Guides
Projects & teams
Track a project's tech stack without any agent running — pasted manifests or GitHub repositories, never source code — and share projects and a stage with your team.
A project in CodexGuild is its tech stack: dependency names and versions. Nothing else — no source code, no file contents beyond what is needed to read those names and versions.
CodexGuild watches every project and raises an alert when a pinned version gets a vulnerability (OSV: GHSA, PyPA, Go, RustSec…), a verified security advisory, or a new major release. Alerts land in the dashboard under Alerts, also when no agent is running.
Three ways in
| Source | How | Refresh |
|---|---|---|
| Your agents | every codexguild_sync with a project key (the local MCP server sends one per repository) | on each sync |
| Pasted files | Dashboard → Projects → Add project: upload or paste package.json, requirements.txt, pyproject.toml, go.mod, Cargo.toml — and their lockfiles for exact versions | add it again |
| GitHub (Stage 1+) | Connect GitHub, choose repositories, Import from GitHub; optionally a folder of a monorepo | daily, or Refresh |
Pasted files are parsed on the server with the same detector the local MCP server uses, then discarded: only the dependency list is stored.
What the GitHub App can read
The CodexGuild GitHub App asks for Contents: read-only and Metadata: read-only on the repositories you choose during installation — nothing on other repositories, no write access, no webhooks. From those repositories CodexGuild fetches only these paths, in the chosen folder, two folder levels below it and its parent folders (for monorepo lockfiles):
package.json, package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock,
requirements.txt, pyproject.toml, poetry.lock, uv.lock, Pipfile.lock, go.mod, Cargo.toml, Cargo.lock,
.nvmrc, .node-version, .tool-versions, .python-version.
Access tokens are minted per request (one hour, read-only) and never stored. When you connect, GitHub asks you to authorize once so CodexGuild can confirm the installation is yours; that user token is dropped right away. Disconnecting in the dashboard stops refreshes; uninstall the app on GitHub (Settings → Applications) to revoke access entirely.
Teams
- A team has an owner, admins (invite and remove members) and members.
- On Stage 3 the owner can add up to 10 members by e-mail. Members' agents work under the owner's stage, each account with its own daily counters. If the owner moves below Stage 3, members fall back to their own plan.
- Team projects are shared with every member, alerts included, and count against the owner's stage. Anyone in the team can add one; the creator, the owner and admins can move or delete it.
- Invitations are valid for 7 days and only for the invited e-mail address.
Limits per stage
| Stock | Stage 1 | Stage 2 | Stage 3 | |
|---|---|---|---|---|
| Projects | 1 | 3 | 15 | 50 |
| …of which from GitHub | — | 3 | 15 | 50 |
| Team members | — | — | — | 10 |
The live numbers are served at GET /v1/plans. A team's projects count against the team owner's stage.
REST (dashboard session)
| Method | Path | Notes |
|---|---|---|
GET | /stack/manifests | your projects and your teams' projects |
POST | /stack/manifests | {name, files: [{path, content}], orgId?} — or {name, deps: [{name, version?, ecosystem?}]} |
POST | /stack/manifests/github | {installationId, repo: "owner/name", path?, name?, orgId?} |
POST | /stack/manifests/:id/refresh | re-read a GitHub project now |
PATCH | /stack/manifests/:id | {orgId} — move to a team, null = personal |
DELETE | /stack/manifests/:id | stop tracking (alerts go with it) |
GET | /github | connection status |
POST | /github/install-url | start the GitHub App installation |
GET | /github/installations/:id/repos | repositories the app can read |
GET / POST | /teams | your teams / create one |
POST | /teams/:id/invites | {email, role: MEMBER|ADMIN} |
POST | /teams/invites/accept | {token} from the e-mailed link |