# AgentBridge MCP

A stdio TypeScript MCP server that delegates bounded coding tasks to a server-side agent loop. It persists tasks and conversations in SQLite, exposes compact task receipts, and keeps file access and command execution inside a guarded workspace.

Current version: `0.1.1`. See [CHANGELOG.md](CHANGELOG.md) for release history; every change updates both the version and changelog.

## Install and run

```powershell
npm.cmd install
npm.cmd run build
$env:AGENTBRIDGE_WORKSPACE = "D:\workplace\my-project"
$env:AGENTBRIDGE_API_KEY = "<server-side key>"
$env:AGENTBRIDGE_API_BASE = "https://api.openai.com/v1" # OpenAI-compatible endpoint
$env:AGENTBRIDGE_MODEL = "gpt-4.1-mini"
npm.cmd start
```

MCP client configuration:

```json
{
  "mcpServers": {
    "agentbridge": {
      "command": "node",
      "args": ["D:/workplace/2026/AgentBridge MCP/dist/index.js"],
      "env": {
        "AGENTBRIDGE_WORKSPACE": "D:/workplace/my-project",
        "AGENTBRIDGE_API_KEY": "${AGENTBRIDGE_API_KEY}",
        "AGENTBRIDGE_MODEL": "gpt-4.1-mini"
      }
    }
  }
}
```

## MCP tools

`delegate_task`, `get_task`, `continue_task`, `get_diff`, and `cancel_task` are public. The agent alone can call `workspace_list`, `workspace_search`, `workspace_read`, `workspace_patch`, and `workspace_command`.

## Security model

- Files must resolve through configured workspace roots; `.git`, symlinks, and common secret files are blocked.
- Patches are a single-file unified diff with a required SHA-256 precondition. File creation, deletion, and renames are disabled. Each write has before/after audit hashes.
- Commands are spawned without a shell, allow-listed (`npm`, `npx`, `node`, `git`), time-limited, and output-capped.
- API keys are read only from server environment variables and redacted from task errors. MCP receipts omit full source, prompt history, and raw tool logs.

## Limits

The OpenAI-compatible adapter supports chat-completions tool calls. The Codex CLI adapter is reserved but deliberately not implemented; no arbitrary shell execution is provided. Set `AGENTBRIDGE_ALLOWED_ROOTS` (semicolon-separated) to constrain the server further. State is written under `.agentbridge/` unless `AGENTBRIDGE_STATE_DIR` is provided.

## Verification

```powershell
npm.cmd run check
npm.cmd test
```