Supported agents
Every agent Pushary supports, how it connects, and what it can enforce
Every agent can send you notifications and ask you questions. The difference is whether Pushary can enforce approvals (stop an action until you say yes) or only cooperate (the agent chooses when to ask).
This table is generated from the shared Pushary agent manifest. Update it with bun run --cwd packages/contracts gen:agents-docs.
| Agent | How it connects | Enforced approvals | Notifications | Setup |
|---|---|---|---|---|
| Claude Code | Native hooks + MCP | Shell, writes and edits, subject to Claude Code permission mode and explicit policy. | Yes | npx @pushary/agent-hooks setup, pick Claude Code |
| Codex | Native hooks + MCP | Shell and apply_patch edits through native permission hooks; requires a compatible Codex runtime. | Yes | npx @pushary/agent-hooks setup, pick Codex |
| Gemini CLI | Native hooks + MCP | Shell, writes and edits through native BeforeTool hooks. | Yes | npx @pushary/agent-hooks setup, pick Gemini CLI |
| Hermes | Native Python plugin + approval transport | Hermes dangerous-command approvals when the Pushary transport is selected; optional PUSHARY_GATE_TOOLS gates named tools. | Yes | npx @pushary/agent-hooks setup, pick Hermes |
| Cursor | Editor plugin hooks + MCP | With installed hooks: shell, MCP execution and Write/Delete/Edit tool calls. Plain MCP remains cooperative. | Yes | npx @pushary/agent-hooks setup, pick Cursor |
| VS Code | Agent plugin hooks + MCP | PreToolUse approval hooks from the installed agent plugin; the host decides which events it exposes. | Yes | npx @pushary/agent-hooks setup, pick VS Code |
| OpenCode | Generated plugin + MCP | Shell, writes, edits and web fetches when OpenCode itself asks for permission. | Yes | npx @pushary/agent-hooks setup, pick OpenCode |
| Claude Chat | Custom MCP connector | Cooperative. The agent chooses when to ask; no native permission interception. | Yes | Claude.ai and Claude Desktop setup |
| Claude Cowork | Custom MCP connector + optional Cowork skill | Pushary’s Cowork connector is cooperative: Claude chooses when to ask. It does not intercept Claude’s native permission prompts or start new Cowork tasks. | Yes | Cowork setup |
| ChatGPT | Custom MCP connector | Cooperative. The agent chooses when to ask; no native permission interception. | Yes | ChatGPT setup |
| Windsurf | Plain MCP | Cooperative. The agent chooses when to ask; no native permission interception. | Yes | npx @pushary/agent-hooks setup, pick Other |
| Lovable | Plain MCP | Cooperative. The agent chooses when to ask; no native permission interception. | Yes | Lovable setup |
| Any MCP client | Plain MCP | Cooperative. The agent chooses when to ask; no native permission interception. | Yes | npx @pushary/agent-hooks setup, pick Other |
| No-code and HTTP | REST with a Bearer token | Cooperative. The agent chooses when to ask; no native permission interception. | Yes | Connect any agent |
- Hermes: Uses the Python plugin, not a macOS bridge HookSource. CLI disconnect and managed-provider controls are not implemented for Hermes.
- VS Code: Has both a bridge HookSource and a per-agent policy profile. CLI disconnect and managed-provider controls are not implemented for VS Code.
For an unsupported or omitted policy-agent name, the API returns resolvedAgent: "*". This reports the selected agent scope; preset loading still falls back to an all-agents preset or built-in defaults when no matching preset exists. Integration capabilities do not prove that this installation or its phone route has been verified.
A few notes from the details:
- Enforced vs cooperative. Enforced means the agent is physically stopped until you approve. Cooperative means the agent decides whether to ask, so it might not. The generated table lists each integration’s enforcement boundary.
- What "hooks" are. Hooks let Pushary step in before an agent runs an action. Agents without hooks (plain MCP, Windsurf, no-code) get notifications and questions only.
- Claude Code's own permission mode wins. In
plan,autoanddontAsk, Claude Code has already decided how it handles permissions, and Pushary steps out of the way rather than asking on top of it.acceptEditsis the same for writes and edits, while shell commands still gate. This is deliberate: hooks run before Claude's own prompt, so gating in those modes would ask you twice for one action, or contradict a choice you just made. A kill switch and any rule you wrote yourself are still honoured in every mode, because those are instructions you already gave. SetPUSHARY_RESPECT_PERMISSION_MODE=0to gate in every mode regardless. - OpenCode follows its own permission rules. OpenCode decides which actions need a decision, and Pushary answers the ones it raises. If your
opencode.jsonalready allows a tool outright, OpenCode never asks anybody — Pushary included. Set that tool back toaskin OpenCode and the approval reaches your phone. - Same agent tools everywhere. Every MCP integration exposes
send_notification,ask_user,propose_scope,wait_for_answerandcancel_question. What differs is the key. A full API key from the CLI setup also getslist_sessionsand the push platform tools (subscribers, campaigns, templates, flows). A connector link is deliberately limited to the five agent tools, so Claude and ChatGPT are not offered twenty tools that would only refuse them. See the tools reference.
I want to...
| Goal | Where to go |
|---|---|
| Get pinged when my agent finishes | Receiving notifications |
| Approve risky commands before they run | Permission policies |
| Answer my agent's questions from my phone | Human in the loop |
| Stop everything right now | Kill switch |
| See what my agents did | Audit log |
| Connect a tool not listed above | Connect any agent |
Was this page helpful?