fx is Vercel Labs' coding-agent harness and CLI, written in Zig and released under Apache-2.0. It went public on 11 August 2026 and has collected 1,951 stars and 198 forks in eleven days. The project labels itself experimental, and the version numbers back that up: five releases between 17 and 21 August, still at v0.0.5.

The design goal is stated plainly: minimalism and performance from the system prompt outward, landing in a 7.8 MiB binary. Where most terminal agents have converged on a full-screen TUI, fx deliberately goes the other way — its output style and form factor aim to sit closer to a Unix shell than to an "IDE in the terminal". fx ask "explain the changes in this repository" is a single request; fx on its own opens an interactive session rooted at the current directory; fx sessions lists saved work and fx session resume last picks it back up. JSON and quiet requests stay noninteractive by default, with prompt text written to stderr so JSON stdout stays parseable.

Authentication is unusually pluralistic. fx login signs in through the Vercel AI Gateway, but fx login codex and fx login grok attach an eligible ChatGPT or Grok subscription over OAuth instead. The project is explicit that neither of those OAuth tokens is sent to the Gateway: the Codex session lives at ~/.fx/chatgpt-auth.json and the Grok session at ~/.fx/grok-auth.json, each used only against its own authenticated catalog. /setup switches providers, /model lists the active provider's fetched models, and /logout codex drops one subscription without touching the others.

Embeddability is the part that separates fx from the rest of the field. It builds as a native binary or WebAssembly, and a host application supplies network transport, session storage, configuration, permission handling and terminal I/O. Three surfaces are exposed: fx acp connects the native agent to editors and other Agent Client Protocol clients, createFxAgent() embeds the agent core in a JavaScript host via fx-core.wasm, and createFxTerminal() embeds the interactive terminal via fx-term.wasm. The WebAssembly SDK is flagged experimental. On top of that, the agent extends through skills, MCP servers and subagents, with fx-native project skills discovered from .fx/skills.

The permission model is more considered than the version number suggests. fx starts in auto mode: routine, understood development actions run directly, while unresolved sensitive ones get one bounded automatic review, and a blocked action can return an exact approval request that the agent sends to the real permission screen. Ordinary question text never grants permission. Inside a saved session, /permissions remember <allow|deny> <tool-name> <arguments-json> stores an exact confirmed rule without running the action, and /permissions revoke <rule-id> removes it even after the workspace or file state has changed. Release v0.0.5 on 21 August added the Codex and Grok subscription routes and .fx/skills discovery, but also shipped two breaking changes: approved captured, background and monitor commands now run as ordinary host subprocesses with sandbox configuration, status fields and commands retired, and the /provider slash command was folded into /setup.

That sandbox removal is the thing to weigh. Combined with an auto default and a self-declared experimental status, fx asks for more trust in its permission logic than a harness at v0.0.5 has had time to earn. Building from source needs Zig 0.16.0+, which is still a moving target of its own.