amicus

Give your coding agent a second opinion from a different model.

amicus is one MCP server that fronts Codex, Kimi and Claude. The backend is a parameter, not a separate installation — so instead of running three servers and learning three tool surfaces, you ask for a consult, a review, or a delegated task and say which model should answer.

• Consult — a read-only second opinion on an approach, a bug, or a design.
• Review — a structured review of changes gathered from git, with findings tied to evidence.
• Delegate — a task implemented in a throwaway git worktree, returned as a diff you review. It is never applied to your working tree.
• Adversarial review — a fixed critic aimed at a plan, claim, or decision.

Long-running calls can be started in the background and polled, so a broad review does not block your session.

Install

Claude Code

/plugin marketplace add briandconnelly/amicus
/plugin install amicus@amicus

Codex

codex plugin marketplace add briandconnelly/amicus
codex plugin add amicus@amicus

Start a new session afterwards so the host loads the bundled skill and tools.

Any other MCP client

The plugins launch the server from a published release tag, pinned in .mcp.json. Point your client at the same command:

{
  "mcpServers": {
    "amicus": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/briandconnelly/amicus.git@v0.9.0", "amicus-mcp"]
    }
  }
}

Environment variables go wherever your client sets them for a stdio server (most accept an "env" object beside "command"; check your client's documentation). A first session from a client that has no notion of a working directory looks like this:

1. Set AMICUS_BACKENDS to the backends you have installed and logged in to.
2. Call amicus_backends with detail: "full". It is free, and it reports each enabled backend's installed and authenticated state plus the disclosures you should read before spending; a backend you did not enable is listed with status: null.
3. Call amicus_consult with backend, question and an absolute workspace_root. Every paid tool needs workspace_root from such a client; the three free discovery tools reject it.
4. If a result has ok: false, branch on error.code and, when present, follow error.repair: its next_step says what to do, and when one call recovers, its tool and arguments name that call.

Requirements

• macOS or Linux: amicus refuses to start on a non-POSIX platform, because its background-job safety layer depends on POSIX process semantics.
• Python 3.11 or newer, and uv.
• The CLI for each backend you enable, installed and authenticated: codex, kimi, claude. amicus drives those CLIs; it does not talk to the providers itself, and it stores no credentials.

Using it

Choose which backends are available with AMICUS_BACKENDS — a comma-separated list of codex, kimi and claude (case-sensitive). Unset, all three are enabled; set, only the backends you name are. An enabled backend whose CLI is missing or not logged in still appears in amicus_backends, with status.installed and status.authenticated saying so.

Then just ask, in your own words:

• "Get a second opinion on this approach from another model."
• "Have another model review my current changes."
• "Delegate this task to another model and show me the proposed diff."

In Claude Code there are also slash commands:

Start with /amicus:status — it tells you which backends are actually usable before you spend anything.

The tools

Eighteen tools, in five groups. Discovery, previews and job management are free; the verbs and their background twins invoke the selected backend and spend its quota.

Not every backend does everything:

A no is amicus's routing policy, not a model limitation. Claude is review-only, and the dedicated adversarial-review verb is scoped to Claude. To ask Codex or Kimi for an adversarial review, use consult or review_changes and supply the stance yourself; the dedicated verb adds a fixed critic stance and the target and evidence inputs.

Asking a tool for a backend outside its backend enum, in-tree or not, is rejected before any spend as an invalid_arguments error whose details.allowed_values lists the backends that tool accepts (the enum is that set). feature_unsupported is only a defensive check: it is returned if the named backend's declared features lack the verb, which no backend a tool's enum accepts does today.

Safety

• A delegated diff is never applied. It runs in a throwaway git worktree and comes back for you to read and apply yourself.
• Every verb call spends the selected backend's quota. The dry runs and the discovery and job tools do not.
• Enabling a backend that can write makes the tool surface carry that backend's approval annotations — see docs/MIGRATION.md.
• Your prompts go to whichever provider you selected, through that provider's own CLI. Each backend discloses how it carries your text — visible on amicus_backends.
• A paid call's whole answer stays on disk in the job record under AMICUS_STATE_DIR, whatever detail delivered it and after only best-effort secret redaction, until it expires (AMICUS_JOB_TTL, default 24h; an expired record is removed on a later job call, not by a daemon), amicus_job_consume_result removes it or, once amicus has returned it, the per-workspace cap evicts it. The cap never evicts a result nobody has fetched that was recorded since delivery tracking (#244), whichever release recorded it. When only running jobs and such results remain, a new paid call is refused with job_cap_reached instead (ADR 0038). It can quote what you sent. Your inputs themselves are never written there (ADR 0035).
• Kimi keeps its own copy. The kimi CLI writes its own session files (observed under ~/.kimi-code/sessions), which can hold the whole prompt and any answer produced. amicus found no documented way to switch that off and does not delete them, and none of the retention controls above reach it; Codex and Claude run with their session persistence disabled.

Configuration

AMICUS_BACKENDS is the one most people set. Beyond it, each backend takes an optional model, reasoning effort, and binary path (AMICUS_CODEX_MODEL, AMICUS_KIMI_REASONING_EFFORT, AMICUS_CLAUDE_BIN, and so on), and there are limits for timeouts, job retention and payload sizes. Every variable, what it does and its default is in docs/CONFIGURATION.md, rendered from the declarations in the code.

Logging goes to stderr, and AMICUS_LOG_FILE mirrors amicus's own records to a file. To reduce the risk of prompt text leaking through dependency logs, fastmcp and mcp records are limited to WARNING or higher on stderr, reduced to non-message diagnostics, and never written to that file (ADR 0023).

Coming from codex-in-claude, moonbridge, or claude-in-codex

amicus replaces all three. docs/MIGRATION.md maps the old tool names onto the new ones.

Status and known limits

0.9.0 is the current release. The discovery surface moves from amicus/0.1/schema-53 to amicus/0.1/schema-55 and RESULT_FORMAT did not move, so a job result 0.8.1 stored can still be read. No tool call 0.8.1 accepted is rejected, but an explicit AMICUS_BACKENDS that names no backend now stops the server from starting instead of enabling all three. An unstructured review carries its answer at either detail, so the default consume no longer deletes the only copy; amicus_capabilities names where a defect in amicus is reported; and codex-cli 0.161 is a supported version. docs/MIGRATION.md explains how to upgrade, and CHANGELOG.md lists every user-visible change.

One known limit: a third-party backend distribution can load through the amicus.backends entry-point group, but cannot yet be enabled or called. AMICUS_BACKENDS and the backend parameter accept only the three in-tree ids.

Development

uv sync
uv run prek install --prepare-hooks   # one-time local hooks

The gate is defined once, in AGENTS.md (Rules, item 2); CI runs it on every supported Python version.

License

MIT. See LICENSE.