AI coding agents compared: shared config formats, different approval defaults

Key findings

Terms used here

• AGENTS.md is a Markdown instruction file kept in a repository. It holds what an agent should know before working, such as build commands and code conventions. OpenAI created it, and it was contributed, together with MCP, to the Agentic AI Foundation (AAIF), which the Linux Foundation formed on 2025-12-09.
• Agent Skills is an open standard (agentskills.io) for packaging reusable agent capabilities as a folder with one SKILL.md file plus optional scripts and reference documents. An agent normally sees only each skill's name and description, and reads the body when it needs it.
• MCP (Model Context Protocol) is an open protocol that defines how agents connect to external tools and data. A program that provides tools to an agent is called an MCP server.
• An approval mode is the setting that decides whether an agent asks a person before acting, for example before editing files, running shell commands or making network requests. In this article, a classifier means a separate model that reviews such actions in place of a person.
• A sandbox is an execution boundary enforced by the operating system. It limits which paths shell commands can write to and which network destinations they can reach. The approval mode decides whether the agent must ask before an action runs; the sandbox decides what that action can access once it is allowed to run.

How we checked

On 2026-10-06 we downloaded the official documentation for all five tools as source files or API responses, then compared the relevant sections directly. To avoid going through a summarizer, we read Claude Code's docs as Markdown sources (a .md suffix on the URL), Codex's docs as Markdown sources on learn.chatgpt.com, GitHub's docs through the docs.github.com body API, Gemini CLI's docs as source files in its GitHub repository, and Cursor's docs as Markdown sources on cursor.com. Each table cell is taken from sentences in these documents.

The baseline versions were the newest npm releases available that day: Claude Code 2.1.290, Codex CLI 0.160.1 and Gemini CLI 0.62.0. For Cursor we used the change log inside its docs (3.5 and 3.6). GitHub Copilot runs in IDEs, a CLI and GitHub.com, but the parts that compare execution location and isolation cover Copilot cloud agent, where you hand tasks over on GitHub.com. That feature's doc URLs still say coding-agent, while the text calls it cloud agent.

We did not compare performance, accuracy or speed. We cover benchmark interpretation in a separate article on agent evaluation, and tool adoption in a comparison of usage surveys.

Instruction files: four tools read AGENTS.md as is

These tools have used different names for repository instruction files, but as of 2026-10-06 all five can read AGENTS.md. The difference is under what conditions.

Two points matter in practice. First, Claude Code skips AGENTS.md if any CLAUDE.md exists. Adding a personal CLAUDE.local.md has the same effect. In that case the docs say to import it by putting @AGENTS.md on the first line of CLAUDE.md. Before 2.1.281, some sessions, such as those with telemetry disabled, did not read AGENTS.md; we covered that issue in a separate article. Second, the AGENTS.override.md that Codex users rely on is Codex-only. The Claude Code docs state that it does not read this file.

Skills: the same standard, but no single folder

All five tools' docs describe Agent Skills as an open standard. The standard defines six fields for the SKILL.md frontmatter (the YAML metadata block at the top of the file), of which name and description are required. name must be at most 64 characters of lowercase letters, digits and hyphens, and must match the folder name.

But each tool looks for project skills in different folders.

.agents/skills/ appears in the docs of four tools (Codex, Copilot, Cursor and Gemini CLI) but not in Claude Code's table of skill locations. .claude/skills/ appears in the docs of three (Claude Code, Copilot and Cursor) and not in the Codex or Gemini CLI docs. So, going only by documented behavior, there is no project folder that all five tools read.

MCP: same support, different config files and limits

All five tools can attach MCP servers. Where you write the server definitions differs by tool.

Even for the same MCP server, the configuration format differs by tool (JSON, TOML or a web settings page), so keeping one configuration file in the repository for every tool to share, as you can with instruction files or skills, is not yet practical. A "—" in the table means we did not find a limit worth listing in the documents we read.

Local approval defaults: "automatic" means different things

This is where the tools differ most. When the agent runs on your own machine, who approves its actions by default, and do shell commands run inside a sandbox?

The word "automatic" appears three times in the table, but it refers to different things.

• Claude Code's auto has a classifier take over the confirmation a person used to give. The shell sandbox is off by default, so a command the classifier lets through has no separate OS-level boundary. The docs also say that adding a sandbox or container adds a layer of defense.
• With Codex's auto_review, the sandbox first limits file writes and network access, and the reviewer agent only checks requests to cross that boundary. The default is a human reviewer.
• Cursor's Auto-review combines the two. Shell commands that can run in the sandbox go to the sandbox; commands that cannot, along with MCP and Fetch calls, go to the classifier.

So the practical question is not whether approval is automatic, but what protection remains if the classifier approves the wrong action. If the sandbox is also on, the write-path and network limits remain; if it is off, the full permissions of your user account remain. What a sandbox actually blocks, and what it does not, is covered with measurement papers in our article on agent sandboxes.

Cloud runs: the environment becomes the boundary instead of approval

Four of the five tools can hand a task to the cloud. In the cloud a person often does not approve actions in real time, so the boundary becomes how the environment is isolated and how network access and secrets are handled.

Two things stand out. Cursor's docs state that Cloud Agents "never ask you to approve an action". And Copilot's docs spell out the firewall's limits: it does not directly cover MCP server processes, and sophisticated attacks may bypass it. When configuring a cloud environment, assume the agent can use anything inside it and include only the secrets and network access the task actually needs; that is consistent with what the docs describe.

Billing units: five tools count five ways

Prices change often, so we recorded what each tool counts rather than amounts. All of this was checked on 2026-10-06.

Requests, tokens, credits and subscription limits are mixed together, so you cannot directly compare the cost of the same task across tools. The only way to compare is to run a few of your own tasks in each tool and read the values on its usage page. This article did not do that measurement.

What changed since the June initial note

This article rewrites an initial note published on 2026-06-16. Below are statements from that note and what today's official documentation shows.

What you can do today

Only items that follow directly from the documentation comparison above.

What is not settled yet

• This article is a rewrite of the 2026-06-16 initial note. The initial note mostly cited blogs and comparison articles, and many of its figures were not checked against primary sources. This version relies only on each vendor's official documentation and standards documents, and statements we could not check were removed.
• We did no measurement of our own. Every cell describes documented behavior. For example, we did not run the tools to confirm whether Claude Code actually reads .agents/skills/, or whether Codex reads .claude/skills/. A path that is not in the docs might work in practice, and the reverse is also possible.
• Classifier accuracy is unknown. All three vendors say their classifiers can be wrong, but we found no public documentation of how often. This article does not rank classifier approaches.
• We looked at five tools only. Windsurf, AWS Kiro, Google Antigravity, Jules, Devin, Aider, Cline and OpenCode, which appeared in the initial note, were left out because we did not check their official docs this time. That does not mean they matter less.
• For Copilot we focused on cloud agent. AGENTS.md and skill support is based on docs that span several Copilot environments, but we did not compare the approval behavior of Copilot CLI or the IDEs.
• We did not compare model performance or output quality. This article cannot tell you which tool does better on the same task.
• Defaults and pricing change quickly. Claude Code's auto default starts at 2.1.283, and Cursor's Auto-review recommended default at 3.6. On versions newer than this article's baseline (Claude Code 2.1.290, Codex CLI 0.160.1, Gemini CLI 0.62.0), the tables may no longer hold.

References

Official documentation was downloaded as Markdown sources or through body APIs and compared on 2026-10-06.

The 2026-06-16 initial note was rewritten to current standards on 2026-10-06. Benchmark and market figures and secondary-source citations from the initial note were removed because we could not check them against primary sources. If defaults or pricing change, we will update this article and record the revision date.