Primary question: Does your team run Google Antigravity as its primary agent runtime and want a structured .agents/ contract with guardrails baked in?
RepoDaily adoption score
RepoDaily rates this as 91/100 (strong) for adoption: evidence, installation path, production risk, differentiation, license clarity, and AI/agent fit are scored from the article sources and adoption notes.
5 source(s) across 4 source category/categories, plus a RepoDaily-specific evidence module when available.
5 workflow step(s), 5 next-action step(s), and 4 command/install signal(s) were detected.
Trending momentum is +211 stars, with maintenance/release/issue signals counted when present.
Risk is marked medium, with 6 security note(s) and 3 explicit skip condition(s).
3 opportunity lens item(s), 3 alternative(s), and 3 type-specific section(s) support differentiation.
License source or license wording is present.
7 AI/agent-related signal(s) were detected in the article text and metadata.
Project overview
AG Kit is an open-source agent engineering kit published by VUDOVN under the MIT license and versioned at 2026.7.27 using calendar versioning (YYYY.M.D). It is not a model, a framework abstraction layer, or a standalone agent runtime. Instead, it installs a complete .agents/ workspace contract—rules, skills, workflows, memory, orchestration commands, MCP configuration guidance, and a native safety hook—on top of a single supported production runtime: Google Antigravity.
The kit's differentiator is its explicit narrowness. The README states that Antigravity is the supported production runtime for this release, and that other tools may read the Markdown components but runtime behavior outside Antigravity is not part of the production compatibility guarantee. That scope boundary is reinforced by a dedicated Antigravity Compatibility GitHub Actions workflow, regression tests for hook payloads and destructive patterns, and a read-only diagnostic tool called Antigravity Doctor.
What makes AG Kit worth attention is the safety layer. A native PreToolUse hook registered in .agents/hooks.json intercepts run_command calls and blocks a small set of high-confidence destructive patterns: recursive Unix root deletion, filesystem formatting, raw-disk overwrite with dd, Windows drive formatting, and recursive forced deletion of a Windows drive root. Normal project cleanup such as deleting dist/ or node_modules/ is intentionally allowed. The hook reads at most 1 MiB of JSON from stdin, performs no network request, and fails closed for recognized destructive commands while failing open with a warning for unrecognized payload shapes.
Beyond the hook, AG Kit ships 20 role definitions and intelligent-routing skills, persistent context under .agents/memory/ with context-compression guidance, slash-command orchestration through /plan, /coordinate, and /orchestrate, and an MCP sync helper that defaults to check-only mode, blocks unresolved placeholders, preserves conflicts unless forced, and writes timestamped backups before replacing target files.
Why it is trending now
- 211 period stars with a trending rank of 12 on 2026-07-29, driven by the Antigravity-native 2026.7.26 production release.
- The 2026.7.26 release introduced six-phase runtime integration: the machine-readable .agents/antigravity.json contract, native PreToolUse hook, Antigravity Doctor diagnostics, MCP plan/sync helper, optional plugin builder with SHA-256 inventory, and a dedicated compatibility CI workflow.
- The 2026.7.27 fix resolved a silent CLI exit when invoked through an npm bin symlink, which previously meant npx @vudovn/ag-kit init installed nothing on some setups.
- 20 specialist agent roles with intelligent routing give teams a structured starting point instead of a blank prompt.
Problem it solves
- Agent runtimes can execute destructive shell commands if prompted or poisoned; AG Kit's PreToolUse gate blocks five high-confidence destructive patterns before they reach the host.
- MCP configuration with embedded credentials is a recurring leak vector; AG Kit's sync helper rejects unresolved placeholders like YOUR_API_KEY and never writes without an explicit --apply flag.
- Agent workspaces drift between machines and contributors; AG Kit treats .agents/ as a versioned contract with integrity coverage for the Antigravity contract, hook configuration, schemas, plugin templates, and tests.
- Plugin artifact tampering is hard to detect; the builder generates a SHA-256 content inventory in PLUGIN_CONTENTS.json and reads repository files only, excluding environment variables and home-directory configuration.
How it works
- Run `npx @vudovn/ag-kit init` or `npm install -g @vudovn/ag-kit` followed by `ag-kit init` to scaffold the .agents/ workspace into a project.
- Do not add .agents/ to .gitignore if Antigravity needs to index rules, skills, or workflows; use .git/info/exclude for local-only filtering instead.
- Verify the workspace with `npm run check:agents` (validators), `npm run check:antigravity` (read-only diagnostics), and `npm run test:antigravity` (hook payload tests).
- Open the repository in Antigravity as a trusted workspace and confirm slash commands such as /plan, /coordinate, and /orchestrate are discovered.
- Optionally build a local Antigravity plugin with `npm run build:antigravity-plugin`, which emits dist/antigravity-plugin/ with a SHA-256 content inventory.
Product demo and interface preview
Command and Script Surface
- `npx @vudovn/ag-kit init` scaffolds the .agents/ workspace contract.
- `npm run check:agents` runs generate_manifest.py --check, dependency_graph.py --check, and validate_kit.py.
- `npm run check:antigravity` invokes .agents/hooks/antigravity-doctor.mjs in read-only mode.
- `npm run test:antigravity` runs `node --test .agents/hooks/tests/antigravity.test.mjs`.
- `npm run build:antigravity-plugin` invokes .agents/hooks/build-plugin.mjs to produce the plugin bundle.
- `node .agents/hooks/antigravity-doctor.mjs --strict` enables strict diagnostics only after all MCP placeholders are resolved.
- Python 3.10+ is required for validators and utility scripts; Node.js 22+ is required for Antigravity integration checks.
Adoption Checklist
- Confirm Node.js 22+ and Python 3.10+ are installed on every contributor machine.
- Confirm a trusted Google Antigravity workspace is available; other runtimes are best-effort for Markdown portability only.
- Run `npm run check:antigravity` and expect a warning until the default MCP example placeholder YOUR_API_KEY is replaced.
- Review .agents/hooks.json before enabling strict mode; the hook is enabled by default but can be set to "enabled": false for compatibility diagnosis.
- Keep .agents/ out of .gitignore so Antigravity can index rules, skills, and workflows.
Integration Surface
AG Kit integrates with Google Antigravity through three primary surfaces: the machine-readable .agents/antigravity.json contract, the native .agents/hooks.json PreToolUse registration for run_command, and the optional plugin bundle generated into dist/antigravity-plugin/. The Antigravity Doctor checks discovery, MCP, hook, orchestration, plugin, and release-readiness in a single read-only pass. MCP synchronization targets a selected Antigravity suite or CLI target file and refuses --apply while placeholders remain, preserving same-name existing servers unless --force is explicitly supplied.
Who should pay attention?
Good fit if
- Teams that have already chosen Google Antigravity and want a structured, validated .agents/ contract with guardrails.
- Projects that need a narrow destructive-command safety net without replacing Antigravity's own permission and workspace-trust controls.
- Organizations that want MCP configuration with placeholder blocking, conflict preservation, and timestamped backups.
Skip for now if
- Teams using a different primary agent runtime where Antigravity compatibility is irrelevant.
- Projects that require a sandbox; AG Kit explicitly states it is not a sandbox and does not replace OS isolation.
- Users who cannot run Node.js 22+ and Python 3.10+ on their validation machines.
Risks and cautions
Runtime is locked to Google Antigravity, the safety hook is narrow by design, and cross-runtime behavior is best-effort only.
- The README explicitly limits production compatibility to Antigravity; other tools may read Markdown but runtime behavior is unsupported.
- The native hook blocks only five high-confidence destructive patterns and does not replace Antigravity permissions, workspace trust, sandboxing, or human approval.
- The default MCP example contains YOUR_API_KEY, so the doctor reports a warning until configured.
- Node.js 22+ is required for Antigravity integration checks even though the published CLI supports Node.js 18+.
- Calendar versioning means security fixes are provided for the latest published release only.
- The PreToolUse hook reads at most 1 MiB of JSON from stdin and performs no network request.
- Recognized destructive commands fail closed with a non-zero exit code; invalid, oversized, or unrecognized payloads fail open with a warning to avoid workspace-wide lockout.
- MCP sync defaults to check-only, rejects unresolved placeholders, preserves conflicts unless --force is supplied, and creates timestamped backups before replacing target files.
- The plugin builder reads repository files only and excludes environment variables and home-directory configuration.
- The SECURITY.md threat model covers prompt injection, destructive shell commands, secret leakage in MCP config, malicious MCP servers, artifact tampering, config conflicts, upstream payload changes, and supply-chain compromise.
- Vulnerability reporting is restricted to GitHub private vulnerability reporting; public issues must not include secrets, exploit payloads, or proof-of-concept data.
Alternatives to compare
| Approach | When to use | Trade-off |
|---|---|---|
Cursor Rules / .cursorrules | When the primary editor is Cursor rather than Antigravity and a lighter-weight rule file is sufficient. | Free, editor-specific. |
Claude Code subagents | When the runtime is Claude Code and specialist agent routing is needed without a full .agents/ contract. | Included with Claude Code usage. |
Custom .agents/ scaffold | When a team wants full control over the workspace contract and can build its own hook and validation pipeline. | Engineering time. |
What this trend reveals
Destructive-command policy as a portable pattern
The five blocked patterns—Unix root deletion, filesystem formatting, raw-disk dd overwrite, Windows drive formatting, and Windows root forced deletion—are concrete and auditable. Runtime maintainers outside Antigravity could adopt the same fail-closed/fail-open split for their own PreToolUse-style hooks.
Review .agents/hooks.json and the hook test suite under .agents/hooks/tests/ to confirm the pattern list and failure modes match the SECURITY.md description.
MCP placeholder-blocking workflow
sync-mcp.mjs refuses --apply while placeholders remain and preserves same-name servers unless forced. This is a reusable safety pattern for any team managing MCP configuration across multiple suites or CLI targets.
Run npm run check:antigravity on a fresh init and confirm the doctor reports a warning for the default YOUR_API_KEY placeholder before strict mode is usable.
Plugin artifact integrity via SHA-256 inventory
The plugin builder emits a PLUGIN_CONTENTS.json with a SHA-256 content inventory, giving reviewers a deterministic artifact to inspect before installation into Antigravity.
Run npm run build:antigravity-plugin and inspect dist/antigravity-plugin/PLUGIN_CONTENTS.json against .agents/VERSION.
RepoDaily verdict
AG Kit is a narrowly scoped, safety-conscious .agents/ workspace contract for Google Antigravity, with a real destructive-command gate, MCP placeholder blocking, and a read-only diagnostic pipeline. It is a strong fit for Antigravity-first teams and a poor fit for anyone expecting cross-runtime production parity or a full sandbox.