Agent Intern

Claude Code × Antigravity + Codex — MCP Bridge

Drive two external coding CLIs — Google's Antigravity (Gemini 3.5 Flash) and OpenAI Codex — as sub-agents inside Claude Code. Text answers, image generation, real repo work, and parallel swarms, on quota you already pay for.

[](https://github.com/SinanTufekci/agent-intern/actions/workflows/ci.yml) [](https://pypi.org/project/agent-intern/) [](https://pepy.tech/projects/agent-intern) [](LICENSE) [](https://www.python.org/) [](https://modelcontextprotocol.io/) [](https://glama.ai/mcp/servers/SinanTufekci/agent-intern) [](https://antigravity.google/) [](https://developers.openai.com/codex/) [](#requirements) [](https://github.com/sponsors/SinanTufekci)

---

One MCP server, two backends. It exposes Google Antigravity and OpenAI Codex to Claude Code as clean MCP tools so you can delegate work to a different model family mid-task — without leaving your terminal, and on the subscriptions you already have. Each backend is independent: install one or both.

• 🛰️ Antigravity (agy, Gemini 3.5 Flash High). Fast, cheap tool-calling — and the only

backend with an image model. Its headless print mode (agy -p) is broken: it authenticates, talks to the model, gets the answer… then writes it to the controlling terminal instead of its stdout, so anything capturing stdout gets nothing (and, under a TUI, agy's text leaks into the host's prompt). The bridge runs agy -p anyway, detaches it from the terminal so it can't leak, and reads the answer straight out of agy's own transcript files.

• 🤖 Codex (codex exec, OpenAI). The well-behaved sibling and a stronger reasoner for real

code/repo work. It writes its final message straight to a file the bridge asks for (no transcript-scraping), supports model selection, and has a real sandbox.

Both share the same niceties: a *_continue to resume a thread, a [live "watch" window](#watch-mode) to see the agent work, a unified [agent_swarm](#swarm) that runs many tasks in parallel across both backends at once, and *_status diagnostics that spend no quota.

> [!WARNING] > This runs unsandboxed code with your privileges. agy -p auto-executes its tools > (read/write files, run shell commands, reach the network) with no usable approval gate — its > --sandbox blocks only shell commands, leaving file writes and network egress wide open. > codex exec also runs autonomously, but its sandbox flag (default read-only) is a real > boundary. In both cases the workspace argument is a starting context, not a security > boundary. Only use these with trusted prompts on trusted content; for real isolation, run the > bridge inside a container or VM. [Full details →](#security)

Why you'd want this

| | | |---|---| | 🧠 Second opinion | Ask a different model family — Gemini or GPT — mid-task without switching tools. | | 🎨 Image generation | Have Gemini draw an image and get the saved file back — no extra API key or image tool. | | 🛠️ Real coding sub-agent | Hand a focused repo task to Codex with a real workspace-write sandbox. | | 💸 Cheap delegation | Burn Antigravity / Codex quota on grunt work instead of Claude tokens. | | 🐝 Parallel fan-out | Run N tasks at once, mixing Gemini and Codex workers in a single swarm. | | 📁 Cross-repo reads | Point a worker at another project directory and let it read/answer there. | | 🔌 Zero new auth | Piggybacks the logins you already did — no keys for the bridge to manage. |

The two backends at a glance

The bridge normalizes both CLIs into the same shape, but they differ where it matters. Pick per task:

| | 🛰️ Antigravity (agy) | 🤖 Codex (codex exec) | |---|---|---| | Model | Gemini 3.5 Flash (High) — fixed (see [Model & auth](#model--auth)) | Selectable via model (codex's -m) | | Best at | Fast, cheap tool-calling; quick answers | Heavier reasoning; real code/repo work | | Image generation | ✅ antigravity_image (+ antigravity_image_swarm) | ❌ no image model | | Sandbox | ❌ no real boundary (--sandbox blocks only shell) | ✅ real: read-only / workspace-write / danger-full-access | | How the answer is read | Scraped from agy's transcript.jsonl (stdout is broken) | Written to a file via -o/--output-last-message | | Continue mechanism | Pins the workspace's conversation id (--conversation) | Resumes the session id (codex exec resume ) | | Auth | OS credential store (AI Pro session) | codex login (ChatGPT account or API key) | | In a swarm | Runs with an isolated HOME to avoid state races | Fresh one-shot — needs no isolation |

How it works

Both backends run headless and one-shot per call; the bridge's job is to get a clean answer out of each and hand it to Claude Code as a plain string.

flowchart LR
    A([Claude Code]) -- "MCP tool call" --> B["bridge(server.py)"]
    B -- "antigravity_*" --> C[agy -p]
    B -- "codex_*" --> D[codex exec]
    C -- "Gemini 3.5 Flash" --> M1((model))
    D -- "GPT / Codex" --> M2((model))
    M1 -. "stdout stays empty" .-> T[("transcript.jsonl")]
    C -.-> T
    B -- "reads final PLANNER_RESPONSE" --> T
    M2 --> O[("output-last-message file")]
    D --> O
    B -- "reads last message" --> O
    B -- "plain text" --> A

Antigravity. agy -p persists its real answer — the one it never sends to stdout — to:

~/.gemini/antigravity-cli/brain//.system_generated/logs/transcript.jsonl

The bridge runs agy, locates the conversation via cache/last_conversations.json (falling back to the newest brain/ directory touched since launch), streams the transcript, and returns the final source=MODEL, status=DONE, type=PLANNER_RESPONSE entry — the answer, minus the intermediate tool-calling steps. antigravity_continue pins the workspace's exact conversation id via --conversation, so it never resumes the wrong thread. If agy wrote no JSONL (true for --sandbox runs), the bridge falls back to reading the SQLite .db agy dual-writes for every conversation.

Codex. codex exec is well-behaved: the bridge passes -o/--output-last-message and codex writes its final message straight there — no scraping. Continue works by capturing the session id from codex's own rollout files (~/.codex/sessions/.../rollout-*.jsonl) and resuming with codex exec resume , falling back to the newest on-disk session for that cwd after a server restart.

Set up in 60 seconds

Prerequisites — install whichever backend(s) you want, and sign in once each:

• Antigravity: install agy and sign in to Antigravity once (via the IDE or agy -i).
• Codex: install codex and run codex login once (ChatGPT account or API key).

You don't need both — the tools for a missing CLI simply report "not found" via their *_status tool.

Recommended — no clone, you control updates

With uv installed, register the bridge straight from PyPI under mcpServers in ~/.claude.json — no path to hardcode, no git pull to remember:

"agent-intern": {
  "command": "uvx",
  "args": ["agent-intern"]
}

uvx pins to the version it first caches and does not auto-upgrade, so you never run an update you didn't choose — important, since the bridge runs [unsandboxed code](#security): a surprise (or compromised) release can't execute until you opt in. When the startup check warns that a newer release is out, upgrade deliberately and restart Claude Code:

uvx agent-intern@latest      # fetch + run the newest release (refreshes uv's cache)

> [!TIP] > Prefer hands-off auto-updates? Put "args": ["agent-intern@latest"] in the config instead — > every launch runs the newest release. Convenient, but it pulls new code without asking each time.

From source

Clone it instead if you want to hack on the bridge or pin a local copy:

git clone https://github.com/SinanTufekci/agent-intern.git
cd agent-intern
pip install fastmcp
python test_smoke.py        # 4 real round-trips (ask, continue, image, swarm) — prints four PASS lines

> [!NOTE] > The smoke test costs a tiny bit of quota and takes ~30–60 s. It exercises the Antigravity path.

Then point Claude Code at the absolute path to server.py under mcpServers in ~/.claude.json:

WindowsmacOS / Linux

"agent-intern": {
  "command": "python",
  "args": ["C:\\path\\to\\server.py"]
}

"agent-intern": {
  "command": "python3",
  "args": ["/path/to/server.py"]
}

Restart Claude Code. Nine tools appear, each prefixed mcp__agent-intern__:

• Antigravity (5): antigravity_ask, antigravity_continue, antigravity_image,

antigravity_image_swarm, antigravity_status

• Codex (3): codex_ask, codex_continue, codex_status
• Shared (1): agent_swarm — fans a list of tasks out across both backends in one run

The single-prompt tools — Antigravity and Codex — take a watch=true flag for the live browser view ([Watch mode](#watch-mode)).

> "Use antigravity_ask to summarize the README of this repo in three bullets." → Claude routes the > prompt through the bridge, agy reads the file under the workspace root, and the answer comes back > as a plain string. Swap in codex_ask to have GPT do the same with a read-only sandbox.

Tools

🛰️ Antigravity

| Tool | Purpose | |---|---| | antigravity_ask(prompt, workspace?, timeout_s?=180, watch?=false) | Start a new Antigravity conversation. watch=true opens the live browser view ([Watch mode](#watch-mode)). | | antigravity_continue(prompt, workspace?, timeout_s?=180, watch?=false) | Continue the conversation rooted at workspace (pinned by id). watch=true opens the live view. | | antigravity_image(prompt, output_path?, workspace?, timeout_s?=240, watch?=false) | Generate an image; saves the file (extension corrected to the real bytes) and returns its path + format/size. watch=true streams progress and shows the image inline. | | antigravity_image_swarm(prompts, output_paths?, workspaces?, max_concurrency?=4, timeout_s?=240, watch?=false) | Generate several images in parallel (one worker per prompt). | | antigravity_status() | Setup diagnostics: the bridge's own version + whether a newer release is available, plus agy version/compat, state dirs, and newest-transcript readability. Spends no quota. |

🤖 Codex

| Tool | Purpose | |---|---| | codex_ask(prompt, workspace?, sandbox?="read-only", model?, timeout_s?=180, watch?=false) | Start a new Codex session. sandbox is a real boundary (see [Codex bridge](#codex-bridge)); model selects the model (-m). watch=true opens the live view, streaming codex's steps from its --json event stream. | | codex_continue(prompt, workspace?, timeout_s?=180, watch?=false) | Continue the Codex session rooted at workspace — resumes the exact session id, falling back to the newest on-disk session for that cwd after a server restart. The resumed session keeps its original sandbox and model. watch=true opens the live view. | | codex_status() | Setup diagnostics: codex version, login status (codex login status), sessions dir. Spends no quota. |

🐝 Shared

| Tool | Purpose | |---|---| | agent_swarm(tasks, max_concurrency?=4, timeout_s?=180, watch?=false) | Run several tasks in parallel across both backends — each task names its backend (antigravity or codex) plus a prompt (and, for Codex, sandbox/model). Every answer comes back in one block; watch=true opens the live dashboard ([Swarm](#swarm)). |

workspace defaults to the MCP server's current working directory. Point it at a real project dir for context-aware answers — both backends give the model access to files under that root (Codex honoring its sandbox).

antigravity_image forces agy to save to an explicit absolute path — without one, agy falls back to its own scratch dir (~/.gemini/antigravity-cli/scratch/). It then corrects the file extension to match the real bytes: agy's image model picks the format itself (JPEG for photo-like images, PNG for flat graphics), so a requested out.png may come back as out.jpg. The returned path always reflects the true format.

🤖 Codex bridge — the well-behaved sibling

Where agy -p is broken (it never writes to stdout, so the bridge scrapes transcript files), codex exec is clean: it writes its final message to a file the bridge asks for via -o/--output-last-message, so the answer comes back without scraping. Three things make Codex worth reaching for over Antigravity:

• Real sandbox. sandbox accepts read-only (default — reads and answers, writes nothing),

workspace-write (may edit files under the workspace), or danger-full-access (no sandbox — avoid). Unlike agy's no-op --sandbox, codex's -s actually enforces this. codex exec has no interactive approval gate, so this flag is your safety boundary — opt into write access deliberately.

• Model selection works. model maps to codex's -m; agy hangs on a model switch in print

mode, codex does not.

• Stronger reasoning. Codex is a coding agent, not an image model — there's no codex_image. Its

strength is reasoning and real code/repo work; hand it the jobs that need a heavier model.

Auth. Uses your existing Codex login (ChatGPT account or API key). Run codex login once; check with codex_status. No new keys for the bridge to manage.

> [!WARNING] > codex exec runs the model as an autonomous agent with no interactive approval gate. The > sandbox flag (default read-only) is the real boundary, but workspace-write / > danger-full-access let it modify files — and a swarm runs N agents at once. Only use it with > trusted prompts on trusted content.

👁️ Watch mode — Agent Intern (experimental)

Pass watch=true to any single-prompt tool — antigravity_ask, antigravity_continue, antigravity_image, codex_ask, or codex_continue — to watch the agent work live in a little terminal-style browser window called Agent Intern. The agent still runs headless; alongside it the bridge serves a tiny page on 127.0.0.1 and opens it in a small, chromeless app window that streams the agent's steps — its planner narration (▸), the real commands it runs ($), and completions (✓) — read live (from agy's transcript, or codex's --json event stream), with the final answer rendered as Markdown (and, for antigravity_image with watch=true, the generated image shown inline).

text ask / continue (agy or codex) antigravity_image — image inline

Real captures — the agent runs headless while the Agent Intern window live-streams its steps (▸ narration · $ commands · ✓ completions), then shows the final answer or image.

• Cross-platform & best-effort. Prefers a Chromium browser (--app mode) for the

windowed look; falls back to a normal browser window. If nothing can open, the run still completes and returns normally.

• Window size. Set AGY_WATCH_WINDOW_SIZE (e.g. AGY_WATCH_WINDOW_SIZE=480,700)

to resize the window; default is 560,760. Press Enter / Esc in the window to close it.

• One window, reused. Repeated watch calls reuse the already-open window

instead of stacking a new one each time — the open page resets itself for the new run (the swarm dashboard rebuilds for the new fan-out). If you closed the window, the next run opens a fresh one. Set AGY_WATCH_ALWAYS_NEW=1 to force a new window every time.

• Progress, keyboard & copy. Each panel shows a time progress bar (elapsed /

timeout). The swarm dashboard adds an overall done/total bar and per-row time bars; use ↑/↓

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: SinanTufekci
• Source: SinanTufekci/agent-intern
• License: MIT

Install and usage instructions live in the source repository linked above.