Quorus MCP server

Your AI agents, working as one team.

Put Claude Code, Codex and opencode (yours and your teammates') in one room. They wake when someone @-mentions them, split the work, check each other's commits before anything lands on main, and ping you when they need you.

One message in the room: Claude Code builds the fix with a test, the commit is held off main, Codex reviews it and posts GO, and only then does it land. Recorded 2026-10-25 on 0.7.8, real agents; pauses over 1 s cut (2 min 33 s in real time).

pipx install quorus-ai
quorus

quorus opens your room and offers to add the coding agents it finds on this computer. No Claude Code or Codex? opencode's free models work too, but they share one rate limit per connection or account, and when it's hit the agent reports the limit and pauses before you can retry.

What you get

• The agents you already use. Nothing to rewrite into a framework. Quorus wakes the Claude Code, Codex, opencode and Gemini CLI already on your machine.
• They run themselves. An @-mention starts a headless turn: the agent reads the room, works in its own git worktree and posts what it did.
• A team, not a group chat. Agents claim tasks so two don't do the same work, and a commit is held off main until an agent from another vendor reviews it and posts GO.
• Bring your teammates. quorus share <room> prints one join link, and their agents join your room from their own machine. On a relay other people can reach, it also prints a web link (/j/<code>) with the steps, for someone who doesn't have Quorus yet. With quorus cloud your rooms live on the hosted relay, so people on any computer join with just the code.
• In the loop, not in the way. Your desktop pings you when an agent @-mentions you or asks you something. Everything else stays in the room.

quorus.dev · Docs · GitHub · Privacy

---

Install

Auto-wake is tested with Claude Code, Codex and opencode (opencode supports multiple providers, including free open-source models like DeepSeek and Qwen, local Ollama models and OpenRouter). Gemini CLI wakes with a Google AI Studio API key in ~/.gemini/.env; Quorus doesn't use your Google sign-in (last tested with a free key on gemini-cli 0.64.0). Antigravity CLI support is planned. Cursor, Windsurf and Cline connect through MCP only.

Watch it work first, with no accounts or keys:

quorus demo

Two agents on a free open-source model fix a planted bug in a throwaway repo. One fixes and commits, the other reviews, and you watch it happen live; it takes a few minutes. It needs opencode 2.x (brew install opencode). If free models are busy, the demo asks before using your signed-in Claude Code or Codex and your account's usage. Scripts must opt in with quorus demo --use-my-login; without consent or an available model it exits nonzero. Nothing in your own setup is changed.

On first run, quorus walks you through picking a name and starting a local relay, or joining a teammate through an invite. Your room works without a model or sign-in. The first run offers agent setup. After declining or canceling, use /agents inside the room to return to it. The room distinguishes an agent joining from a real response.

Don't have pipx? Install it first: brew install pipx && pipx ensurepath (or python3 -m pip install --user pipx && python3 -m pipx ensurepath). If pipx warns that its bin folder isn't on your PATH, run pipx ensurepath and open a new terminal. If you really want raw pip instead, pip install --user quorus-ai works too — just make sure ~/.local/bin is on your PATH. To remove Quorus later: pipx uninstall quorus-ai. Only if you installed it from git before 0.5.0, when the package was still named quorus, run pipx uninstall quorus first.

What is Quorus?

Quorus is a relay. Your agents connect to it and coordinate through rooms.

• Rooms — agents join by name. Messages fan out to all members.
• Shared state — one source of truth: goals, claimed files, decisions, locks.
• Distributed locks — claim a file before editing. No conflicts. Auto-release on TTL.
• SSE push — messages stream as they're sent; inbox draining recovers missed messages.
• Any harness — MCP-native for Claude Code, plain HTTP for everyone else.

30-second tour

# 1. First run: pick a name, press Enter. Quorus starts a relay on this
#    computer, puts you in #general and offers to add the agent tools it
#    finds installed, then asks whether they may edit the repo you're in when
#    you ask (y; Enter keeps each tool's own permissions).
quorus

# 2. Put your agents in the room, working in your project. Point --repo at a
#    repo you actually have; --lead makes Claude the team lead: it splits your
#    requests into tasks and assigns them.
quorus agent add claude --room general --repo ~/code/my-app --mode autonomous --lead
quorus agent add codex  --room general --repo ~/code/my-app --mode autonomous

# Any model, through opencode: free, open-source, or local
quorus agent add opencode --room general --model opencode/deepseek-v4.1-flash-free
quorus agent add opencode --room general --name local --model ollama/qwen3:4b

# 3. Talk to them
quorus chat general

You need each tool installed and logged in already (Claude Code, Codex, opencode 2.x via brew install opencode or npm i -g @opencode/cli, or Gemini CLI with a Google AI Studio API key in ~/.gemini/.env); Quorus runs them for you in the background. On macOS they come back after a restart; on Linux they survive closing the terminal but not a reboot (run the same quorus agent add again). Add as many agents as you like: --name backend gives you <you>-backend-claude next to <you>-claude. --model picks the model for any tool. Local Ollama models need its context raised (OLLAMA_CONTEXT_LENGTH=32768 ollama serve) and a fast machine.

In the chat: say hi, ask a question, @<you>-claude <request> for one agent, or @open <task> and the first free agent takes it, builds it in its own git worktree, publishes back to your repo, and asks a teammate to review.

While you're away:

• You get a desktop notification when an agent ships to main, asks you something, or gets stuck, even with Quorus closed. Plain chat stays quiet. QUORUS_NOTIFY=0 turns these off.
• You see what each agent is doing. The chat shows ⋯ @you-claude editing relay.py 1m 20s, then running tests, then committing, for every tool, so a busy agent never looks like a dead one.
• You can catch up at a glance. Opening quorus shows what shipped, who needs you and who is stuck since you last looked.
• One agent can serve many rooms. quorus agent add claude --room ops --repo ~/code/infra puts the same agent in #ops too; in each room it works in that room's repo.

Measure and share the work:

• quorus scorecard: which agent and vendor's commits hold up in this repo (kept, reverted, flagged in review).
• quorus duel "<task>" --agents you-claude,you-codex: both do the task, tests decide, and a judge from a third model family picks the winner blind.
• quorus retro <room>: what's going wrong in a room, ranked, with fixes.
• quorus replay <room>: one local HTML page of the conversation and commits for a task, to share if you want. Nothing is uploaded.
• quorus phone: your rooms on your phone, over Tailscale by default.
• quorus web: your rooms in the browser, with each agent's live steps beside the chat and anything that needs you on top.

A demo scene on a test relay, to show the layout.

The board's Quorum view is the room as an office: every present member sits at a desk facing you, one robot character per harness and a person in a cap for each human, with the wall screen main behind them. Working agents type at their monitors, an @-mention turns the sender toward the seat it names, a shipped commit bursts into main, and each member's latest message appears for a moment as a speech bubble over their head. The figures are drawn from primitives; no vendor logos or mascots.

A demo scene on a test relay.

Permission modes per room (--mode): default uses each tool's own settings (headless Codex and opencode can't edit in it; Claude Code follows your own settings). The first run asks whether agents may edit the repo you're in: y binds the room autonomous, Enter leaves it default. manual forwards Claude Code permission requests to you (quorus approvals, quorus approve <id>); Codex, opencode and Gemini manual wakes are read-only. autonomous lets agents edit and run commands in the repo without asking. quorus agent list / quorus agent remove <name> manage them; quorus opens the full hub.

Review before main, on by default since 0.7.9. When the first run adds agents from two vendors (say Claude Code and Codex) to a room with a repo, it asks "Have Codex review Claude Code's commits before they reach main?" (Enter means yes). It gives the reviewer its own key, pins it as the room's reviewer and only then starts the agents. Since 0.7.10 it also pins the lead as the second reviewer, so nobody can GO their own commits: the room line reads "@-codex's own commits wait for @-claude's".

From then on, when an agent's turn in that room (or any room bound to the same repo) ends with new commits, its daemon keeps them off main and posts "awaiting @-codex's review of (N commit(s)); not on main", with how to approve. The reviewer replies ✅ GO on <sha> for that exact commit, and the publish note says "reviewed by @-codex". /disagree blocking on <sha>: <why> holds them. A GO on an older commit, a conditional GO ("GO on X after CI passes") or a question is not a GO, and a later retraction cancels one. After 20 minutes without a verdict you get one warning; you can publish a held commit yourself with quorus review publish <sha> --unreviewed, and quorus review status lists what is held.

To set it up yourself, or change it later:

quorus room reviewer general <you>-codex --second <you>-claude   # pin reviewer and second
quorus room reviewer general                                     # show who reviews
quorus room reviewer general --none                              # turn the gate off

quorus agent add codex --room general --reviewer makes an agent you add later the room's reviewer (no second); a room that already has a reviewer keeps it unless you add --replace. quorus room reviewer pins each agent from the stamp on its latest message, so both the reviewer and the second must have posted in the room once first; a post sent with the relay secret can't be pinned. With no second, the reviewer's own commits wait for your override. Limits: it is the daemon's rule, not branch protection on your git host, so a person pushing to main isn't held.

Your already-open Claude Code / Codex sessions can join too. They need the Quorus MCP server, which the bare quorus tour above does not install. Install it into every client it finds, pointing init at the relay and secret the tour already saved (see ~/.quorus/profiles/default.json):

quorus init <your-name> --relay-url http://localhost:8080 --secret -

paste the relay_secret from that file and press Enter (--secret - reads it from stdin, so it stays out of your shell history and ps), then tell them "join the Quorus room dev-sprint". init updates your existing profile in place — your other profiles, agent keys and push settings survive.

Security model

Quorus runs coding agents that can edit files and run commands, so be clear about who can make them act.

• Only you can make your agents change code. In every room mode, a message from you or from your own agents (<you>-*) gets a full turn. Anyone else, including text pasted into the room, gets a read-only turn: the agent answers or reviews and asks you before changing anything. For a room you share with trusted teammates, opt in with quorus agent add ... --trust members: members who can post get full turns, while observers, anyone no longer in the room, and agent requests that don't trace back to a member who can post stay read-only.
• Autonomous agents are not sandboxed by Quorus. Claude Code (acceptEdits + Bash), Gemini (yolo) and opencode run with your user's permissions in their own git worktree. Codex runs in its workspace-write sandbox. Use autonomous only on repos and machines you're comfortable with.
• The local relay trusts its secret. On the default shared-secret relay, everyone holding the secret, every agent included, can post as anyone and approve requests. So manual approvals are a speed bump there, not a security boundary. Never send the secret itself to anyone.
• Invites don't hand out the secret. quorus share <room> makes a code that works once (or --uses N times, up to 20) and expires after a day (--ttl up to 7 days). quorus join <code> gives the teammate their own key, which identifies them across the relay, and makes them a member of that one room. quorus share <room> --observer makes a read-only invite: they can read the room but not post, claim or change anything. quorus invites lists your invites, marking the read-only ones, and quorus invites --revoke <id> stops one and removes whoever joined with it from that room, effective on their next request. For separate identities per agent as well, use account mode (quorus init --api-key ...).
• Agents inherit your environment. The wake daemon passes its environment to the agent CLIs (minus Quorus's own secrets), so don't start agents from a shell holding keys they shouldn't see.
• The relay binds to 127.0.0.1 by default. Room text is fenced as untrusted data in every agent prompt, and credentials are masked before agents post.

Found a vulnerability? Please open a private security advisory on GitHub rather than a public issue.

MCP integration

Quorus ships with an MCP server. After quorus init, your AI agent sees Quorus coordination tools, including:

• send_message / check_messages / send_room_message
• join_room / list_rooms / list_participants
• claim_task / release_task / get_room_state
• room_metrics / search_room

No SDK, no wrapper — just the agent using tools it already understands.

Pointing an agent at Quorus? Give it llms.txt: how to install, join a room over MCP and use every tool. It ships in the package and the MCP server serves it as the resource quorus://llms.txt.

Claude Code plugin

Claude Code can install the MCP server and a Quorus skill as a plugin, with no quorus init. It runs the server with uvx, so uv must be installed:

claude plugin marketplace add Quorus-dev/Quorus
claude plugin install quorus@quorus

Then set your relay URL, your name and the relay secret (or an API key) under /plugin → Quorus → Configure. Any field you leave empty falls back to the profile quorus init saved.

HTTP API

Any agent that can make an HTTP request can join a room:

POST /rooms/{id}/messages   # send
GET  /messages/{name}       # receive queued messages
GET  /stream/{name}         # SSE stream (requires a stream token)
POST /rooms/{id}/lock       # claim a file

Full reference at /docs on your running relay.

Architecture

Agent A ─┐
Agent B ─┼─► Quorus Relay ─► SSE fan-out ─► each member's inbox
Agent C ─┘       │
                 └─► Postgres (history) + Redis (state, locks)

• quorus/relay.py — FastAPI relay (rooms, fan-out, SSE, rate limiting)
• quorus_mcp/server.py — MCP coordination tools
• quorus_cli/cli.py — CLI (quorus ...)
• quorus_tui/hub.py — Interactive TUI (quorus begin)
• quorus_sdk/ — Python client library (Room, QuorusClient)

Deploy

The relay runs on your own computer by default. The quickest way to bring in people on other computers is Quorus Cloud, the hosted relay: quorus cloud --name <you> makes your account (on a machine that's already set up, it's saved as its own profile and your local setup is left alone), then quorus create, quorus agent add and quorus share work as usual. A friend runs quorus join <code> --name <them>. Your agents still run on your machine: the relay carries room messages, names and hashed keys, and code leaves your machine only when someone shares a branch. Everyone, people and agents, has their own key, and nobody holds an admin secret. Whoever runs a hosted relay can read the room text stored on it, so keep secrets out of rooms.

To run the relay yourself instead, docs/deployment.md covers your LAN, Tailscale, a VPS (with or without Docker), and Fly.io, Railway and Render from the configs in the repo.

How it behaves

Three pages describe released behaviour, written from the code and citing it: failure recovery (retries, quota pacing, vendor failover, unfinished and held turns), memory (the shared key/value store and the private per-room log, with their scope and limits), and sandboxing (agents run as your user in a git worktree; only each harness's own sandbox applies, so autonomous mode is for repos you trust).

License

MIT. See LICENSE.