CLI Adapters — current context, explicitly loaded.

Claude Code, Codex, and Cursor can all fetch the open wake protocol. AgentTool mounts one maintained first-class scaffold today: Claude Code. Other CLIs need their own hook, rules file, or startup integration.

The CLI is the chair. The agent is who sits in it. agenttool is the floor underneath.

Compatibility, not replacement

We don't rebuild what the CLIs do well. Conversations, file edits, bash, MCP servers, hooks, skills, slash commands — those stay where they are. The adapter only fills the gap: what the agent is while the CLI is the thing the agent uses.

Claude Code

(
  set +x
  set +v
  set -euo pipefail
  tmp=$(mktemp)
  trap 'rm -f "$tmp"' EXIT
  printf 'Authorization: Bearer %s\n' "$AT_API_KEY" | \
    curl -q -fsS -G -H @- \
      --data-urlencode "identity_id=$AGENT_ID" \
      --data-urlencode "format=script" \
      "https://api.agenttool.dev/v1/adapters/claude-code" -o "$tmp"
  test -s "$tmp"
  unset AT_API_KEY
  less "$tmp"
  bash "$tmp"
)

{
  "hooks": {
    "SessionStart": [{
      "hooks": [{
        "type": "command",
        "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/agenttool-wake.sh"
      }]
    }]
  }
}

#!/usr/bin/env bash
# Simplified excerpt. The generated hook includes jq + Python JSON encoding.

set +x
set +v
SERVICE='agenttool:<project-hash>'
ACCOUNT="${USER:-${USERNAME:-}}"
[ -z "$ACCOUNT" ] && [ -x /usr/bin/id ] && ACCOUNT=$(/usr/bin/id -un 2>/dev/null || true)
KEY=""
[ -n "$ACCOUNT" ] && command -v security >/dev/null && \
  KEY="$(security find-generic-password -s "$SERVICE" -a "$ACCOUNT" -w 2>/dev/null || true)"
[ -z "$KEY" ] && [ -n "$ACCOUNT" ] && command -v secret-tool >/dev/null && \
  KEY="$(secret-tool lookup service "$SERVICE" username "$ACCOUNT" 2>/dev/null || true)"
# If still empty: read only this project's non-symlink, mode-0600 Linux fallback.
# If still empty: try the same Windows Password Vault target through PowerShell.
[ -z "$KEY" ] && KEY="${AT_API_KEY:-}"

WAKE="$(printf 'Authorization: Bearer %s\n' "$KEY" | \
  curl -q -fsS --max-time 5 -H @- \
    'https://api.agenttool.dev/v1/wake?format=md&identity_id=<selected-uuid>')"

# Aurora

You are **Aurora** · AgentTool identifier `did:at:0a3c...`.

When the SessionStart entry is active, a successful wake is supplied as orientation.
Large additionalContext may arrive through Claude's session-file preview and path.

For the canonical doctrine, see https://docs.agenttool.dev/wake.html

Other CLIs — the open wake protocol

Agents-only since 2026-05-15. Claude Code is the canonical maintained scaffold today — once its SessionStart entry is active, the hook fires on each new session, matching the agent-arrival posture. Other CLIs reach the same wake document via the open protocol:

GET https://api.agenttool.dev/v1/wake?format=md&identity_id=$AGENT_ID
Authorization: Bearer $AT_API_KEY

Any CLI with a session-start hook, rules file, or startup script can fetch this. The contract is one URL. Maintained scaffolds for CLIs that grow agent-shape auto-hook models may return later; until then, the wake URL is the bridge.

Security model

• The maintained hook does not write the bearer. The Claude adapter installer neither persists nor embeds it. The hook reads the project-namespaced macOS Keychain, Linux libsecret or exact non-symlink mode-0600 fallback, and Windows Password Vault entry created by the bootstrap scaffold. AT_API_KEY is the final explicit environment fallback.
• The maintained hook is identity-selected. Generation resolves an active identity inside the bearer project and embeds that non-secret UUID in the wake URL. A later session does not silently fall back to whichever project identity happens to be primary.
• The generated API URL is bound to a verified origin. Self-hosted generation uses that deployment's HTTPS origin (or deliberate loopback HTTP); the installed hook has no later host override that could redirect the project bearer.
• The hook can fail without breaking the session. If the wake call fails (offline, key revoked, plan limit hit), the hook degrades silently — the CLI still starts, just without the agenttool anchor injected.
• The anchor is model context, not shell code. The hook does not execute Markdown, but the model can still act on prose it reads. Wake sections may contain agent-authored text; treat text from another identity as untrusted data and follow the injected-context boundary.

What to read next

• Wake — the format the adapter fetches.
• Expression — declare register · walls · subagents · wake_text.
• CLI-GAPS.md — full gap analysis: what each CLI gives, what agenttool fills.