On this page
The coding agents AgentRoom drives
AgentRoom ships with four built-in coding agents and can register external ones over Agent Client Protocol. What each needs to be set up, and what each one loads from your workspace.
AgentRoom does not have its own coding agent. It drives agents that already exist, behind one adapter, so the client experience is the same whichever you pick.
Four are built in. External agents that speak Agent Client Protocol version 1 can also be registered, and that path ships switched off.
The four built-in agents
| Agent | How AgentRoom talks to it | What you need |
|---|---|---|
| Codex | Its app-server JSON-RPC interface, with the older command-line path kept as a fallback | A path to the executable, set in the Mac app |
| Claude Code | The Claude Agent SDK, holding one persistent session per AgentRoom thread | Your existing claude login on that Mac. A path is optional |
| DeepSeek Harness | The first-party SDK runtime over JSON-RPC | The SDK runtime, a composition that defines the agent's tools, and provider credentials |
| Cursor | The bundled Cursor SDK, running in a child process the backend spawns | A web sign-in through the SDK. Needs a Cursor Pro plan or better |
Two notes on that table that matter before you pick one.
Claude Code needs the least setup. It uses the login already on the Mac, so if you use Claude Code in a terminal on that machine, AgentRoom can use it too.
Cursor turns bill the account you sign in with. The Cursor SDK is bundled with AgentRoom, so there is nothing to install, but the work goes through your Cursor plan.
What each agent loads from your workspace
This is the part people skip and then get surprised by. Registering a folder with AgentRoom does not sandbox it. Each agent, once running inside that folder, reads that folder's own configuration exactly as it would if you had started it there yourself.
| Agent | Reads from the workspace |
|---|---|
| Codex | Its instructions file, repository skills, and its config file, including any MCP servers and hooks configured there |
| Claude Code | Project settings, hooks, MCP servers, skills, and its instructions file |
| DeepSeek Harness | Whatever the composition you supplied grants it |
| Cursor | Its hooks file, its MCP config, rules, and skills, unless you turn workspace settings off |
The practical consequence: pointing AgentRoom at a repository you did not write means letting that repository's agent configuration run. A hostile .mcp entry or hook in a cloned project is a hostile hook whether you started the agent from a terminal or from a headset.
Two further specifics worth knowing:
- Claude Code's default permission mode is not confined to the registered folder. It is the SDK's default, not something AgentRoom adds, and AgentRoom does not narrow it for you.
- A Cursor turn is sandboxed by default, but read it precisely. That sandbox bounds writes, to the workspace and a temporary directory, and it bounds network egress. It does not bound reads.
- A DeepSeek turn is bounded by the composition you supply, and AgentRoom cannot inspect that graph to tell you what it allows.
Trust and safety covers the rest of the posture, including the parts that are still sharp.
External agents
Any agent speaking Agent Client Protocol version 1 can be registered through a single adapter shared by all of them.
This path is disabled by default, and enabling it is deliberately two steps: switch it on, and name an admitted executable through environment configuration. That second step is the point. An agent executable is arbitrary code, so which executables are allowed is not something a connected client can decide for itself. It is set on the Mac, in the environment, where a bearer token does not reach.
Picking one
Clients fetch the agent list from the backend rather than keeping their own, so whichever agents you have configured are the ones that appear in the picker. An agent shows up in one of three states: registered, meaning AgentRoom knows about it; configured, meaning it has what it needs to run; and enabled. Those are kept separate on purpose, so a client cannot read one as another and offer you an agent that will fail on the first turn.
Next: trust and safety, or install AgentRoom.