v0.2.0

Changelog

Features

• 016c9c6: feat: Codex takes skills too (@masihmoloodian)
• a0f2c4d: feat: Cursor takes skills, and package installs are idempotent (@masihmoloodian)
• c67d075: feat: VS Code takes skills, via chat.agentSkillsLocations (@masihmoloodian)

Fixes

• 52d09d7: fix: a skills-only plugin created an empty config in every JSON client (@masihmoloodian)
• b209cb6: fix: an empty container outlived every plugin that used it (@masihmoloodian)
• 1db9546: fix: enforce the working directory on the two clients that ignore it (@masihmoloodian)
• d20af2c: fix: the installer pointed at an organisation that does not exist (@masihmoloodian)
• 23820de: fix: the npm package installed a command that hung on first use (@masihmoloodian)
• e644508: fix: the same empty container outlived both plugins in the second config file (@masihmoloodian)
• 4f904c1: fix: two adapters never wrote the working directory, and two clients ignore it (@masihmoloodian)

Documentation

• 4e17040: docs: Cursor takes skills (@masihmoloodian)
• b84a5b1: docs: VS Code confirmed; no client reports undocumented any more (@masihmoloodian)
• aeed458: docs: a publishing path for npm that does not need a token (@masihmoloodian)
• 741c6ae: docs: bring every document up to date, and enforce two of the claims (@masihmoloodian)
• 69f64a9: docs: end-to-end verified against five clients by their own CLIs (@masihmoloodian)
• 6748981: docs: four of six clients now carry skills; VS Code is the holdout (@masihmoloodian)
• 047d8b7: docs: how to turn on the Homebrew tap, and what the first release taught (@masihmoloodian)
• 511d8f1: docs: npm is published and verified (@masihmoloodian)
• a24e1fb: docs: npm no longer accepts TOTP, so the publish flow is not what this said (@masihmoloodian)
• 894957e: docs: record the client path findings against M10-2 (@masihmoloodian)
• 728da57: docs: record the cwd fixes in the end-to-end summary (@masihmoloodian)
• 2686ee8: docs: record what auditing the documentation by running it found (@masihmoloodian)
• 6a4b2c8: docs: run TESTING.md end to end, and fix what running it exposed (@masihmoloodian)
• 124783d: docs: the landing page now installs rather than builds (@masihmoloodian)
• c2685c7: docs: the local npm version is not what trusted publishing depends on (@masihmoloodian)
• a51de80: docs: the repository is public and v0.1.0 is released (@masihmoloodian)

Verifying this release

Every artifact is covered by a signed checksum file. Verification is not an
optional extra here — a tool that asks you to care about where your plugins
come from should make it trivial to check where it came from itself.

cosign verify-blob checksums.txt \
  --signature checksums.txt.sig \
  --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/agentbridgehq/agentbridge/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

sha256sum --check --ignore-missing checksums.txt

Build provenance is attested through GitHub and can be checked with:

gh attestation verify <artifact> --repo agentbridge/agentbridge

v0.1.0

One command installs an agent plugin into every AI coding assistant on your machine — with a lockfile, secrets kept out of config files, and a scanner that reads what a plugin's instruction text tells your agent to do.

curl -fsSL https://raw.githubusercontent.com/agentbridgehq/agentbridge/main/install.sh | sh

The installer verifies a SHA-256 checksum against the signed checksum file below before writing anything, and the Sigstore signature too when cosign is present. AGENTBRIDGE_REQUIRE_SIGNATURE=1 makes cosign's absence an error.

What is in it

• Six clients. Claude Code, Cursor, VS Code / Copilot, Codex, Gemini CLI, opencode. Each gets the plugin in its own dialect — a directory here, JSON there, a TOML block somewhere else — and you are told exactly what each one took and what it dropped, with a reason.
• Skills reach Claude Code and opencode, the two clients whose vendors document where skill packages go. Elsewhere MCP servers install normally and the missing skills are reported rather than written to a guessed path.
• A scanner for instruction text. A SKILL.md is loaded into a model holding your credentials, your SSH agent and your source tree. No SCA tool, SAST scanner or EDR agent reads it. This one does — 15 rules over the text itself, plus hidden-text tricks: invisible characters, bidirectional overrides, look-alike alphabets. High-severity findings stop an install until you have looked.
• Pinned sources. Local directories, git references and OCI registries, each resolved to an immutable commit or digest before anything downloads, recorded in a lockfile you commit.
• Updates that show what changed. A version bump that grants an agent the network is a different event from one that does not, and one that adds an instruction to conceal activity is different again. New findings since the version you approved block an update; ones you already accepted do not ask twice.
• Secrets off disk. Tokens live in your OS keychain and are injected when the server launches, so they never sit in a file you could commit, back up or screen-share.
• Exact uninstall. Driven by a receipt of what was written, never by pattern-matching. Your own entries and comments survive — and so does your formatting: install then remove returns a config to its original bytes, which is enforced by a test.

Verifying this release

cosign verify-blob checksums.txt \
  --signature checksums.txt.sig --certificate checksums.txt.pem \
  --certificate-identity-regexp 'https://github.com/agentbridgehq/agentbridge/.github/workflows/release.yml@.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

gh attestation verify agentbridge_0.1.0_darwin_arm64.tar.gz --repo agentbridgehq/agentbridge

Every artifact also ships an SBOM. Only the checksum file is signed — verifying it transitively covers everything it lists.

Known gaps

Stated plainly, because a tool that argues about provenance should not overstate its own:

• brew and npm do not work yet. Homebrew and Scoop publishing stay disabled until those tap repositories exist; the npm name is not yet registered. install.sh is the supported path.
• Two clients have been independently measured, four have not. Codex reports an installed server as enabled, and opencode reports one as connected and lists the installed skills — their own tooling answering, not ours. Cursor and VS Code are desktop applications with no equivalent read-back, so what we write there matches their published schemas and is unconfirmed.
• Plugin signatures do not exist. These binaries are signed; a plugin's provenance is currently the commit or digest in your lockfile, which is real but is not a signature.

Nothing phones home. Every address the tool reaches is one you supplied — and that is enforced by a test, not promised. See docs/telemetry.md.

Start here: Getting started · Docs · CI integration