Every frontier mind,
inside Codex.

Caara runs Claude Code and Antigravity as native Codex subagents, so one session can use every model you subscribe to.

Every subscription, used to the max

Your Claude and Antigravity plans carry subsidized usage that idles while you work in Codex. Spawning those agents as subagents spends it, without ever leaving your harness.

Save Fable for the hard parts

Route judgment-heavy work to Claude Fable and let cheaper seats handle execution. A panel with one Fable seat outscores Fable working alone.

A second model checks the diff

Cross-family review catches what self-review keeps missing. Gemini reads Claude's work with different habits and different blind spots.

Local and open

MIT licensed, served on 127.0.0.1, with every failure mode explicit. Read the source, build it yourself, or install from Homebrew.

Panels of models outscore any model alone

OpenRouter's Fusion benchmark ran 100 deep-research tasks. Every multi-model panel beat every solo frontier model, and a budget trio outscored solo GPT-5.5 and Opus 4.8 at half the cost.

DRACO deep-research score, higher is better

Fable 5 + GPT-5.5

69.0%

Opus 4.8 + GPT-5.5 + Gemini 3.1 Pro

68.3%

Claude Fable 5, solo

65.3%

Gemini 3 Flash + Kimi K2.6 + DeepSeek V4

64.7%

Synthesis helps even without model diversity: Opus 4.8 paired with itself scored 65.5% against 58.8% solo. Caara gives a Codex session the same structure. Codex orchestrates while Claude Code, Antigravity, and native Codex seats work the task.

Send each task to the model that fits it

The prefix of the Codex model string picks the driver. Everything after it belongs to the agent.

claude/*

Claude Code, via the Claude Agent SDK

Frontend work, design judgment, careful refactors.

fablesonnethaikuopus

native

Codex itself, no bridge involved

Orchestration, execution, long tool chains.

gpt-5.5

agy/*

Antigravity CLI

Code review and large-context sweeps.

gemini-3.5-flashgemini-3.1-progpt-oss-120b

diagnostic/*

Built-in test driver, runs in-process

Smoke tests for transport, recovery, and cancellation.

basicrecoveryecho

One request shape, every agent

Codex sends its usual streaming Responses call to 127.0.0.1:8787. Caara reads the model prefix, starts or resumes the matching agent, and streams the result back as SSE.

the whole contract

{
  "model": "claude/fable",
  "input": "Review this diff for regressions.",
  "stream": true
}

codex provider config, written for you by the installer

[model_providers.caara]
base_url = "http://127.0.0.1:8787/v1"
wire_api = "responses"
query_params = { effort = "high" }

Follow-up turns resume the agent's own session.
Text, reasoning summaries, and tool activity stream back live.
Closing the Codex stream cancels the in-flight turn.
Bad input, unknown drivers, and unresumable sessions fail loudly.

The Panel skill referees the room

Caara ships with a Codex skill that convenes several subagents on one task and delivers a single adjudicated result. It picks a strategy from the risk you describe, or you name one yourself.

Group deliberation usually decays into agreement. The skill is built to prevent that:

The orchestrator checks artifacts mechanically instead of reading them, which keeps its verdict unbiased.
Positions travel between seats as file paths. Paraphrasing would leak the orchestrator's lean.
A debate round counts only when a position changes for a stated reason. Two stalled rounds end the run.
Every seat works in a quarantined directory that git and search tools skip.

Ensemble

For work where one model would miss things.

Isolated seats attempt the same task in parallel, then a synthesis seat merges the results.

Debate

For contested calls between competing approaches.

Seats argue across rounds and keep their disagreements on the record.

Cross-review

For diffs, plans, and anything you just wrote.

One seat does the work and a seat from another model family reviews it.

Running in two minutes

1
Install
```
brew install --cask niieani/tap/caara
```
Installs the signed binary, starts the per-user service, runs the doctor, and verifies health. Linux tarballs live on GitHub Releases. Running your agents in a sandbox? Re-run the installer as caara install-service --yolo so subagents skip permission prompts — see Permissions below.
2
Check the generated roles
```
ls ~/.codex/agents/caara-*.toml
```
The installer detects claude and agy on your machine and writes a Codex agent role for each available model. Updates keep your edits.
3
Delegate from Codex
```
spawn a caara-claude-fable subagent to redesign the settings page
```
Follow-up turns resume the same agent session. caara status and caara doctor keep the service observable.
4
Teach Codex to delegate (opt-in)
```
caara install-codex-roles --agents-md --panel-skill
```
Maintains a marked guidance block in ~/.codex/AGENTS.md — reach for caara subagents when a different model family's take adds value: reviews, second opinions, contested design calls — and installs the panel skill globally as $panel. Never automatic; uninstall removes both.

Permissions

Caara subagents run without an approval loop: there is nobody to click "allow" when an external agent wants to run a tool. Every install has to pick one of two postures up front.

Default: dontAsk

Out of the box the Claude driver runspermission_mode=dontAsk: any tool call that is not already pre-approved is denied instead of prompting. Pre-approval comes from the permission rules configured in your repo (.claude settings) or from allowed_tools /disallowed_tools query params on the role.auto swaps the deny for a model classifier that approves or denies each prompt.

Safe by default — but curating allowlists per repo is tedious and easy to get wrong, and a missing rule surfaces as the subagent silently losing a tool mid-task.

Sandboxed: --yolo

If you already run your agents inside a sandbox (container, VM, throwaway checkout) with flags like--allow-dangerous-skip-permissions, install Caara the same way:

caara install-service --yolo

This enables the dangerous-skip gate in the service config and installs bypass roles (permission_mode=bypassPermissions for Claude, dangerously_skip_permissions=true for Antigravity). The sandbox is the security boundary; the subagents stop tripping over permission denials. This is the recommended posture.

Subagents can widen a sandboxed Codex

Caara's permission posture is its own, not Codex's. If you install with--yolo — or configure any role with a security posture looser than your harness — a sandboxed or non-permissive Codexwill be able to get around its own restrictions by spawning a Caara subagent: the subagent runs with Caara's posture, not the caller's. Keep Caara at least as strict as the strictest Codex setup that can reach it, or make sure the sandbox itself contains both.

Reference, the short version

The full protocol and design spec lives in docs/caara.md. This is the map.

Endpoints and drivers

Caara serves POST /v1/responses (streaming only, Responses SSE out) and a shallow GET /healthon 127.0.0.1:8787. Model prefixesclaude/, agy/, and diagnostic/ select the driver. Provider query parameters become driver options, and unknown option names are rejected.

Claude driver options

param	values	default when unset
effort	low, medium, high, xhigh, max	Codex's advisory effort for the turn
max_budget_usd	positive number	no budget cap
tools	default, disabled, or a comma-separated list	the Claude Code tool preset
additional_directories	comma-separated absolute paths	none
allowed_tools, disallowed_tools	comma-separated tool lists	none beyond your repo's rules
permission_mode	auto, dontAsk, bypassPermissions	dontAsk
include_partial_messages	true, false	true
activity	on, off	on

Interactive permission modes are rejected because subagent turns have no approval loop — see Permissions.bypassPermissions also requires starting the server with --allow-dangerous-skip-permissions(what install-service --yolo sets up).

Antigravity driver options

param	values	default when unset
model	model override	the role's model suffix
effort	low, medium, high, xhigh	Codex's advisory effort, else medium
sandbox	true, false	follows the Codex sandbox posture
print_timeout_seconds	1 to 86400	7200
add_dirs	JSON array of absolute paths	none
reasoning, activity	on, off	on
dangerously_skip_permissions	true, false (server-gated)	false

CLI

command	does
caara	run the bridge in the foreground
caara install-service	install the binary, service, and Codex roles, then verify health
caara status, caara doctor --fix	inspect and repair the installation
caara install-codex-roles	regenerate Codex agent roles for available drivers
caara uninstall-service --purge	remove the service, and state only when asked

Config is strict YAML at ~/.config/caara/config.yaml. State and logs live under ~/.local/state/caara.

Sessions and state

Session bindings are keyed by agent kind plus Codex thread id, and they hold resume metadata only. The external agent stays the source of truth for its own conversation. When a session can no longer be resumed, the agent asks the managing session to restate context instead of silently starting over.

Every frontier mind,inside Codex.