Agent Ecosystem Map: One View for AI Coding Tools

Harness Control Plane was renamed to Agent Ecosystem Map (AEM). The old URL is kept so existing links do not break, but the current package is agent-ecosystem-map and the short command is aem.

The rename reflects a broader product. The first version mapped skills, agents, MCP servers, and rules. The current repository also covers coding-agent sessions, live processes, provider usage, remote machines, registries, and diagnostic exports.

The Problem It Solves

Claude Code, Codex, Gemini CLI, Cursor, Windsurf, Copilot, and Continue keep instructions and agent state in different paths and formats. Once a developer uses several of them, three questions become surprisingly expensive:

1. Which tool has this skill or rule?
2. Which copy is current?
3. Where did yesterday’s agent session and token usage go?

AEM scans local configuration and exposes a single inventory. It does not create a universal config standard; it makes the existing files and sessions visible and provides controlled copy and editing workflows.

What the Current Release Discovers

The repository documents these seven primary coding tools:

Paths and formats change as upstream tools evolve. Treat the project’s current README and scanner code as the source of truth, not a copied table in an older tutorial.

The map supports type/provider/category filters, client-side search, collections, registry import, provider-targeted install, inline editing, diff-before-save, and warnings before destructive changes.

Copy-Based Connections Replaced Symlinks

The original HCP design connected assets with symlinks. That made one file visible to several tools, but it also coupled their lifecycles: editing or deleting what looked like a provider-local file could affect the shared source.

Current AEM releases use provider-owned copies by default:

source skill
  -> Claude-owned copy
  -> Codex-owned copy
  -> Gemini-owned copy

Matching assets are grouped in the UI with provider badges. Disconnecting or deleting one copy is scoped to that provider. Older symlinked assets can be converted when reconnected.

This is safer than the old deletion behavior, but copies can drift. AEM includes health and drift views; teams still need an explicit source-of-truth policy. If a rule is security-sensitive, review changes before distributing it rather than treating sync as automatic trust.

AgentSync addresses a narrower MCP-config workflow. AEM inventories a larger local agent ecosystem.

Sessions and Usage Are Now First-Class

The sessions browser normalizes logs from several coding agents and can show a timeline, token usage, live process metadata, cost estimates, activity, search, labels, and Markdown handoff export.

The usage dashboard probes supported providers using local credentials and exposes rate-limit or balance information where the provider makes it available. Current README documentation lists 18 usage providers, more than the seven tools in the asset scanner.

These features handle sensitive data. Session logs may contain source code, prompts, file paths, customer information, and tool results. OAuth tokens and local credential metadata deserve the same protection as the original clients.

Before enabling session search or usage tracking:

• inspect which directories and credentials the provider adapter reads;
• restrict filesystem and OS-user access to the local AEM data;
• avoid exposing the HTTP API on a shared network;
• use the redacted diagnostic export for support;
• define retention for indexed session content;
• review exported handoffs before sharing them.

Local, macOS, Raycast, and Remote Interfaces

Run the current CLI without a global install:

npx agent-ecosystem-map

Or install it globally:

npm install -g agent-ecosystem-map
aem

The package currently requires Node.js 18 or newer. The web UI opens on http://localhost:3000. A native macOS app is distributed through GitHub Releases, and the repository links a Raycast extension for keyboard-first access.

For a remote machine:

# On the remote host
aem --headless -p 3000

# On the local machine
ssh -L 3000:localhost:3000 user@your-vps

Headless mode binds to 127.0.0.1 by default. If you deliberately bind to 0.0.0.0, the CLI requires bearer authentication. Prefer the SSH tunnel: an application-level token does not replace network policy, host hardening, and credential isolation.

The remote command center can inspect sidecar status, sessions, processes, usage, MCP runtimes, tunnels, and copy-sync plans. Use preview/dry-run before apply and keep rollback data.

Architecture and Operating Boundary

The current package uses a Node.js local agent, SQLite persistence, a React web UI, and a SwiftUI desktop application. better-sqlite3 and ssh2 are declared runtime dependencies. File watchers and WebSockets update the UI after local changes.

This design keeps most data local, but “local” is not automatically safe. The process can read multiple assistants’ configs, credentials metadata, session logs, and remote-host settings. Run it under a dedicated user boundary where practical, back up the SQLite state before major changes, and inspect new releases before granting broader filesystem access.

Who Should Use It

AEM is useful when at least two of these are true:

• several AI coding tools are active on one machine;
• skills, rules, agents, and MCP configs are difficult to inventory;
• session history is fragmented across clients;
• subscription windows need one operational view;
• local and remote agent environments must be compared;
• a team needs reviewable asset distribution rather than manual copying.

With one client and a handful of files, ordinary version control may be simpler. The map is most valuable when the inventory and drift problem already exists.

License and Naming Caveat

The repository is public, but its current license is Business Source License 2.0. The license permits personal use, internal business production use, modification, and internal integration. It restricts competing commercial or hosted products and states a change to MIT on April 6, 2030.

BSL is source-available, not an OSI-approved open-source license. Review the actual LICENSE file for commercial use; this summary is not legal advice.

Verification Checklist

• Install agent-ecosystem-map, not the former package name.
• Run aem scan before changing any asset.
• Verify which provider owns each connected copy.
• Preview diffs and downstream impact before save or delete.
• Keep the web service on localhost or behind an SSH tunnel.
• Treat sessions, diagnostics, OAuth data, and remote settings as sensitive.
• Back up state and test rollback before large copy operations.
• Check the current README and license before relying on feature or usage terms.

Current Sources

• Agent Ecosystem Map repository and README
• Current package manifest
• Business Source License 2.0 terms
• GitHub Releases

AEM is no longer the symlink dashboard described by the first version of this article. It is a broader local operations surface for AI coding tools, and that broader access deserves equally broader security review.