Skip to main content
Glama

SWE2 bridge for Codex

Use your installed Devin CLI as an additional worker in Codex. Persistent assignments support follow-ups in the same Devin session, structured permissions, declared checks, and a shared pool of up to three independent workers. Version 0.3 adds prepared Git review comparisons, optional quiet waits, and retrievable final reports.

Your existing task, role, and model-selection rules choose when to use Devin alongside native Codex agents. The plugin adds no routing priorities and does not add an entry to Codex's native model picker.

Status: experimental. Real macOS evidence covers session/edit/check behavior, images, follow-ups, crash recovery, and the version 0.3 review/wait/report additions. Linux remains experimental and Windows is unsupported. See verification for tested behavior and qualification limits.

How it runs

Codex starts a local Node.js MCP server over stdio. The bridge drives your local Devin CLI through its Agent Client Protocol (ACP), and Devin uses your authenticated account for remote model inference.

There is no central bridge service to host, listening HTTP port, or account managed by this project. Each person installs and runs their own copy. Publishing this repository shares the source and setup process; it does not publish the plugin to the official Codex directory or create a universal one-click installation link.

Related MCP server: cursor-agent-bridge

Install locally

You need:

  • macOS, Node.js 22 or later, npm, and Git.

  • A Codex build with local plugins and the codex plugin commands.

  • Devin CLI installed, authenticated, and able to use your selected model. Account access is separate from this project.

git clone https://github.com/naim149/swe2-bridge.git
cd swe2-bridge
npm ci --ignore-scripts
npm run doctor
npm run install:local

Resolve any prerequisite reported by doctor, then rerun it. These setup commands do not submit a model task. The installer creates a machine-specific plugin under .local/marketplace/plugins/swe2-bridge, registers the local marketplace swe2-bridge-local, and installs swe2-bridge@swe2-bridge-local in Codex.

Start a fresh Codex task after installation. Ask Codex to use the Devin worker for a bounded task. Keep the clone in place: its local installation is used by Codex.

Tools

Tool

Purpose

devin_preflight

Check a structured assignment and prerequisites without inference.

devin_run

Start an assignment, or return its existing job for the same identity and revision.

devin_message

Create the next revision as a new job in the same Devin session.

devin_wait / devin_wait_many

Collect progress with per-job cursors, or opt into compact quiet waits for new outcomes and attention.

devin_report

Retrieve a finished job's retained answer and separate execution, evidence, policy, verification, and acceptance states.

devin_list

Discover persisted jobs and recover assignment identities.

devin_respond

Approve an allowed declared check once, deny a request, or answer a requested form.

devin_cancel

Stop a job. Changes already made remain in the workspace.

devin_record_check

Attach caller-reported evidence from a native or other authorized executor.

Waits default to mode: "progress". Optional mode: "quiet" ignores ordinary progress and returns compact state on a new terminal outcome, actionable request, error, or timeout. Pass each job's next_token back as after_token to acknowledge what you have seen. Both modes wait up to 55 seconds, defaulting to 10. Cancelling a wait stops only the wait; use devin_cancel to stop the worker. See the worker contract for cursor and acknowledgment details.

For a Git review, add review: {base_sha, head_sha} with explicit immutable commit IDs to a read assignment. The bridge prepares a bounded complete comparison diff, changed-file metadata, and applicable head-revision AGENTS.md files. These comparison IDs are separate from the assignment's base_sha, which asserts checkout HEAD. Missing or unsupported evidence blocks preparation; no Git/history or shell tools are added to the reviewer. See review preparation for coverage and limits.

After a turn finishes, devin_report retrieves its retained answer independently of the rolling event buffer. A completed answer can coexist with denied actions or incomplete verification. task_accepted: false means the Lead has not accepted the work; inspect all outcome fields before deciding whether it meets the task.

The supported model IDs are exactly swe-2-medium (default), swe-2-high, and swe-2-max. The selected model must be available to your Devin account; aliases and silent fallback are not accepted.

Assignments use one of three execution profiles:

Profile

Authorized work

read

Investigation; delegated writes and shell checks are denied.

edit

Edits to explicit owned_paths; checks are handed to a native executor.

edit_check

Owned edits plus exact declared checks assigned to Devin, with command and working directory enforced.

The bridge enforces delegated filesystem writes and check permissions, but it is not an OS sandbox. Other CLI tools, approved shell commands, and Git's evidence gaps limit isolation and observation. Review the worker contract before assigning work.

The shared external pool allows up to three jobs in independent checkouts. The Lead also counts native and external workers against the caller's existing budget and coordinates named resources. Stable assignment IDs and revisions prevent a repeated request from blindly rerunning the same work.

Permissions and private data

Trust is established for the specific assignment directory, using an existing native trust record or an explicit caller acknowledgment. Profiles determine execution policy; no global trust or permission setting is changed. Permission and form questions appear as attention requests. Only declared, allowed checks can be approved through the bridge.

Job prompts, session records, logs, and Git snapshots are stored locally under ~/.local/share/devin-bridge by default. They can contain source code and sensitive data. Keep them out of public issues and commits. Read SECURITY.md for the trust boundary and reporting guidance.

Verification and contributions

npm run check and npm test run local source and regression checks without model inference. Real acceptance checks use disposable workspaces and the installed CLI. VERIFICATION.md records versions, observed results, and remaining gaps; it is not a model benchmark or a guarantee for arbitrary projects.

Contributions are welcome, especially reproducible bug reports, installation portability, and results from bounded real-environment checks. Start with CONTRIBUTING.md. The project is licensed under MIT.

This is an independent community project; it is not an official OpenAI or Cognition integration.

Available Tools

3 tools
devin_cancelCancel Devin workerA
DestructiveIdempotent

Stop an existing Devin job and return its cancellation or existing terminal state. Cancellation preserves changes already made in the working directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesJob identifier returned by devin_run.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true and idempotentHint=true. The description adds genuinely useful context beyond those: that cancellation preserves changes already in the working directory, which softens the destructive implication, and that it returns the cancellation or existing terminal state, explaining the idempotent behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, and the core action-plus-outcome is front-loaded before the side-effect note. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description responsibly covers the return value ('cancellation or existing terminal state'). For a one-parameter, low-complexity tool this is nearly complete, though it could note whether calling on an already-terminal job errors or silently succeeds.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single job_id parameter is fully documented as 'Job identifier returned by devin_run.' The description adds no syntax or format detail beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Stop an existing Devin job') and clarifies the outcome. It is clearly distinguishable from siblings devin_run and devin_wait, which start and poll a job respectively.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by 'Stop an existing Devin job', which tells the agent this is for terminating a running job. However, there is no explicit when/when-not guidance or routing to an alternative, and no prerequisites are named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

devin_runRun Devin workerA
Destructive

Start a delegated engineering task through the installed Devin CLI. Returns a job_id promptly; collect its result with devin_wait. The worker may edit files and execute commands. One external job runs at a time per bridge instance.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdYesAbsolute path to the existing working directory.
taskYesObjective, required context, constraints, and acceptance criteria.
modelNoDevin model identifier or alias. Omit to use DEVIN_BRIDGE_MODEL, or swe-2-medium if unset. Model aliases may change model.
scopeNoFile ownership or task constraints to communicate to the worker; does not enforce isolation.
timeout_secondsNoMaximum worker duration in seconds.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true and openWorldHint=true, and the description adds critical context: the worker may edit files and run commands (explaining the destructive nature), one external job runs at a time per bridge instance (a concurrency constraint), and it returns a job_id promptly (async behavior). This meaningfully exceeds what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loaded with the core action and immediately stating the return value and the follow-up tool. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the async start/poll model, the destructive capability, the concurrency limit, and the result-retrieval path, complementing annotations and the fully-documented schema. No output schema exists, but the description explains the job_id return so nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with each parameter already documented in the schema, including defaults, bounds, and a note that scope does not enforce isolation. The description adds no parameter-level detail beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Start a delegated engineering task'), and explicitly names the sibling devin_wait as the way to collect results, distinguishing it from the polling tool. The async nature and the job_id return are clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clear routing to devin_wait for results and an implied fire-and-forget usage model. However, it doesn't state when NOT to use this tool (e.g., vs. doing the work directly) or describe the role of devin_cancel, leaving some alternative-selection gaps.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

devin_waitWait for Devin workerA
Read-onlyIdempotent

Read the current or terminal result of an existing Devin job. Waits for completion for at most wait_seconds. Reuse the same job_id while it is running; a completed process still requires review of the work.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesJob identifier returned by devin_run.
wait_secondsNoWait up to this many seconds; zero returns an immediate snapshot.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly, idempotent, non-destructive behavior, so the bar is lower. The description adds blocking semantics (waits up to wait_seconds for completion) and the note that a finished job still needs review, which is genuinely useful context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the core action and no redundant filler. Slightly more compressed would still convey the same, but every sentence carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully characterizes the return as a current or terminal result and explains the wait bound. Safety is fully covered by annotations, leaving little an agent needs that is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented by the schema descriptions. The description reinforces wait_seconds as a completion-wait bound but adds no format or edge-case detail beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (read/wait) and resource (an existing Devin job), with 'existing' implicitly distinguishing it from the sibling devin_run that creates jobs. It does not name devin_run or devin_cancel explicitly, so the differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives practical usage context: reuse the same job_id while running, and review the work even after a completed process. It does not explicitly contrast when to call this versus devin_cancel or devin_run, but the running-job context is clear enough to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observeddevin_cancel
    • First observeddevin_run
    • First observeddevin_wait

TDQS

A4.2/5.0

Scored across 3 tools

Disambiguation5/5

Each tool maps to a distinct job lifecycle stage: run (start), wait (poll/collect), cancel (stop). Descriptions explicitly distinguish devin_run from devin_wait and mention job_id handoff, so there is no realistic overlap.

Naming Consistency5/5

All three tools use the same devin_<verb> snake_case pattern with parallel imperative verbs (run, wait, cancel). Fully predictable and readable.

Tool Count5/5

Three tools precisely cover the async start/poll/cancel lifecycle for a single-job bridge. Nothing is redundant; adding more would be overengineering.

Completeness4/5

Start, wait, and cancel cover the core lifecycle, and cancellation notes that changes are preserved. Minor gaps could be listing/inspecting active jobs or cleaning up terminal job state, but these are workable around.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables Codex to delegate bounded coding tasks to MiMo Code through a shared local daemon, supporting task boundaries, Git Worktrees, and a collaborative review workflow.
    3
    MIT
  • A
    license
    Not graded
    quality
    A
    maintenance
    A local STDIO MCP server that bridges MCP clients to the Codex CLI by sending instructions to a configured workspace, exposing task run, status, and result tools with a read-only sandbox and no remote transport.
    124
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Launches the official Codex CLI as a persistent MCP server so DeepSeek Harness can invoke Codex models without storing or transmitting ChatGPT credentials to third parties.
    MIT