AgentBridge
A local bridge connecting Claude Code and Codex in one live session — two agents exchange messages, review each other, and hand off tasks in real time.
The tool launches both agents with --dangerously-skip-permissions and --yolo by default; although a --safe/AGENTBRIDGE_SAFE opt-out exists and a prominent WARNING documents this, the max-permission default contradicts least privilege — a concrete deduction. Data flow is reasonably transparent (architecture table, SECURITY.md's 127.0.0.1-only and no-sanitization statements). Sensitive-data handling, external side effects (process cleanup, port binding, postinstall plugin auto-registration) are asserted without code evidence; no actual source is among the provided files, so most security claims are unverifiable. Rollback is handled adequately via kill/pairs prune/idempotent init/killed sentinel. Attribution is 'AgentBridge Contributors' with an unverified publisher identity.
The README and CI configs show good internal consistency: commands, owned flags, --safe suppression logic, and port allocation are described coherently. Dependency availability is supported by abg doctor, transport auto/ws/unix fallback, and version checks; failure messaging by a troubleshooting doc and guided errors (missing Bun). However, these are largely documentary claims; actual code behavior could not be verified in this static file set.
Audience and scenarios are exceptionally well covered: an explicit is/is-not list, three concrete use cases, and comparisons against copy-paste, one-way plugins, and external orchestrators. Capability boundaries appear in Current Limitations and the is/is-not list; trigger precision is backed by the three-tier marker routing and owned-flag conflict detection; environment fit covers macOS/Linux with Windows explicitly unsupported. The gap is that boundaries rest on documentation, not verifiable code.
Information architecture is clear (quick start, CLI table, architecture diagram, config tables, limitations, roadmap); install notes are exceptionally thorough, including a manual plugin-install fallback and dev setup; the MIT license is complete; naming is stable (agentbridge/abg consistent across package. and docs); known limitations have a dedicated section. Deductions: no standalone CHANGELOG (release notes are generated from git log), and maintenance responsibility is thin — SECURITY.md lists a single email, the author calls it a first open-source project, and the supported-versions table covers only 0.1.x with no evidence of long-term commitment.
Output usability is supported by -- options, doctor/budget diagnostics, and log commands. Marginal value is argued concretely in the 'Why not just…' section (bidirectional, mid-turn, peer-to-peer vs. alternatives). Cost-benefit is addressed via the two-process design and context filtering. All of this is documentation-level argument; real-world effect requires execution, which this review did not perform.
Claim traceability is moderate-to-weak: issue numbers (#68/#69/#85) and source paths (buildCodexArgs) are cited, but the provided evidence excludes those sources, so they cannot be checked. Cross-source corroboration is limited — CI badges, the npm package name, and external repo links exist but their contents were not verifiable here. Fact/inference separation is handled well: experimental features are labeled Experimental/opt-in, upstream variability is candidly disclosed, and the demo is described as a replayed session. No evidence URLs are attached per instructions.
- Both agents launch with --dangerously-skip-permissions and --yolo by default and can run commands and edit files without prompting; use only in a fully trusted workspace, or pass --safe / set AGENTBRIDGE_SAFE=1.
- The bridge does not filter or sanitize message content, and both agents may execute code based on received messages; be aware of prompt-injection risk propagating through the bridge.
- postinstall auto-registers and installs the Claude Code plugin — an install-time side effect; review scripts/postinstall.cjs before installing if this is unwanted.
- This review is based only on README, LICENSE, SECURITY.md, package., and CI configs; core source code was not in the evidence set, so no behavioral claim has been execution- or code-verified.
- Publisher identity is unverified, the project is at 0.1.x, and the maintainer describes it as a first open-source project; assess long-term maintenance risk before depending on it.
- Windows is not officially supported, and Claude Channels is a Research Preview whose behavior may change upstream.
What does this agent do, and when should you use it?
AgentBridge is a local tool that gives Claude Code and OpenAI Codex persistent, bidirectional real-time communication inside a single working session. It is a two-process architecture: a foreground MCP client (bridge.ts) started by Claude Code through its plugin, and a persistent background daemon (daemon.ts) that owns the Codex app-server proxy and bridge state, connected over an MCP stdio/plugin link, a control WebSocket (default :4502), and a local proxy (default :4501). Codex's conclusive output reaches Claude as channel notifications carrying only agentMessage payloads, while Claude replies via the reply MCP tool and the bridge injects it into Codex's thread as a turn/start. The tool adds a busy-guard turn coordinator, three-tier marker routing ([IMPORTANT]/[STATUS]/[FYI]), quota relay via the companion agent-quota-guard tool, and per-pair port allocation for multiple side-by-side pairs. Much of the codebase was written by the two agents collaborating through AgentBridge itself, with each agent's PRs reviewed by the other. Scope is explicit: it is not a hosted service, a generic orchestration framework, or a security boundary, and today it supports only the Claude Code ↔ Codex pair.
AgentBridge is driven by the abg CLI: abg init checks dependencies and generates .agentbridge/config.; abg claude launches Claude Code with the plugin channel enabled; abg codex starts a Codex TUI attached to the daemon. The daemon intercepts Codex app-server output, extracts only agentMessage items (collapsing commandExecution, fileChange, and reasoning noise), forwards them over the control WebSocket to bridge.ts, and delivers them as notifications/claude/channel to Claude. When Claude calls the reply tool, the message flows back through daemon.ts and is injected into the Codex thread via turn/start. Each message carries a source field for loop prevention; failed pushes fall back to an in-memory queue drained by get_messages. Marker routing forwards [IMPORTANT] immediately, batches [STATUS] into one periodic summary (3 updates or 15s), and drops [FYI]; the collaboration contract lives once in AGENTS.md written by abg init. abg doctor runs read-only diagnostics, abg budget shows both agents' 5h/weekly quota snapshots via agent-quota-guard, and near a quota hard-line the guard stops at a turn boundary, writes .agent/checkpoint.md, then resumes automatically when the window refreshes.
- Cross-review workflows where Codex implements and Claude reviews the diff in the same session, pushing change requests straight back into Codex's thread.
- Independent developers running unattended overnight jobs who want a task handed off to the other agent at a turn boundary when one subscription quota window runs dry.
- Users who want two agents to negotiate a division of labor from a single prompt and then implement their parts while the human steers.
- Multi-project developers running one Claude+Codex pair per project directory, side by side on one machine.
- Teams worried about unbounded context growth who want only conclusive messages crossing, not raw scrollback.
What are this agent's strengths and limitations?
- True bidirectional peer messaging: both agents stay live and either side can push a message mid-turn, unlike one-way request/response delegation plugins.
- Context does not blow up: the bridge passes only agentMessage conclusions, with [IMPORTANT]/[STATUS]/[FYI] three-tier routing so each side sees a curated stream, not the other's raw activity.
- Quota relay: when one side's subscription window runs dry it stops cleanly at a turn boundary, writes a checkpoint, and hands off — long jobs survive limits.
- Local-first resilient lifecycle: the persistent daemon survives Claude Code restarts with exponential-backoff reconnect, and automatic resume is protected by idempotency tombstones even across daemon restarts.
- Hard dependency on Bun v1.3.11+ as the runtime; the daemon and plugin server will not run on Node.js alone.
- Defaults launch with --dangerously-skip-permissions / --yolo, meaning both agents run commands and edit files without prompting — safe only in trusted workspaces.
- Supports only the Claude Code ↔ Codex pair, one Codex thread and one Claude foreground connection per pair, and Windows is not officially supported yet.
- Budget coordination is experimental and opt-in, requiring the companion agent-quota-guard package; Claude-side resume is best-effort with known upstream variability for idle-session pushes.
How do you install or deploy this agent?
Prerequisites: Bun v1.3.11+ (required runtime; Node.js alone is not enough), Claude Code v2.1.80+, and Codex CLI. Install:
- Install Bun: curl -fsSL https://bun.sh/install | bash
- Install the CLI globally (postinstall best-effort registers and installs the Claude Code plugin): npm install -g @raysonmeng/agentbridge
- Initialize the project (checks deps, writes .agentbridge/config.): abg init
If the postinstall plugin step was skipped, run inside Claude Code: /plugin marketplace add raysonmeng/agent-bridge, then /plugin install agentbridge@agentbridge, then /reload-plugins. For local development: git clone the repo, run bun install && bun link, then agentbridge dev.
How do you use this agent?
Five steps to a running pair:
- abg init
- abg claude (starts Claude Code with the channel enabled in this terminal)
- In another terminal run abg codex (bare command auto-resumes the pair's last Codex thread; abg codex --new starts fresh)
Then give Claude a task wanting a second agent, e.g. "Propose a task split with Codex, have Codex implement its part while you review" — messages flow both ways without manual relaying. By default abg claude launches with --dangerously-skip-permissions and abg codex with --yolo; use them only in trusted workspaces, or add --safe / set AGENTBRIDGE_SAFE=1 to restore permission prompts. Supporting commands: abg doctor for diagnostics, abg budget for quota snapshots, abg logs -f to tail logs, abg kill to stop.
How does this agent compare with similar options?
The README explicitly contrasts two alternatives: running two terminals with manual copy-paste (you become the message bus, with no busy-guard or event filtering), and one-way delegation plugins like openai/codex-plugin-cc (request in, one response out; the other side is not a standing peer and interaction happens only at call boundaries). Unlike an external orchestrator — a top-down god-process scheduling dumb terminals — AgentBridge is peer-to-peer: two full agents converse in-session, propose their own splits, and review each other.