Coding agents
npx signafaide agent setupfinds the coding agents installed or in use and adds, for each one, the signafAIde MCP server and a short skill that tells the agent when signafAIde fits: someone asks to audit, log or trace what an agent decided, needs an audit trail or compliance evidence, or builds an agent whose tools pay, send, approve, delete or change real things. It merges into existing files and never overwrites what is there; running it twice changes nothing. It prints one line per agent with what changed, then what is sent: nothing until a person runs signafaide init or sets SIGNAFAIDE_API_KEY, then only hashes; full inputs and outputs stay in .signafaide/chain/ unless stored content is turned on.
npx signafaide agent setup --agent claude-code --agent cursor # only these
npx signafaide agent setup --agent all --dry-run # show what would change
npx signafaide agent setup --url https://signafaide.internal.example.com # a self-hosted witness--url writes SIGNAFAIDE_URL into each agent's MCP server entry (the env of .mcp.json, Codex's config.toml, and the others), so the evidence stays with your self-hosted witness.
Where it writes #
| agent | MCP server | instructions |
|---|---|---|
| Claude Code | .mcp.json | .claude/skills/signafaide/SKILL.md and a section in CLAUDE.md |
| Codex | ~/.codex/config.toml (or $CODEX_HOME), shared by all projects | a section in AGENTS.md |
| Cursor | .cursor/mcp.json | .cursor/rules/signafaide.mdc |
| Gemini CLI | .gemini/settings.json | a section in GEMINI.md |
| GitHub Copilot (VS Code) | .vscode/mcp.json | a section in .github/copilot-instructions.md |
| Windsurf | .devin/mcp_config.json | a section in AGENTS.md |
Every server entry runs npx -y signafaide-mcp@<version>: the MCP server is its own package, pinned to the SDK's version, so npm install signafaide stays small and a coding agent never runs whatever latest is today. Sections in shared Markdown files sit between <!-- signafaide:start --> and <!-- signafaide:end -->. A file that is not plain JSON (for example .vscode/mcp.json with comments) is left alone and the line says what to add by hand.
The MCP tools #
| tool | does |
|---|---|
signafaide_setup | a preview that changes, creates and sends nothing: the project's language, package manager and framework, the install command, the code edit, the functions that look like actions, and what a sandbox would send |
signafaide_init | creates the external sandbox and saves its key to .env. It creates nothing unless the agent passes confirm_user_agreed: true and user_words, what the person wrote when they agreed |
signafaide_quickstart | the snippet for a language and framework |
signafaide_verify | runs the checks (with a key, it ships waiting records first; without one it sends nothing), returns one line per check, what still needs the witness, and PASS or FAIL |
signafaide_status | key, chains, last receipts, outbox, quota |
signafaide_explain_error | what an error code means and how to fix it |
signafaide_claim_link | the link the person opens to claim the sandbox |
The MCP server needs Node.js 20 or later.