agentlinkCAUTION
AgentLink: open-source, local-first MCP server for coding agents. Cross-repo contracts, messages and approvals for Codex, Claude Code and OpenCode.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Website & quickstart · npm package · Releases
AgentLink by Sruthik Issac is published as `@sruthik/agentlink` on npm.
0.2.0 reliability release: locally verified with 111 passing tests, installed-package MCP checks, 50×8-process lock contention, real supervised Codex wake/restart/acknowledgement, and real OpenCode proposal/review/approval/sync/session-resume/acknowledgement. Automatic wake is limited to explicitly enrolled supervised/headless Codex—not arbitrary GUI, IDE or Claude sessions. Distribution availability is tracked separately on npm and GitHub Releases. Release notes. GitHub Actions tests remain account-billing blocked; these are local, installed-package and actual-client results, not a CI PASS.
AgentLink is a local-first coordination layer for multiple coding agents — Claude Code, Codex CLI, GitHub Copilot CLI, OpenCode, Gemini CLI, and similar harnesses — working across related repositories.
The product goal is not generic agent chat. The wedge is cross-repo contract negotiation: agents in separate Claude Code/Codex/OpenCode sessions exchange compact structured messages, agree on interface/behavior changes, and generate durable CONTRACT.md handoff files each repo can implement against.
Install
Install once, then add AgentLink to your coding agent app as an MCP server:
npm install -g @sruthik/agentlink npx @sruthik/agentlink doctor agentlink doctor codex mcp add agentlink -- agentlink-mcp # or: claude mcp add -s user agentlink -- agentlink-mcp # OpenCode: add an MCP stdio server named agentlink with command agentlink-mcp in OpenCode settings
After that, use Codex/Claude Code/OpenCode normally
c82452623080OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add agentlink --env AGENTLINK_TEST_FAIL_TRANSACTION_KEY=${AGENTLINK_TEST_FAIL_TRANSACTION_KEY} -- npx -y @sruthik/[email protected]{
"mcpServers": {
"agentlink": {
"command": "npx",
"args": [
"-y",
"@sruthik/[email protected]"
],
"env": {
"AGENTLINK_TEST_FAIL_TRANSACTION_KEY": "${AGENTLINK_TEST_FAIL_TRANSACTION_KEY}"
}
}
}
}Exposed tools (19)
13 read · 3 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
agentlink_accept_contract | read | Mark the local AgentLink contract Accepted, optionally syncing it to a peer workspace. |
agentlink_ack_inbox | read | Durably acknowledge processing through one message id or cursor for the configured participant. This is separate from reading and notification. |
agentlink_approve_contract | read | Approve the current semantic contract revision as the stable participant configured for this MCP process/workspace. |
agentlink_close_conversation | read | Close an explicitly identified AgentLink conversation. |
agentlink_heartbeat_agent | read | Renew an active registration owned by the configured stable participant. |
agentlink_join_conversation | read | Join a conversation as the stable participant configured for this MCP process/workspace. |
agentlink_list_agents | read | List active, explicitly registered IDE/harness participants on the shared bus. Expired registrations are cleaned up. No tmux or filesystem crawling is required. |
agentlink_list_conversations | read | List conversations on the authoritative bus with ids, topics, status, message counts, and latest message activity. |
agentlink_list_tmux_agents | read | Optionally list coding-agent tmux panes. Absence of tmux is non-fatal and does not affect core AgentLink workflows. |
agentlink_read_inbox | read | Read ordered messages using a durable versioned cursor. Reading never acknowledges processing. |
agentlink_register_agent | read | Register the configured stable participant as an expiring IDE/harness endpoint. An adapter id is only a reference; executable trust remains in user config outside the repo. |
agentlink_retry_notification | read | Explicitly retry a failed notification event. Delivered events are deduplicated and are not executed again. |
agentlink_revoke_participant | destructive | As the conversation owner, revoke one stable participant from eligibility while preserving its historical messages and approvals for audit. |
agentlink_send_message | write | Persist a structured message and automatically enqueue eligible explicitly enrolled recipients. Persistence remains distinct from notification and processing acknowledgement. |
agentlink_set_message_cap | destructive | As the conversation owner, raise, set, or remove the optional message cap while the conversation is open. |
agentlink_start_conversation | write | Start a structured AgentLink conversation in the current workspace and create CONTRACT.md. |
agentlink_unregister_agent | destructive | Remove an IDE/harness registration owned by the configured stable participant. |
agentlink_update_contract | write | Update the local contract status and/or deterministically merge one markdown section, optionally syncing CONTRACT.md to a peer workspace. |
agentlink_wait_for_messages | read | Wait up to 30 seconds for messages after a durable cursor/message id. Timeout returns normally; cancellation does not acknowledge. Retry after restart with the same cursor. |
Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- none-observed
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (8)
token: 'dead-reclaim-successor',
agentlink_revoke_participant, agentlink_set_message_cap, agentlink_unregister_agent
.nojekyll
@types/node, typescript
> **0.2.0 reliability release:** locally verified with 111 passing tests, installed-package MCP checks, 50×8-process lock contention, real supervised Codex wake/restart/acknowledgement, and real OpenC
<section id="questions"><div class="eyebrow">Before you connect</div><h2>A small tool with a specific job.</h2><details open><summary>What is AgentLink?</summary><p>AgentLink by Sruthik Issac is an op
demos/agentlink-demo.gif
docs/agentlink-demo.gif
Gates applied: no_behavioural_pass.
c82452623080full audit observations/trust-audit/mcp-server/sruthik27__agentlink.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | c82452623080 | CAUTION | B | 89 | first audit |
Questions
What is the agentlink MCP server?
AgentLink: open-source, local-first MCP server for coding agents. Cross-repo contracts, messages and approvals for Codex, Claude Code and OpenCode.
What tools does agentlink expose?
19 in total: 13 read-only, 3 that write, and 3 that can delete or overwrite (agentlink_revoke_participant, agentlink_set_message_cap, agentlink_unregister_agent). Every one is listed on this page with its risk.
Is agentlink safe to connect to an agent?
With care. The audit graded it B (89/100) and found 8 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does agentlink need?
It reads AGENTLINK_TEST_FAIL_TRANSACTION_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (c82452623080), read on 2026-10-11. The repository is watched and re-audited when it changes.