Developer plova_rama has released agentbelt, an open-source Model Context Protocol (MCP) server designed to provide a unified, safe tooling layer for multiple AI coding assistants. The tool addresses a critical fragmentation issue in the current AI development landscape, where assistants like Claude Code, Codex, Cursor, VS Code, DeepSeek, and LM Studio each implement different configuration files, permission models, and safety constraints for basic operations like running tests or modifying git states.

The Fragmentation Problem

The core motivation behind agentbelt is the inconsistency developers face when switching between AI apps. Each assistant reinvents the wheel for common tasks, leading to lost workflows and increased risk. As the author notes, when an assistant executes a dangerous command like git reset --hard, relying on the model's intent is insufficient. Agentbelt acts as a separate program that provides these tools, ensuring that the AI app brings the model while agentbelt brings the consistent, audited tooling.

Safety by Design, Not by Prompt

Agentbelt enforces safety through a strict broker system rather than relying on prompt engineering. Plugins never run commands directly; instead, every action is checked against declared permissions and a core policy that restricts shell access, limits allowed subcommands, and prevents path traversal outside the project directory. Git operations are isolated to specific task branches (e.g., agentbelt/) with commits allowed but pushes, resets, rebases, and cleanups explicitly blocked. This architectural choice ensures that even if a model is manipulated or confused, it cannot execute destructive actions without explicit, human-approved workflows.

Verified Compatibility and Audit Trails

The project distinguishes itself by verifying compatibility through real-world usage rather than theoretical support. An app is only considered supported if it successfully makes real tool calls that appear in agentbelt’s audit log, stored in .agentbelt/audit.jsonl with secrets redacted. This testing process uncovered specific integration quirks, such as DeepSeek Harness not sharing the project context by default and Cursor failing to resolve ${workspaceFolder} in global configs. The tool also employs honest labeling, distinguishing between policy-only built-in tools and third-party plugins that require OS-level sandboxing via sandbox-exec or bubblewrap to run.

Key Takeaways

  • Agentbelt provides a shared MCP server for git, testing, and workflow management across six major AI coding assistants.
  • Safety is enforced via a broker system that blocks destructive git commands and restricts file system access.
  • Human approval for critical workflows is isolated to the terminal, preventing the AI from approving its own actions.
  • Compatibility is verified through real tool call logs, ensuring that support claims are backed by actual usage data.

The Bottom Line

Agentbelt is a necessary infrastructure layer for serious AI-assisted development, replacing fragile prompt-based safety with deterministic, auditable tooling. It transforms the chaotic landscape of individual AI app configurations into a standardized, secure workflow that developers can actually trust.