agents-can-communicateBLOCK
Messages between AI coding sessions in different vendors' clients, such as Claude Code and Codex. Local, open source, no lead agent.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The message your clients can’t send each other.
Claude Code can message your other Claude Code sessions, and Codex can queue a message for another Codex session. Neither client offers a way to message the other’s sessions. ACC carries questions, reviews and handoffs between sessions in different vendors’ clients, on your machine.
You open each client normally and choose its work. Every session keeps its own model, conversation, and permissions. Coordination runs locally, with no lead agent managing the others. If all your sessions run in one of these two clients, try its own messaging first.
flowchart TB you["You choose the tools and work"] codex["CodexFeature A"] claude["Claude CodeFeature B"] antigravity["Antigravity CLIFeature C"] acc["Communication via ACC"] you -.-> codex you -.-> claude you -.-> antigravity codex acc claude acc antigravity acc subgraph handoff["When you switch clients"] direction LR current["Claude Codesession"] --> saved["HandoffDone · DecisionsNext steps"] saved --> next["Codexsession"] end acc ~~~ handoff classDef human fill:#f1f5f9,stroke:#8593a3,color:#202a35 classDef session fill:#fff,stroke:#ced4d9,color:#202a35 classDef shared fill:#e8edff,stroke:#385cde,color:#202a35 class you human class codex,claude,antigravity,current,next session class acc,saved shared style handoff fill:transparent,stroke:#ced4d9 linkStyle 3,4,5,6,7 stroke:#385cde,stroke-width:2px
When ACC helps
- Get a second opinion from another vendor’s model. Ask a Codex session to review a change
your Claude Code session just made, and send its findings back to the session that wrote the code.
- Bring parallel features together. Let sessions in different clients ask each other about
a shared API before they build around different assumptions
eed167b070a1OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add storage-filesystem --env ANTIGRAVITY_CSRF_TOKEN=${ANTIGRAVITY_CSRF_TOKEN} --env EXPECTED_TOKEN=${EXPECTED_TOKEN} -- npx -y @agents-can-communicate/[email protected]{
"mcpServers": {
"storage-filesystem": {
"command": "npx",
"args": [
"-y",
"@agents-can-communicate/[email protected]"
],
"env": {
"ANTIGRAVITY_CSRF_TOKEN": "${ANTIGRAVITY_CSRF_TOKEN}",
"EXPECTED_TOKEN": "${EXPECTED_TOKEN}"
}
}
}
}Exposed tools (11)
9 read · 2 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
acc_ack | read | Acknowledge receipt without accepting work or writing an answer. |
acc_claim | read | Acquire one resource or atomically acquire a nonempty resources array; renew by claimId. |
acc_finish | read | Record a handoff describing what was completed and what remains, and |
acc_inbox | read | List a bounded page of unresolved message summaries, newest first, without |
acc_message | read | Durably record a typed message to other participants. ${OUTGOING} ${MUTATION_POLL} |
acc_release | read | Release only claims this session owns, with exactly one of claimId, claimIds, resource, |
acc_reply | read | Reply to one addressed message and acknowledge the original in the same |
acc_request | read | Ask another agent to do something in a reply-required message. Use this |
acc_status | read | Read who is here, current intents and claims, the workspace |
acc_sync | write | Read coordination state for this workspace: roster, attention items, and |
acc_work | write | Publish what this session is doing now as one concise Intent. Intent is |
Trust audit
BLOCKgrade F · trust 45/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const commonDir = await exec(cwd, ["rev-parse", "--path-format=absolute",
const worktreeRoot = await exec(cwd, ["rev-parse", "--show-toplevel"]);
const branch = await exec(cwd, ["branch", "--show-current"]).catch(() => "");
const head = await exec(cwd, ["rev-parse", "HEAD"]).catch(() => "");
const remote = await exec(cwd, ["remote", "get-url", "origin"]).catch(() => "");
peer's ID, read runtime bindings, or improvise credentials.
peer's ID, read runtime bindings, or improvise credentials.
peer's ID, read runtime bindings, or improvise credentials.
peer's ID, read runtime bindings, or improvise credentials.
value = JSON.parse(text.replace(/^/, ""));
const apiKey = "sk-ant-stub-key-0123456789abcdefghij";
const TOKEN = "c740d75d-0000-4b4d-bf37-secret-token";
const TOKEN = "0123456789abcdef0123456789abcdef";
const TOKEN = "0123456789abcdef0123456789abcdef";
token: "delayed-legacy-token",
const apiKey = "sk-ant-stub-key-0123456789abcdefghij";
return createHash("sha1").update(`${key}${GUID}`).digest("base64");return createHash("sha1").update(`${key}${GUID}`).digest("base64");f.place("w1", name(), JSON.stringify(record("/home/me/.ssh/agent.sock")));await readFile(new URL("../../package.json", import.meta.url), "utf8")).version,import { NO_ALLOW_RULE_ON_WINDOWS } from "../../../tests/helpers/platform-scope.mjs";import { NO_ALLOW_RULE_ON_WINDOWS } from "../../../tests/helpers/platform-scope.mjs";import { NO_ALLOW_RULE_ON_WINDOWS } from "../../../tests/helpers/platform-scope.mjs";assert.equal(await reason({ event: { sessionId: "../../etc" } }), "handshake_failed");+ "--enable_sidecars --host_bridge_url=http://127.0.0.1:55326 --host_bridge_token=<bridge>";
Gates applied: no_behavioural_pass.
eed167b070a1full audit observations/trust-audit/mcp-server/automatis-tools__agents-can-communicate.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | eed167b070a1 | BLOCK | F | 45 | first audit |
Questions
What is the agents-can-communicate MCP server?
Messages between AI coding sessions in different vendors' clients, such as Claude Code and Codex. Local, open source, no lead agent.
What tools does agents-can-communicate expose?
11 in total: 9 read-only, 2 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is agents-can-communicate safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (45/100) and found 9 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does agents-can-communicate need?
It reads ANTIGRAVITY_CSRF_TOKEN and EXPECTED_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (eed167b070a1), read on 2026-10-11. The repository is watched and re-audited when it changes.