AgentGo

What AgentGo does

AgentGo MCP server lets an MCP-connected assistant inspect approved project workspaces and delegate coding tasks to Codex or Claude Code running on the same computer. The agents use the local files, logins, and Git credentials available to the user. AgentGo does not request API keys; it relies on the existing CLI installations and their authenticated sessions.

Workspaces are explicitly added by folder or as individual paths. A folder-based workspace configuration turns each eligible child folder into a separate project, while hidden directories are skipped. Workspace changes take effect on subsequent requests without restarting the server.

How it works

For remote access, AgentGo starts an MCP endpoint behind a Cloudflare tunnel and prints the endpoint URL plus an Authorization bearer value. The default Quick Tunnel does not require a Cloudflare account, but its address can change after a restart or reconnection. A fixed Cloudflare hostname or a user-managed tunnel can be configured instead.

For local clients, AgentGo can run as a stdio MCP process. This mode avoids the tunnel and password, but active runs end if the client closes the process. The background server and stdio mode cannot share a state directory at the same time unless separate directories are assigned.

Starting an agent run returns task and session identifiers immediately. The client can poll status, retrieve output, cancel the task, list historical runs, or send a follow-up prompt to the same session.

Setup and configuration

AgentGo requires macOS or Linux, Node.js 24.13 or newer, and at least one of the codex and claude commands installed and logged in. ripgrep must be available on PATH for file search tools. A cloudflared installation is needed for tunnel mode; AgentGo can download the official release when started with the relevant approval option.

Install the package globally, then run the diagnostic command to check agent, search, and tunnel dependencies. Add workspaces with the workspace commands before starting the daemon. The first background start creates a password, which can later be replaced with the token rotation command. status, stop, and restart manage the background process, and --json makes command output suitable for scripts.

The server can listen locally without a tunnel, use a Cloudflare Quick Tunnel, use a custom Cloudflare-managed domain, or connect to a tunnel token supplied in a file. A custom state directory is available for stdio mode.

Tools and capabilities

The AgentGo MCP server provides 13 tools in two groups:

• Workspace inspection: listWorkspaces, listDirectory, readFile, globFiles, and grepFiles.
• Agent operations: getAgentCapabilities, getSupportedModels, startAgentRun, getAgentRunStatus, getAgentRunOutput, listAgentRuns, cancelAgentRun, and continueAgentSession.

The inspection tools can list directories, read text files, find paths by pattern, and search file contents with ripgrep. Agent tools expose installed providers, supported models and options, asynchronous run state, output, cancellation, and follow-up prompts. An idempotency key can be supplied when creating a run.

Limitations and notes

AgentGo MCP server gives remote clients access to agents running with the user's permissions. Codex uses its workspace-write sandbox and automatic review, while Claude Code runs in automatic mode with permission prompts disabled. Neither agent has a person available to answer an interactive question; a Codex run that requires input fails with INPUT_REQUIRED.

The browsing tools stay within the selected workspace, do not follow symlinks, and block sensitive paths and files such as .env, .ssh, .aws, .git, .npmrc, and private keys. Searches operate on one workspace at a time, follow .gitignore, skip hidden files and common dependency or build directories, and are limited to 100,000 files. Agents may have broader access subject to their own sandbox and review rules.

Stopping the server interrupts active runs. Changes already made by an agent remain, and interrupted work is not automatically resumed. Anyone with the AgentGo password can invoke the available agent actions, so the password and workspace selection require careful access control.