Supported agents

Pushary works with Claude Code, Codex, Gemini CLI, Cursor, Hermes, ChatGPT, Claude and any MCP client. Every agent can send you push notifications and ask you questions. The table shows which agents Pushary can also enforce, meaning the action stops until you approve it, and which only cooperate, meaning the agent decides when to ask.

Most agents in the table set up with one command:

npx pushary@latest setup

This table is generated from the shared Pushary agent manifest. Update it with bun run --cwd packages/contracts gen:agents-docs.

• Hermes: Uses the Pushary plugin in ~/.hermes/plugins/pushary, not a macOS bridge HookSource. CLI disconnect and managed-provider controls are not implemented for Hermes.
• VS Code: Has both a bridge HookSource and a per-agent policy profile. CLI disconnect and managed-provider controls are not implemented for VS Code.
• Qoder: Qoder documents no user-level instructions file, so the proactive-ask block is not installed. Hooks and MCP are unaffected.
• Droid: Droid registers MCP servers through droid mcp add rather than a documented remote-server config shape, so setup writes hooks only. Add Pushary's MCP server yourself to let Droid send notifications and ask questions.
• Devin CLI: Devin CLI answers PreToolUse with {decision} rather than a permission decision. Pushary blocks an unanswered approval because this adapter cannot request a native prompt reliably. Question and plan dialogs remain with Devin; this adapter does not render their answers. It also fires no Notification event.
• Antigravity CLI: Antigravity CLI ignores a hook's allow unless it runs in always-proceed mode, so connecting it sets toolPermission: "always-proceed" when you never chose a mode, and disconnecting puts it back. Pushary is then the only gate: it answers allow or deny and never ask, and a call it cannot decide, one nobody answers, or one made after Pushary was removed is blocked with a reason.
• Grok Build: Grok fails open if it kills a hook or cannot run it. Setup leaves Grok's permission mode unchanged. Native question and plan dialogs stay in Grok; proactive phone questions use Pushary MCP.
• fx: fx has no hooks that other tools can register, so Pushary cannot answer fx's own approval prompts. Setup turns off fx's terminal question tool so fx's agent asks through Pushary. fx's full-access mode ignores that setting; there the agent is only instructed to ask through Pushary.
• Cline: Setup writes the Pushary server, with your key, into Cline's shared MCP settings and a global rule that tells Cline to ask and notify through Pushary. Cline's own approval prompts stay in VS Code. Auto-approving MCP servers in Cline lets Pushary calls run without a click there, and it applies to every MCP server Cline has, not only Pushary.
• Grok Bot: Grok Bot keeps its own approval cards, and Pushary cannot stop a Bot in the middle of a task. A question nobody answers expires after about ten minutes and is never treated as a yes.

For an unsupported or omitted policy-agent name, the API returns resolvedAgent: "*". This reports the selected agent scope; preset loading still falls back to an all-agents preset or built-in defaults when no matching preset exists. Integration capabilities do not prove that this installation or its phone route has been verified.

Enforced or cooperative: what is the difference?

Enforced means the agent cannot run the action until you approve it. Cooperative means the agent decides whether to ask, so it might not. The table above lists the exact enforcement boundary for each integration.

What are hooks?

A hook is a small program the agent runs before it uses a tool. Pushary's hook checks your policy and, when needed, holds the action until you answer on your phone. Agents without hooks (plain MCP, Windsurf, no-code tools) get notifications and questions only.

Why does Pushary not ask in some Claude Code permission modes?

Claude Code's own permission mode wins. In plan, auto and dontAsk, Claude Code has already decided how it handles permissions, so Pushary steps aside instead of asking on top of it. In acceptEdits, writes and edits are left to Claude Code, and shell commands still go through Pushary.

Hooks run before Claude Code's own prompt. Asking in those modes would ask you twice for one action, or contradict the mode you picked.

Some things still apply in every mode: the kill switch, any deny rule, and a scope you approved. Questions (AskUserQuestion) and plan approvals (ExitPlanMode) are still asked too. Set PUSHARY_RESPECT_PERMISSION_MODE=0 to have Pushary ask in every mode.

Which OpenCode versions work?

The generated plugin supports OpenCode V2 and the V1 compatibility entry introduced in 1.18.29. After updating Pushary, run setup again to replace the installed plugin. Existing MCP configuration can stay as it is; V2 reads the earlier format.

V2 approvals cover shell commands in the active working directory, single-file reads, writes and edits, and web fetches. Outside-directory access, another shell working directory, multi-file edits, renames with two paths, and custom permissions stay in OpenCode's native prompt. A phone answer grants one request, not a session-wide permission. Native questions also stay in OpenCode.

Why does OpenCode not ask me about some tools?

OpenCode decides which actions need a decision, and Pushary answers the ones it raises. Out of the box OpenCode runs shell commands, edits and web fetches without asking, so setup sets bash, edit and webfetch to ask under permission in opencode.json, but only for a tool no rule of yours names, and it puts them before your rules so yours still decide. If your opencode.json allows a tool outright, OpenCode never asks anybody, Pushary included. Set that tool back to ask and the approval reaches your phone. pushary doctor tells you which of the three OpenCode would run without asking.

Which tools does each key get?

Every MCP integration gets the same six agent tools: send_notification, ask_user, propose_scope, wait_for_answer, cancel_question and schedule_reminder. What differs is the key.

A key from setup or phone pairing also gets list_sessions. A key you create in Settings > API keys also gets the push platform tools (subscribers, campaigns, templates, flows). A connector link for Claude or ChatGPT gets only the six agent tools, so those apps are never offered tools that would only refuse them. See the tools reference for every argument.

Find the page for your goal

Next step