What changed

safetyClaudeCrush

Sensitive skills can be manual-only

Claude and Crush now share the same meaning for disable-model-invocation: true. It prevents the model from choosing a skill while letting users invoke it explicitly. agnostic-ai can preserve it through tool-specific fields today, but has no shared field for it.

Vendor evidence. Claude says, "Only you can invoke the skill." Claude skills. Crush says these skills "can still be invoked manually by users." Crush repository.

Repository evidence. The shared spec entry has no portable invocation field. Target extensions carry the value instead.

least privilegeQoderFactoryOpenHands

Each agent can have its own MCP access {#mcp-access-is-moving-inside-the-agent-boundary}

Three tools can narrow MCP access for an individual agent. Qoder accepts names or inline definitions, Factory uses a list of allowed server names, and OpenHands uses server definitions inside the agent file. They share a goal, but agnostic-ai has no common configuration format for it.

Vendor evidence. Qoder supports "MCP servers" inside task-specific agent configuration. Qoder subagents. Factory says, "Use mcpServers to limit which MCP servers a droid can reach." Factory subagents. OpenHands says file-based agents can define "MCP server configurations inline." OpenHands agents.

Repository evidence. agnostic-ai models agents through the same generic entry. Qoder writes the tool-specific field, Factory accepts tool-specific fields, and OpenHands cannot write agent files. There is no shared field for which MCP servers an agent can access.

contextCodexCursor

A skill's directory now changes where it applies

Codex scans nested skill directories from the working directory to the repository root. Cursor says nested skills are scoped to files inside their directory. Both agnostic-ai adapters move directory-specific skills to the project root today.

Vendor evidence. Codex scans "every directory from your current working directory up to the repository root." Codex skills. Cursor says nested skills are "automatically scoped to files inside that directory." Cursor skills.

Repository evidence. Both Codex and Cursor build the destination from the root skills directory and the skill name, without the source scope.

ecosystemClineAmpWindsurfOpenCodeJunie

Project plugins still need tool-specific setup {#project-plugins-are-becoming-normal-not-portable}

Five tools now expose project extensions or plugins. Some copy executable code, some install package references, and some apply repository policy. agnostic-ai should represent the shared workflow only after defining which tool manages each plugin and what access it gets.

Vendor evidence. Cline supports plugins "per-project." Cline plugins. Amp says project plugins "apply when you run Amp in that project." Amp plugins. Windsurf stores required and optional plugin policy in repository configuration. Windsurf plugins. OpenCode calls .opencode/plugins/ its "Project-level plugins" directory. OpenCode plugins. Junie describes extensions as "reusable bundles" for project-specific capabilities. Junie extensions.

Repository evidence. The ten shared source types do not include a plugin or extension bundle. Adding one before those access rules are clear would hide meaningful differences.

Why it matters

A manual-only flag controls whether a model can start sensitive work. Agent-specific MCP access controls which systems and data a delegated agent can reach. A skill's directory decides whether its instructions apply only there.

Vendors are moving more team policy into project files, but each uses different paths, allowed fields, defaults, and access rules. A portable setup needs to keep the common intent while showing how tools differ.

Where agnostic-ai is now

Manual-only skills work through tool-specific fields. Qoder can preserve each agent's MCP access through tool-specific fields, Factory needs a target-specific field, and OpenHands cannot write agent files. Codex and Cursor currently lose directory limits when writing skills. Project plugins have no shared spec kind.

What happens next

Fix confirmed loss

Decide the shared fields

Audit details

All confirmed target gaps
  • Claude drops continueOnBlock from prompt hooks.
  • Codex and Cursor flatten directory-specific skills.
  • Copilot drops HTTP hook handlers. This stays in the shared hooks issue.
  • Amp orb setup, resume, and services still need shared setup, resume, and service fields.
  • OpenCode and Junie omit project default model settings.
  • Kiro strips explicit custom-agent display names.
  • Augment omits project indexing exclusions.
  • Factory writes an undocumented ws MCP transport.
Clean targets and research limits

No confirmed differences between documented behavior and generated or imported files were found for Gemini, Aider, Cline, Windsurf, Continue, Zed, Warp, Antigravity, Crush, Trae, Jules, Goose, Qoder, OpenHands, or Kilo in this pass.

Scheduled agents in Cline and Amp remain a watch item because schedules persist outside the repository. Augment's project trust behavior also needs runtime or vendor confirmation before it becomes implementation work. Kilo's shared agent board remains experimental.

Method and evidence standard

Every confirmed finding requires a direct vendor source, an exact documented behavior, and the repository line that contradicts it. Cross-target proposals require independent evidence for every target and a representation check against the current spec and tool-specific fields.

This audit covered all 25 registered targets using changes since 13 September 2026 as the initial window. The audit also checked documented behavior when a new feature exposed an older gap.

Second review: not requested. No secondary model result influenced these conclusions.