agent-bus

A local communication bus for the coding agents on your machine.

You probably run more than one coding agent — Claude Code in a terminal, Codex in another, Cursor in a window. Each one is an island: it has no idea the others exist, what they're working on, or what they've already figured out. The vendors are quietly building one-way bridges (Codex imports Claude Code transcripts; Claude Desktop has an internal session bus) — but each wants to be the orchestrator, so nobody ships the neutral layer.

agent-bus is that layer: one small MCP server that every agent registers, giving each of them eyes on — and a channel to — all the others. No daemon, no accounts, no cloud. It reads the session stores the agents already write to disk, and relays through the headless CLIs they already ship.

┌─────────────┐      ┌─────────────┐      ┌─────────────┐
│ Claude Code │      │    Codex    │      │   Cursor    │
└──────┬──────┘      └──────┬──────┘      └──────┬──────┘
       │  MCP (stdio)       │                    │
       └────────────────────┼────────────────────┘
                     ┌──────┴──────┐
                     │  agent-bus  │
                     └──────┬──────┘
          ┌─────────────────┼──────────────────┐
     session stores    headless CLIs      handoff briefs
     (~/.claude, …)   (claude -p, codex exec)  (~/.agent-bus)

What each agent gains

So from inside any agent you can say things like:

• "What are my other agents working on right now?"

• "Ask Codex what it concluded about the flaky auth test."

• "Hand this session off to Claude Code and have it pick up where we left off."

Related MCP server: agent-bus-mcp

How it works

It's an MCP server, not a skill and not a service. Each agent speaks MCP natively; registering agent-bus adds its five tools to that agent's toolbox. There is nothing to start and nothing running in the background: MCP stdio servers are spawned by the agent as a child process when a session opens, spoken to over stdin/stdout, and killed when the session ends. Concurrent agents each spawn their own instance — shared state is just the files on disk.

• Discovery reads the stores each agent already maintains: Claude Code's ~/.claude/projects/**/*.jsonl, Codex's ~/.codex/sessions rollouts + session_index.jsonl, Cursor's state.vscdb SQLite (read-only, immutable mode).

• Asking shells out to the callee's own headless mode — claude -p [--resume <id>], codex exec [resume <id>] — so answers come from a real session of that agent, resumable later, in its own history.

• Handoff distills the source transcript into a brief under ~/.agent-bus/handoffs/, then either hands you the launch command or seeds the target session for you and returns its resume command.

Install

Requires Node 18+, macOS (session-store paths are macOS-specific for now), and whichever agents you use on the machine.

# register with each agent you use — npx fetches the package on first spawn:
claude mcp add --scope user agent-bus -- npx -y agent-bus
codex mcp add agent-bus -- npx -y agent-bus
# Cursor: add to ~/.cursor/mcp.json →  { "mcpServers": { "agent-bus": { "command": "npx", "args": ["-y", "agent-bus"] } } }

Or from a clone (for development): git clone https://github.com/rishabhjava/agent-bus && cd agent-bus && npm install, then register node <path>/server.mjs instead of npx -y agent-bus.

Codex note: Codex prompts for approval on an MCP server's first tool call ("always allow" persists it). Headless codex exec cannot answer that prompt — to use the bus headlessly, set default_tools_approval_mode = "auto" under [mcp_servers.agent-bus] in ~/.codex/config.toml.

New sessions of each agent pick the tools up automatically. Smoke-test without any agent:

npm run smoke                          # list tools, list sessions, read one per agent
node test/smoke.mjs ask claude        # cheap round-trip through claude -p

Safety model

Letting agents talk to each other is letting untrusted inputs talk to each other, so the bus is deliberately paranoid:

• Provenance headers — every relayed prompt is prefixed with a notice that it comes from a peer agent, not the human, and should be treated as untrusted input.

• Loop guard — a relay-depth counter propagates through the child process tree (AGENT_BUS_DEPTH) and hard-refuses at depth 2, so two agents can never recursively prompt each other into a token bonfire.

• No permission laundering — the bus never widens the callee's permissions: Codex calls run sandboxed read-only unless explicitly allowed to write, and Claude calls run headless under its default permission mode.

Caveats

• Prototype, built and verified on one machine in one sitting. Parsers for the vendors' session formats are defensive but the formats are undocumented and will drift.

• Cursor is read-only (discovery + handoff source) until its headless CLI is present.

• Asking a thread that is currently open interactively does not inject into the live TTY — the callee answers out-of-band, from a snapshot of that thread's context. With Claude Code, the exchange isn't even a separate session: it lands in the same session file as a parallel branch (same session id, different parent chain), which the live view never displays. Observed in practice when a Codex session used ask_agent on the live Claude Code session that was building this project — the answer was correct, and the live session only learned about the exchange by reading its own transcript off disk. True live injection needs harness cooperation; that's the interesting next problem.

License

MIT