Claude Code, Codex, Cursor, VS Code, DeepSeek and LM Studio, with the same safe tools, set up once and tested for real.
I use several AI coding assistants. Each one can run commands, touch git and run my tests, and each one does it differently: different config files, different permission prompts, different ideas about what's safe. When I switched apps, I lost my workflows. And when an assistant runs git reset --hard or pushes to the wrong branch, "the model meant well" doesn't help much.
I wanted one set of developer tools that:
The Model Context Protocol (MCP) lets AI apps call tools provided by a separate program. agentbelt is that program. It provides:
agentbelt/<id>). They can commit there but never push, and never run reset, rebase, clean or checkout. repo-health or safe-commit, with approval steps.
Your AI app brings the model. agentbelt brings the tools. No API key, no second LLM.
.git. agentbelt approve). There's no tool for it, so the model can't approve its own work..agentbelt/audit.jsonl, with secrets removed. sandbox-exec, Linux bubblewrap) with no network, and if there's no sandbox, they're refused.
npx agentbelt setup installs a pinned copy with install scripts turned off, then makes real tool calls against it before switching to it. agentbelt update does the same with a new version next to the old one; agentbelt rollback switches back instantly.
An app counts as supported only when it made real tool calls in a real session, and the calls show up in agentbelt's audit log. Testing that way found real problems:
--workspace.${workspaceFolder} in its global config. With a folder open, Cursor does share the project through MCP, so the fix was to stop relying on the placeholder.
Today agentbelt is verified with Claude Code, Codex, Cursor, VS Code (Copilot agent mode), DeepSeek Harness and LM Studio.
npx agentbelt setup
Then ask your AI app: "Use agentbelt to run the checks and fix what fails."
⭐ If agentbelt is useful to you, a star on GitHub helps other developers find it.