AgentsHow magus equips AI agents - the installable skills, the MAGUS.md routing index, the MCP server, and the guard hook any agent host can wire, with a setup page per host. Any other hostThe host-neutral contract - install the guidance where your host reads it, pipe the event to magus session hook, render the verdict with -o template - for an agent host magus does not document by name. Claude CodeWiring magus into Claude Code - skills in .claude/skills, the two PreToolUse guard hooks, attention notifications, and the checks that prove the guard is running. CodexWiring magus into Codex - skills in .agents/skills, the AGENTS.md block you paste, MCP in the user-level config, and the hooks that carry the guard, the checkpoint and the post-compaction brief. CursorWiring magus into Cursor - AGENTS.md for guidance, one self-contained hook script for all five of its events, and the one job Cursor's contract cannot express. Guard hook templatesThe hook templates Claude Code and Codex run for the magus guard, the checkpoint and the post-compaction brief, in POSIX sh and in Buzz - the variables that adapt them to a host, the version marker that tells you when your copy is stale, and the full source of each. Guard rulesEvery rule the guard enforces: what each one catches, whether it refuses or explains, and where the reasoning lives. MGS1045: a magus\guard.spawn, command or write registration is unusableFires when magus\guard.spawn, magus\guard.command or magus\guard.write is handed something other than a function, is called twice in one load, or is called from a magusfile other than the root one. The workspace does not load. MGS1046: a MAGUS_* environment variable that is provably wrongFires when the environment carries a MAGUS_* variable magus retired, or one a typo away from a variable magus reads. Every command stops before doing any work, and the magus shell guard denies, naming each variable with what to do instead. MGS3024: a hook names no agent hostInstalled hook glue called magus without --agent-name, so magus cannot tell which agent host it is answering. The call is refused, and `magus agent harness apply` rewrites a configuration that names the host. OpenCodeWiring magus into OpenCode - skills in .opencode/skills, the TypeScript plugin that carries both guard surfaces, the post-compaction brief, and the idle checkpoint. Session load adaptersPer-host adapters that turn an agent host's own session log into the magus session event contract, so an audit can ask which skills loaded, whether the guard fired, and what ran unjudged. The guardWhat magus session hook denies, what it explains, and why - the four deny triggers, the file-path surface, the verdict contract a host wires into, and the observations magus records. agent-sign-off: an agent stamping a read receipt or closing an attention request, which only a person may doA deny rule: it refuses an agent stamping a read receipt or closing an attention request, which only a person may do, and names what to run instead. backtick-substitution: a backtick command substitution, which inside double quotes runs a commandA deny rule: it refuses a backtick command substitution, which inside double quotes runs a command, and names what to run instead. brief-command: a spawn or continuation brief that teaches a command the guard deniesA deny rule: it refuses a spawn or continuation brief that teaches a command the guard denies, and names what to run instead. busy-wait: a loop polling for work you started, which announces its own completionA deny rule: it refuses a loop polling for work you started, which announces its own completion, and names what to run instead. buzz-unbriefed: the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skillA deny rule: it refuses the first Buzz a session authors, by file write or `magus buzz -e`, before reading the Buzz skill, and names what to run instead. cache-dir-write: a write into this checkout's magus cache dir, which magus alone ownsA deny rule: it refuses a write into this checkout's magus cache dir, which magus alone owns, and names what to run instead. capture-filter: a filter over a run capture or log, which cuts the failure block apartA deny rule: it refuses a filter over a run capture or log, which cuts the failure block apart, and names what to run instead. cd: a `cd` before a magus command, when the project is an argumentA deny rule: it refuses a `cd` before a magus command, when the project is an argument, and names what to run instead. chained-run: several magus runs chained on one line, where the dependency graph would have run themAn advisory: it explains, and blocks nothing, on several magus runs chained on one line, where the dependency graph would have run them. checkpoint-state: a command reaching for a tree's identity, which a revision alone cannot giveAn advisory: it explains, and blocks nothing, on a command reaching for a tree's identity, which a revision alone cannot give. claimed-declaration: a leased edit landing in a declaration another live job claims (`run.go#executeStages`)A deny rule: it refuses a leased edit landing in a declaration another live job claims (`run.go#executeStages`), and names what to run instead. credential-verb: an agent minting, printing, rotating or revoking a credential through the CLIA deny rule: it refuses an agent minting, printing, rotating or revoking a credential through the CLI, and names what to run instead. exit-status-echo: a line ending by printing an exit status, which the harness already reportsA deny rule: it refuses a line ending by printing an exit status, which the harness already reports, and names what to run instead. filter-without-input: a filter with no file, pipe or redirect, which reads a stdin nothing feedsA deny rule: it refuses a filter with no file, pipe or redirect, which reads a stdin nothing feeds, and names what to run instead. focus: a read or write outside the paths the running job declaredAn advisory: it explains, and blocks nothing, on a read or write outside the paths the running job declared. gate-repeat: the gate run again soon after it passed, repeating work already doneAn advisory: it explains, and blocks nothing, on the gate run again soon after it passed, repeating work already done. generated-write: a hand edit to a declared output, which the next run overwritesAn advisory: it explains, and blocks nothing, on a hand edit to a declared output, which the next run overwrites. graph-stale: a graph read while the index is older than the sources it describesAn advisory: it explains, and blocks nothing, on a graph read while the index is older than the sources it describes. hook-wiring: a write to the host wiring that decides whether these rules run at allAn advisory: it explains, and blocks nothing, on a write to the host wiring that decides whether these rules run at all. installed-skill: a write to an installed skill copy, which re-installing discardsAn advisory: it explains, and blocks nothing, on a write to an installed skill copy, which re-installing discards. interpreter-rewrite: an inline interpreter rewriting a file this tree already carriesA deny rule: it refuses an inline interpreter rewriting a file this tree already carries, and names what to run instead. lease-invalid: a call naming a lease this workspace's job store does not declareAn advisory: it explains, and blocks nothing, on a call naming a lease this workspace's job store does not declare. lease-terminal: a call naming a lease whose row has already finishedAn advisory: it explains, and blocks nothing, on a call naming a lease whose row has already finished. leased-path: a write into paths a running lease owns, by a caller that names no leaseAn advisory: it explains, and blocks nothing, on a write into paths a running lease owns, by a caller that names no lease. magus sessionOne family over the repository's session store: list what magus invocations ran and the host session each ran in, list the blocks agents raised, close one by hand, and take the host-hook ingest that writes it all. magus shellRead one shell command, or one path an edit is about to write, and report what this workspace would rather you ran. magus\guard.commandRegister one Buzz function the agent guard calls on every agent shell command, to add a deny or an advisory from your repository's own rules. magus ships the seam and no rules. magus\guard.spawnRegister one Buzz function the agent guard calls on every subagent spawn and continuation, to add a deny or an advisory from your own rules. magus ships the seam and no rules. memory-write: a write to a memory file, where the memory surface is the way inAn advisory: it explains, and blocks nothing, on a write to a memory file, where the memory surface is the way in. merge-side-checkout: a checkout of one merge side over a conflicted file, which discards the mergeA deny rule: it refuses a checkout of one merge side over a conflicted file, which discards the merge, and names what to run instead. new-file: a new file in a directory whose naming has settledAn advisory: it explains, and blocks nothing, on a new file in a directory whose naming has settled. new-source-dir: a new file that opens a directory, which is a boundary rather than a fileAn advisory: it explains, and blocks nothing, on a new file that opens a directory, which is a boundary rather than a file. notes-author: an agent authoring a human's note, whose only provenance is who wrote itA deny rule: it refuses an agent authoring a human's note, whose only provenance is who wrote it, and names what to run instead. output-pipe: magus output piped into a filter, when magus projects the record itselfA deny rule: it refuses magus output piped into a filter, when magus projects the record itself, and names what to run instead. output-redirect: magus output redirected to a file, which the run log already holdsA deny rule: it refuses magus output redirected to a file, which the run log already holds, and names what to run instead. precedent-search: a hunt for one distinctive name, which refs answers with verified sitesAn advisory: it explains, and blocks nothing, on a hunt for one distinctive name, which refs answers with verified sites. process-poll: a process table inspected to wait on magus work the lock already reportsA deny rule: it refuses a process table inspected to wait on magus work the lock already reports, and names what to run instead. push-gate: a push the run log does not prove ungated, which names the gate and lets it throughAn advisory: it explains, and blocks nothing, on a push the run log does not prove ungated, which names the gate and lets it through. push-ungated: a push at a commit with no green gate: the person is asked, a leased worker refusedA deny rule: it refuses a push at a commit with no green gate: the person is asked, a leased worker refused, and names what to run instead. raw-tool: a toolchain command a spell already wraps, run outside the cacheA deny rule: it refuses a toolchain command a spell already wraps, run outside the cache, and names what to run instead. regen-source: a hand edit to a file a target regeneratesAn advisory: it explains, and blocks nothing, on a hand edit to a file a target regenerates. revert-classify: a revert that has not classified what it is revertingAn advisory: it explains, and blocks nothing, on a revert that has not classified what it is reverting. scope-drift: a write into a project this session has no dependency edge toAn advisory: it explains, and blocks nothing, on a write into a project this session has no dependency edge to. scripted-rewrite: a scripted substitute-and-write, which cannot tell your symbol from a dependency'sA deny rule: it refuses a scripted substitute-and-write, which cannot tell your symbol from a dependency's, and names what to run instead. search-translation: a text search whose pattern a graph query provably answers with the same entitiesA deny rule: it refuses a text search whose pattern a graph query provably answers with the same entities, and names what to run instead. sed-in-place: `sed -i`, whose two spellings destroy each other's work across platformsA deny rule: it refuses `sed -i`, whose two spellings destroy each other's work across platforms, and names what to run instead. shared-stash: a bare stash push or pop, on a stack every worktree sharesA deny rule: it refuses a bare stash push or pop, on a stack every worktree shares, and names what to run instead. sibling-checkout: a magus command relocated into another checkout, judging a tree nobody shipsA deny rule: it refuses a magus command relocated into another checkout, judging a tree nobody ships, and names what to run instead. skill-source: a write to an installed skill copy rather than to its sourceAn advisory: it explains, and blocks nothing, on a write to an installed skill copy rather than to its source. source-read: an unbounded source read the symbol index has already answeredAn advisory: it explains, and blocks nothing, on an unbounded source read the symbol index has already answered. spawn-unbriefed: a subagent spawned before the multi-agent skill loadedA deny rule: it refuses a subagent spawned before the multi-agent skill loaded, and names what to run instead. split-run: the same target run again on a different project set, on one line or as a separate callAn advisory: it explains, and blocks nothing, on the same target run again on a different project set, on one line or as a separate call. stage-all: a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated outputA deny rule: it refuses a whole-tree `git add` (-A, -u, ., --all, --update), which sweeps in regenerated output, and names what to run instead. stage-classify: staging without classifying, when generated and source differAn advisory: it explains, and blocks nothing, on staging without classifying, when generated and source differ. symbol-search: a recursive text search for names the graph answers exactly: symbols or diagnostic codesA deny rule: it refuses a recursive text search for names the graph answers exactly: symbols or diagnostic codes, and names what to run instead. throwaway-copy: a run inside a temp or scratchpad copy, which leaves the real tree unverifiedA deny rule: it refuses a run inside a temp or scratchpad copy, which leaves the real tree unverified, and names what to run instead. token-state: an agent reading or writing the token secrets: the operator token file or the token storeA deny rule: it refuses an agent reading or writing the token secrets: the operator token file or the token store, and names what to run instead. unknown-env: a retired or misspelled MAGUS_* variable handed to a commandA deny rule: it refuses a retired or misspelled MAGUS_* variable handed to a command, and names what to run instead. unleased-write: a write magus cannot attribute while a fleet is runningAn advisory: it explains, and blocks nothing, on a write magus cannot attribute while a fleet is running. whole-tree: a whole-tree VCS reset, checkout, restore or clean, which cannot be undoneA deny rule: it refuses a whole-tree VCS reset, checkout, restore or clean, which cannot be undone, and names what to run instead. worktree-remove: removing a worktree, which may hold another session's uncommitted workA deny rule: it refuses removing a worktree, which may hold another session's uncommitted work, and names what to run instead.