A team of coding agents,
each on its own model,
in one terminal.

The architect plans on a strong model. The coder writes on a cheap one. The reviewer runs on a free tier. Each with its own key, on its own service, in its own git worktree — and when the leader says a job is done, the harness runs the tests and merges. It does not take the model's word for it.

Install Read the source MIT · macOS, Linux, Windows · one file, nothing to install beside it

One take, cut for length. An empty repository, the setup wizard, a key, a team of two. The architect plans on glm-5.3-flash; the coder builds, tests and commits on deepseek-v4-flash; the leader verifies the branch and it comes home to main. The whole run, through OpenRouter, cost under a cent.

One model for everything is the expensive way.

Mixed models are the base case here, not an extension: two agents hold two credentials on two services in one session. When a job comes home the pane says what it cost, on which models — and what the same tokens would have cost on claude-sonnet-5 and gpt-5. That line is the argument for running a team at all.

Done is checked, not said.

Every job gets a git worktree on a branch of its own. When the leader ends a turn with changes on it, the harness runs the project's check — bun test, pytest, go test, cargo test, read off the files, or whatever the config names — and merges the branch if it passes. If it fails, or the work was never committed, the leader is sent back with the output.

Everything is a plugin.

The core has no dependencies and knows no provider or tool by name; a test fails the build if it ever learns one. What ships — the OpenAI, Anthropic and Gemini dialects, the filesystem and shell tools, the guards, compaction, prices — loads through the same registry a stranger's plugin does. A whole provider is about twenty lines.

How a job goes home

You ask the leader. One instruction, to one agent. Everything that follows reports back to it.
It hands the work on. A plan goes to the coder with agent_send: the files to touch, what each should do, and the check that proves it. Nobody stops to ask permission — nobody is watching.
The coder commits as it goes, on work/<job>, made for it when the checkout was. A commit is safe from the moment it exists; the shell cannot even cd out of the checkout.
The harness brings it home. When the leader says done, the check runs on the branch, the branch merges, and the pane says what it cost — or the leader is sent back, twice at most.

Two agents side by side, so a handoff can be watched from both ends at once. The divider moves with the mouse, or with ^← and ^→.

Two panes side by side, the divider between them moved with the keyboard

Add a service in a file.

Drop a TypeScript module in ~/.aidcrew/plugins or .aidcrew/plugins. No build step, no publishing, no restart. A plugin declares any of providers, tools, loaders, hooks, prices and ui — and may ask you a question before it registers.

The claim is enforced, not described. packages/core/src/architecture.test.ts fails the build if the core imports a tool or a provider, reaches out of its own package, or so much as names a real service in a string:

const forbidden = /\b(openai|anthropic|deepseek|openrouter|gemini|ollama)\b/i

import { definePlugin, defineProvider } from '@aidcrew/plugin-sdk'
import { z } from 'zod'

export default definePlugin({
  name: 'my-service',
  providers: [
    defineProvider({
      id: 'my-service',
      endpoint: 'https://api.example.com/v1',
      configSchema: z.object({ apiKey: z.string().min(1) }),
      create: ({ apiKey }) => ({
        id: 'my-service',
        async *send(request, signal) {
          // Translate the canonical request,
          // stream back canonical deltas.
        },
      }),
    }),
  ],
})

What is here

Providers: Anthropic; Gemini; anything OpenAI-compatible — Zen, OpenRouter, DeepSeek, OpenAI, Ollama, vLLM, or any endpoint by URL — in both dialects, chosen by trying. A model without native tool calling gets its tools in the prompt and its calls read back from the text.
Tools: read, write, edit, grep, glob, tree, head, stat, json, toml, outline, symbols, imports, deps, git-log, bash, skill, agent_send. Everything that only reads is a tool of its own, so looking something up never needs approving.
MCP: Any MCP server, over stdio or HTTP, from the .mcp.json a project already has. Its tools arrive as ordinary tools; a server a project declares does not start until you say it may.
Cost: Per agent, per job and per session, from the service's own price list, the project's stated prices, or a bundled list checked against what the services publish — with a tilde when it is an estimate.
Sessions: Every turn written to disk; a session resumes where it was left — transcript, history and checkouts included. A checkout with uncommitted work outlives the session.
The screen: The alternate buffer, every frame exactly the window's height, drawn over the last rather than after a wipe: nothing scrolls, nothing blinks. Nine palettes, each solid or hairline; the default stays six hues under the common forms of colour blindness, and that is a test.

Cloning a repository is not consent.

Everything that arrives with a clone is inert until you type a command: a project's plugins are not imported, its MCP servers are not started, the parts of its config that let an agent act unasked do not apply. Answers are remembered in your own store, never in the project.

A never-write list — .git, .env, .ssh, .aws, private keys, the session database — in every mode.
An always-ask list of commands that cannot be taken back, in every spelling the guard knows: rm -rf, git push --force, git reset --hard, dd, curl … | sh. Approving one never approves the next. Headless, a question is a refusal.
A snapshot of every file before it changes, and aidcrew undo to take it back.
A shell that cannot leave its checkout: cd or git -C pointed at another checkout — the repository root included — is refused, and told where it was going.
Keys read from stdin, stored 0600, never logged, never echoed. A committed config names the variable, never the value.

Not a sandbox, and the security document says exactly what these are not.

Install

One file, no runtime to install alongside it.

# macOS, Apple silicon
curl -Lo aidcrew https://github.com/antoniociccia/aidcrew/releases/latest/download/aidcrew-macos-arm64
chmod +x aidcrew && sudo mv aidcrew /usr/local/bin/
aidcrew --version

# then: sixty seconds against real files, with no key and no account
aidcrew demo

Also macOS x64, Linux x64, Linux arm64, Windows x64 and checksums. Before a release is published, the binary it built is started on each of the three platforms. On Windows the shell tool runs bash, which Git for Windows provides.

From source, with Bun 1.3 or later: git clone https://github.com/antoniociccia/aidcrew && cd aidcrew && bun install && bun run build

It is better with more hands on it.

Providers and plugins for services not yet covered. Reports from real use on Windows. Corrections to the model price list, with a link. Agent files and briefings that work well for a language or a kind of project. Palettes. The ground rules are short: the failing test first, comments that say why, three checks before a pull request.

Discussions Open an issue

A team of coding agents,each on its own model,in one terminal.