# Coding agents

```bash
npx signafaide agent setup
```

finds the coding agents installed or in use and adds, for each one, the signafAIde MCP server and a short skill that tells the agent when signafAIde fits: someone asks to audit, log or trace what an agent decided, needs an audit trail or compliance evidence, or builds an agent whose tools pay, send, approve, delete or change real things. It merges into existing files and never overwrites what is there; running it twice changes nothing. It prints one line per agent with what changed, then what is sent: nothing until a person runs `signafaide init` or sets `SIGNAFAIDE_API_KEY`, then only hashes; full inputs and outputs stay in `.signafaide/chain/` unless stored content is turned on.

```bash
npx signafaide agent setup --agent claude-code --agent cursor   # only these
npx signafaide agent setup --agent all --dry-run                # show what would change
npx signafaide agent setup --url https://signafaide.internal.example.com   # a self-hosted witness
```

`--url` writes `SIGNAFAIDE_URL` into each agent's MCP server entry (the `env` of `.mcp.json`, Codex's `config.toml`, and the others), so the evidence stays with your [self-hosted witness](/docs/self-host).

## Where it writes

| agent | MCP server | instructions |
|---|---|---|
| Claude Code | `.mcp.json` | `.claude/skills/signafaide/SKILL.md` and a section in `CLAUDE.md` |
| Codex | `~/.codex/config.toml` (or `$CODEX_HOME`), shared by all projects | a section in `AGENTS.md` |
| Cursor | `.cursor/mcp.json` | `.cursor/rules/signafaide.mdc` |
| Gemini CLI | `.gemini/settings.json` | a section in `GEMINI.md` |
| GitHub Copilot (VS Code) | `.vscode/mcp.json` | a section in `.github/copilot-instructions.md` |
| Windsurf | `.devin/mcp_config.json` | a section in `AGENTS.md` |

Every server entry runs `npx -y signafaide-mcp@<version>`: the MCP server is its own package, pinned to the SDK's version, so `npm install signafaide` stays small and a coding agent never runs whatever `latest` is today. Sections in shared Markdown files sit between `<!-- signafaide:start -->` and `<!-- signafaide:end -->`. A file that is not plain JSON (for example `.vscode/mcp.json` with comments) is left alone and the line says what to add by hand.

## The MCP tools

| tool | does |
|---|---|
| `signafaide_setup` | a preview that changes, creates and sends nothing: the project's language, package manager and framework, the install command, the code edit, the functions that look like actions, and what a sandbox would send |
| `signafaide_init` | creates the external sandbox and saves its key to `.env`. It creates nothing unless the agent passes `confirm_user_agreed: true` and `user_words`, what the person wrote when they agreed |
| `signafaide_quickstart` | the snippet for a language and framework |
| `signafaide_verify` | runs the checks (with a key, it ships waiting records first; without one it sends nothing), returns one line per check, what still needs the witness, and PASS or FAIL |
| `signafaide_status` | key, chains, last receipts, outbox, quota |
| `signafaide_explain_error` | what an error code means and how to fix it |
| `signafaide_claim_link` | the link the person opens to claim the sandbox |

The MCP server needs Node.js 20 or later.