": ["D:/workplace/2026/AgentBridge MCP/dist/index.js"],
      "env": {
        "AGENTBRIDGE_WORKSPACE": "D:/workplace/my-project",
        "AGENTBRIDGE_API_KEY": "${AGENTBRIDGE_API_KEY}",
        "AGENTBRIDGE_MODEL": "gpt-4.1-mini"
      }
    }
  }
}

Related MCP server: PatchWarden

MCP tools

delegate_task, get_task, continue_task, get_diff, and cancel_task are public. The agent alone can call workspace_list, workspace_search, workspace_read, workspace_patch, and workspace_command.

Security model

• Files must resolve through configured workspace roots; .git, symlinks, and common secret files are blocked.

• Patches are a single-file unified diff with a required SHA-256 precondition. File creation, deletion, and renames are disabled. Each write has before/after audit hashes.

• Commands are spawned without a shell, allow-listed (npm, npx, node, git), time-limited, and output-capped.

• API keys are read only from server environment variables and redacted from task errors. MCP receipts omit full source, prompt history, and raw tool logs.

Limits

The OpenAI-compatible adapter supports chat-completions tool calls. The Codex CLI adapter is reserved but deliberately not implemented; no arbitrary shell execution is provided. Set AGENTBRIDGE_ALLOWED_ROOTS (semicolon-separated) to constrain the server further. State is written under .agentbridge/ unless AGENTBRIDGE_STATE_DIR is provided.

Verification

npm.cmd run check
npm.cmd test