What changed

safetyClaudeCrush

Sensitive skills can be manual-only

Claude and Crush now share the same disable-model-invocation: true contract. It prevents the model from choosing a skill while keeping explicit user invocation available. agnostic-ai can preserve it through target extensions today, but cannot state the safety intent once.

Vendor evidence. Claude says, "Only you can invoke the skill." Claude skills. Crush says these skills "can still be invoked manually by users." Crush repository.

Repository evidence. The shared spec entry has no portable invocation field. Target extensions carry the value instead.

least privilegeQoderFactoryOpenHands

MCP access is moving inside the agent boundary

Three tools can narrow MCP access for an individual agent. Qoder accepts names or inline definitions, Factory uses a server-name allowlist, and OpenHands uses an inline server map. The shared goal is clear, but the portable shape is not.

Vendor evidence. Qoder supports "MCP servers" inside task-specific agent configuration. Qoder subagents. Factory says, "Use mcpServers to limit which MCP servers a droid can reach." Factory subagents. OpenHands says file-based agents can define "MCP server configurations inline." OpenHands agents.

Repository evidence. agnostic-ai models agents through the same generic entry. Qoder has a native mapping, Factory accepts target-specific metadata, and OpenHands has no agent emitter. There is no shared agent-to-MCP contract.

contextCodexCursor

A skill's directory now changes where it applies

Codex scans nested skill directories from the working directory to the repository root. Cursor says nested skills are scoped to files inside their directory. Both agnostic-ai adapters flatten scoped skills to the root today.

Vendor evidence. Codex scans "every directory from your current working directory up to the repository root." Codex skills. Cursor says nested skills are "automatically scoped to files inside that directory." Cursor skills.

Repository evidence. Both Codex and Cursor build the destination from the root skills directory and the skill name, without the source scope.

ecosystemClineAmpWindsurfOpenCodeJunie

Project plugins are becoming normal, not portable

Five tools now expose project extensions or plugins. Some copy executable code, some install package references, and some apply repository policy. agnostic-ai should represent the shared workflow only after it defines ownership and trust.

Vendor evidence. Cline supports plugins "per-project." Cline plugins. Amp says project plugins "apply when you run Amp in that project." Amp plugins. Windsurf stores required and optional plugin policy in repository configuration. Windsurf plugins. OpenCode calls .opencode/plugins/ its "Project-level plugins" directory. OpenCode plugins. Junie describes extensions as "reusable bundles" for project-specific capabilities. Junie extensions.

Repository evidence. The ten shared spec kinds do not include a plugin or extension bundle. Adding one before the trust model is clear would hide meaningful differences.

Why it matters

These are not cosmetic additions. A manual-only flag controls whether a model can start sensitive work. Agent-scoped MCP controls which systems and data a delegated agent can reach. Directory scope decides whether local instructions stay local.

The same pattern appears across the ecosystem. Vendors are moving more team policy into project files, but each uses a different path, schema, default, and trust boundary. A portable setup needs to keep the common intent while making native differences visible.

Where agnostic-ai is now

Manual-only skills work through target extensions. Qoder can preserve agent-scoped MCP through native agent metadata, Factory needs a target-specific field, and OpenHands has no file-agent emitter. Codex and Cursor currently lose directory scope when emitting skills. Project plugins have no shared spec kind.

These are audit observations, not shipped support. The target reference and release changelog remain the source of truth for what works today.

What happens next

Fix confirmed loss

Decide the portable contract

Audit details

All confirmed target gaps
  • Claude drops continueOnBlock from prompt hooks.
  • Codex and Cursor flatten directory-scoped skills.
  • Copilot drops HTTP hook handlers. This stays in the shared hooks issue.
  • Amp orb setup, resume, and services still need a lifecycle mapping.
  • OpenCode and Junie omit project default model settings.
  • Kiro strips explicit custom-agent display names.
  • Augment omits project indexing exclusions.
  • Factory emits an undocumented ws MCP transport.
Clean targets and research limits

No confirmed emitter or importer drift was found for Gemini, Aider, Cline, Windsurf, Continue, Zed, Warp, Antigravity, Crush, Trae, Jules, Goose, Qoder, OpenHands, or Kilo in this pass.

Scheduled agents in Cline and Amp remain a watch item because schedules persist outside the repository. Augment's project trust behavior also needs runtime or vendor confirmation before it becomes implementation work. Kilo's shared agent board remains experimental.

Method and evidence standard

Every confirmed finding requires a direct vendor source, an exact documented behavior, and the repository line that contradicts it. Cross-target proposals require independent evidence for every target and a representation check against the current spec and target extensions.

This audit covered all 25 registered targets using changes since 13 September 2026 as the initial window. The audit also checked current contracts when a new surface exposed an older gap. A separate model challenge was not requested.

Challenger: not requested. No secondary model result influenced these conclusions.