# AI coding agents

> The Nexafon agent skill teaches Claude Code, Cursor, Codex and Copilot to integrate Nexafon correctly, with references generated from the tested examples.

Source: https://docs.nexafone.so/v1/tools/ai-agents/

The **Nexafon skill** gives an AI coding agent what it needs to add Nexafon to an app on the first try: when to use
which package, the integration steps, the security rules, and code that comes from Nexafon’s tested examples.

## Install it

In your project:

:::note[Not published yet]
The Nexafon packages are not on npm, Packagist or PyPI yet, and `go get` finds the Go module only once the Nexafon
repository is public and tagged, so installing them by name fails for now. Until then,
[install them from a checkout of the repo](/v1/quickstart/#install-from-a-checkout). The install commands shown here
are the ones to use after release.
:::

```sh
npx @nexafon/cli skill add
```

It writes `.claude/skills/nexafon/` (Claude Code loads it in its next session), a Nexafon section in `AGENTS.md` (read
by Codex, Copilot, Jules and other agents) and `.cursor/rules/nexafon.mdc` for Cursor. Until the CLI is published, run
it from a checkout, as [the CLI page](/v1/tools/cli/) shows.

Claude Code can also install it as a plugin from the Nexafon repository’s marketplace entry
(`.claude-plugin/marketplace.json`): `/plugin marketplace add Keyd-Solutions/nexafon`, then
`/plugin install nexafon@nexafon`.

Then ask the agent, for example, “add the Nexafon inbox to this app”.

## What it teaches

- **When to use what**: web or mobile (the mobile SDKs are [coming soon](/v1/mobile/), so it does not invent them), a
  single business or a [partner](/v1/partners/) platform, and which framework guide applies: HTML, React, Next.js,
  Vue, Nuxt, Angular, Svelte, WordPress, Laravel/PHP.
- **The steps**: keys → a server token endpoint → the component → appearance, preferring `nexafon init` to do the
  scaffolding and `nexafon doctor` to check it.
- **The rules**: never put a secret key in frontend code or a public env variable; keep sessions in memory only;
  register every origin as an allowed website and an embed domain; sign tokens only for the app’s own signed-in user,
  answer `401` without one and `403` to signed-in users who are not staff (never customers; everyone only in an app
  with no customer accounts at all), and send the user’s real `emailVerified` and a `role` (`agent` unless the user is
  one of the app’s own admins).
- **Your brand**: it reads the colour from your Tailwind config, CSS variables or theme files and passes it as
  `appearance.primaryColor`.
- **References** per framework and server language (Node, PHP, Python, Go), webhooks, events, errors and theming.

## Never out of date

Every code block in the skill names the example or docs snippet it comes from, such as `examples/react/src/App.tsx`;
CI fails when a block differs from its file (`task skill:check`). The examples themselves run end to end against
Nexafon in CI, so the agent copies code that works with the current SDK.

The skill is also checked by evals: an agent that has only the skill and the CLI integrates a fresh React (Vite) app
and a fresh Laravel app, and a browser test confirms the inbox loads through the app’s own token endpoint.

For questions an agent should look up rather than know, give it the [MCP server](/v1/ai/mcp/): it searches these docs
and the example apps while the agent works, and with a test key sends a test message and shows your webhook deliveries
and recent errors. Agents without MCP can read [`/llms.txt`](/llms.txt) or any page’s `.md` version.