Any Model Plugin

A Claude Code plugin that lets AI agents delegate tasks, run adversarial reviews, and manage background jobs from Claude Code to any provider and model.

What it does

• Delegate work from Claude Code to another engine/model with a single slash command.
• Run adversarial reviews across different models and providers.
• Manage background jobs (status, result, cancel) just like the upstream plugin.

Use it from any agent host

Claude Code is one of three surfaces — the same CLI powers all of them:

• Universal CLI: node plugins/anymodel/scripts/companion.mjs <command> (or npx anymodel) from any shell or agent.
• MCP server: plugins/anymodel/scripts/mcp-server.mjs exposes every capability as anymodel_* tools in any MCP host — Claude Code, Codex, Cursor, Windsurf, VS Code. See INTEGRATIONS.md.
• Claude Code native plugin: /anymodel:* commands via the marketplace install below.

The two-axes concept

Delegation is built on two orthogonal ideas:

• Executor harness — the agent runtime that plans, runs commands, edits files, and manages sandboxes (e.g., Codex, Claude).
• Model — the underlying provider/model the harness uses to reason and respond.

The Codex plugin hardwires both to OpenAI. This project separates them so you can mix and match:

/anymodel:delegate --engine codex  --model zai/glm-5.2  fix the flaky test
/anymodel:review   --engine claude --base main

Quick start

TODO: installation, setup, and first-delegate steps once Phase 0 scaffolding is complete.

Roadmap

Attribution

This project derives from openai/codex-plugin-cc under the Apache-2.0 license. See LICENSE and NOTICE for details.

Security

• API keys are never stored in this repository. Providers are configured with env_key references in registry.toml; keys come from your environment or a local env file you pass to companion.mjs shim --env-file (keep it outside the repo — .env files are gitignored).
• Sandboxing varies by engine. The codex engine runs inside Codex's own sandbox; the claude engine uses Claude Code permission modes; the built-in direct engine has only tool-level guards (workspace path containment, symlink-hardened; write_file/exec_command exist only in --write mode). Don't point --engine direct --write at repositories you can't afford to mutate, and treat model output as untrusted input.
• The bridge (shim or LiteLLM) listens on 127.0.0.1 only.
• Found a vulnerability? Please open a private security advisory rather than a public issue.

License

Apache-2.0 — see LICENSE and NOTICE.