One Toolbelt for Every AI Coding Assistant: Why I Built agentbelt

A developer built agentbelt, an open-source Model Context Protocol (MCP) server that gives multiple AI coding assistants — including Claude Code, Codex, Cursor, VS Code, DeepSeek Harness and LM Studio — a single shared set of sandboxed developer tools. The tool enforces safety through per-repo git worktrees that can commit but never push or run destructive commands like reset and rebase, requires human approval for risky actions, logs calls to an audit file, and runs commands in OS-level sandboxes with no network. The developer reports that requiring real tool calls during verification surfaced concrete integration bugs, such as Cursor not sharing the project folder through MCP when a workspace is open.

Claude Code, Codex, Cursor, VS Code, DeepSeek and LM Studio, with the same safe tools, set up once and tested for real. I use several AI coding assistants. Each one can run commands, touch git and run my tests, and each one does it differently: different config files, different permission prompts, different ideas about what's safe. When I switched apps, I lost my workflows. And when an assistant runs git reset --hard or pushes to the wrong branch, "the model meant well" doesn't help much. I wanted one set of developer tools that: The Model Context Protocol MCP lets AI apps call tools provided by a separate program. agentbelt is that program. It provides: agentbelt/<id . They can commit there but never push, and never run reset , rebase , clean or checkout . repo-health or safe-commit , with approval steps. Your AI app brings the model. agentbelt brings the tools. No API key, no second LLM. .git . agentbelt approve . There's no tool for it, so the model can't approve its own work. .agentbelt/audit.jsonl , with secrets removed. sandbox-exec , Linux bubblewrap with no network, and if there's no sandbox, they're refused. npx agentbelt setup installs a pinned copy with install scripts turned off, then makes real tool calls against it before switching to it . agentbelt update does the same with a new version next to the old one; agentbelt rollback switches back instantly. An app counts as supported only when it made real tool calls in a real session, and the calls show up in agentbelt's audit log. Testing that way found real problems: --workspace . ${workspaceFolder} in its global config. With a folder open, Cursor does share the project through MCP, so the fix was to stop relying on the placeholder. Today agentbelt is verified with Claude Code, Codex, Cursor, VS Code Copilot agent mode , DeepSeek Harness and LM Studio. npx agentbelt setup Then ask your AI app: "Use agentbelt to run the checks and fix what fails." ⭐ If agentbelt is useful to you, a star on GitHub https://github.com/LovaRK/agentbelt helps other developers find it.