Crush combines a coding agent with a serious terminal interface
Crush works inside a repository, keeps multiple sessions, calls coding tools, and uses language-server diagnostics as context. A model can come from Charm Hyper, a long list of hosted providers, Amazon Bedrock, Vertex AI, or a local OpenAI-compatible endpoint. Models can change during a session without discarding the conversation. The terminal interface is available across macOS, Linux, Windows, Android, FreeBSD, OpenBSD, and NetBSD through packages or release binaries.
Provider choice is more than a settings checkbox. Different models have different context windows, tool behavior, prices, and authentication. Crush maintains a provider catalog through the separate Catwalk project and updates that catalog automatically unless the user disables it. Restricted environments can pin the embedded catalog or point at a local file. That control matters when an organization needs repeatable model metadata instead of a background update.
Permission prompts are useful only if teams keep them
Built-in tools ask for approval by default. Users can allow selected operations, deny tools so the model cannot see them, disable individual skills, or block tools exposed by an MCP server. These are practical controls because a coding agent can edit source, run shell commands, and reach services. A narrow allow list is easier to audit than a broad promise that the model will behave.
The README also documents --yolo, which skips every prompt. That option may be convenient in a disposable sandbox, but it removes the main human checkpoint. Shared workspaces add another detail: the first client fixes process-wide --yolo and debug settings for that working directory. Later clients cannot quietly change them. Teams using crush serve should make the workspace policy explicit before anyone attaches.
What happened when we ran it
Our sandbox cloned commit 37f36e9 into a fresh unprivileged Debian container with 3 CPUs and 8 GB of RAM. The repository had 1,100 files, about 147,342 source lines, and occupied 9 MB. Go installed 452 packages in 117 seconds. The dependency step was the shortest part of a source verification that took almost 8 minutes end to end.
The build completed successfully in 155 seconds. Tests then ran for 192 seconds and reported 52 passed with 0 failed out of 52. The checkout contained 10 CI workflow files, no Dockerfile, and no tests directory. Go tests do not require a top-level folder, so the missing directory does not conflict with the passing suite we measured.
Our run did not connect a model, spend provider credits, edit a real repository, start an MCP server, or test an interactive approval. It verifies that this commit compiled and passed the detected Go suite in the stated container. Agent quality, tool judgment, context use, and cost still depend on the chosen model and the work given to it.
Project configuration is executable code
Crush now prefers crushrc, a Bash-like configuration interpreted consistently across platforms. It can add providers, register models, set permissions, configure language servers, include files, and run command substitutions. The older JSON format remains supported but is deprecated, and command substitutions there also execute at load time. The README directly warns users not to launch Crush in a directory whose configuration they have not reviewed.
That warning should shape team policy. A cloned repository can contain local .crushrc or crushrc files with higher priority than the global configuration. Treat them like build scripts: inspect changes in code review, keep secrets in an external manager, and avoid sourcing files fetched from the internet. Global AGENTS.md and CRUSH.md files add more instructions, while project skill directories can introduce agent behavior.
MCP and skills extend both capability and risk
Crush supports stdio, HTTP, and SSE MCP servers. Configuration can set environment values, headers, timeouts, disabled tools, OAuth, and sessionless behavior. Release v0.91.2 specifically fixed GitHub MCP by detecting its sessionless connection pattern. The same release corrected code indentation in the interface and added 3 models to Hyper, evidence that integrations and display behavior are moving quickly.
Agent Skills are discovered from several global and project directories, including .agents/skills and .claude/skills. A skill can be model-invoked, user-invoked through the command palette, or hidden from automatic use. This makes recurring workflows portable, though instructions from an untrusted skill can steer tool use. MCP credentials, enabled tools, and skill sources deserve the same review as the agent's shell permissions.
The source is available now and becomes MIT later
Crush uses FSL-1.1-MIT rather than a standard permissive open-source license today. Internal use, education, research, and professional services for a compliant licensee are permitted. Offering a competing commercial product or service is restricted. Each released version receives an MIT license on the second anniversary of the date that version was made available. Businesses near the competing-use line should obtain legal advice before redistribution or service use.
GitHub showed 27,705 stars, a push on August 26, 2026, and 672 combined open issues and pull requests. Version 0.91.2 shipped the same day. That pace gives users quick fixes, but it also argues for pinned versions and a small upgrade check around config, providers, MCP connections, and permissions. Crush is ready to try; safe adoption depends on preserving the controls it already provides.