Orchestrating agent CLIs from another agent

How to use one agent CLI to test and automate other agent CLIs. We used OpenCode as the orchestrator to test OpenCode, Codex, and Cursor CLI onboarding flows against Conductor.

The pattern

text Orchestrator (opencode) │ ├── opencode run --model X --auto --dir <workspace> "prompt" ├── codex exec -m X -C <workspace> --sandbox danger-full-access "prompt" └── cursor → GUI only, no headless mode

Commands by CLI

OpenCode (orchestrator and target)

opencode run executes a prompt non-interactively and exits. Use for scripting.

powershell opencode run ` --model opencode/deepseek-v4-flash-free ` --auto ` --dir "D:\workspace\test-folder" ` "Your prompt here"

Key flags: - --model <provider/model> — select the model - --auto — auto-approve permissions (required for MCP config writes, git clones, etc.) - --dir <path> — working directory - --continue / --session <id> — resume a previous session

Codex

codex exec runs non-interactively.

powershell codex exec ` -m gpt-5.6-luna ` -C "D:\workspace\test-folder" ` --sandbox danger-full-access ` --skip-git-repo-check ` "Your prompt here"

Key flags: - -m <model> — model name - -C <dir> — working directory - --sandbox <mode> — workspace-write (default, blocks network) or danger-full-access (allows network) - --skip-git-repo-check — allow running outside a git repo - --ephemeral — don't persist session files - codex mcp add <name> --url <url> --bearer-token-env-var <VAR> — add MCP server

Cursor

Cursor has no headless mode. To test programmatically, write the MCP config to .cursor/mcp.json and verify the MCP endpoint responds:

```powershell

Write config

@{ mcpServers = @{ conductor = @{ url = "https://conductor-konstant.hectorsanchez.eu/mcp" headers = @{ Authorization = "Bearer $token" } } } } | ConvertTo-Json -Depth 3 | Set-Content ".cursor\mcp.json"

Verify MCP server responds

$init = '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-03-26","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}' Invoke-WebRequest -UseBasicParsing -Uri "$MCP_URL" -Method Post -Headers $headers -Body $init ```

No agent execution is possible — Cursor must be opened manually in the IDE GUI.

MCP configuration per CLI

Each CLI has a different native way to add MCP servers:

CLI	Native command	Header format	Token handling
OpenCode	opencode mcp add <name> --url <url> --header "Authorization=Bearer $token"	KEY=VALUE	Inline in command
Codex	codex mcp add <name> --url <url> --bearer-token-env-var <VAR>	Env var	Separate env var
Cursor	Write .cursor/mcp.json	JSON "Authorization": "Bearer ..."	In config file

All three also support the JSON config file format with "headers": {"Authorization": "Bearer ${TOKEN}"}.

Token retrieval (Windows PowerShell)

Prerequisite for all agents on this machine:

powershell . "D:\Workspace\_repos\tools\secret-gate\secret-gate.ps1" $env:CONDUCTOR_MCP_AUTH_TOKEN = ((bws secret list | ConvertFrom-Json) | Where-Object { $_.key -eq "CONDUCTOR_MCP_AUTH_TOKEN" }).value

Common failure modes

Symptom	CLI	Cause	Fix
"Permission denied" writing config	OpenCode	Missing --auto flag	Add --auto
"Socket access denied" fetching URL	Codex	workspace-write sandbox blocks network	Use --sandbox danger-full-access
No run/exec command	Cursor	GUI-only IDE, no headless mode	Manual test only
Token printed in error output	OpenCode	Wrong header format triggers error echo	Use KEY=VALUE format
"Session not found" on MCP call	Any	Streamable HTTP session not carried between requests	Capture Mcp-Session-Id header from initialize response
PowerShell eats $() in SSH	Any	PowerShell pre-parses bash variables before sending	Write script to file, scp, then ssh execute

Test workspace layout

D:\ai-agent-workspace\ ├── opencode-cli-test\ # OpenCode test │ └── conductor\ # Cloned conductor repo ├── codex-cli-test\ # Codex test │ ├── .codex\ # Codex config (auto-created) │ └── conductor\ # Cloned conductor repo └── cursor-cli-test\ # Cursor test ├── .cursor\ # Cursor MCP config │ └── mcp.json └── conductor\ # (not cloned — manual step)