# CodexGuild > Tuning for AI coding agents (Claude Code, Codex, Cursor, Gemini CLI, Hermes and other MCP agents): what changed in a project's dependencies, vulnerabilities in the installed versions, known fixes for errors, package checks before install, security-scanned skills and MCP servers, and a dated knowledge base. Agents: start with the start-here guide. To set CodexGuild up for a user, follow its section "0. First-time setup" — the user only creates an agent key. ## Start here - [Start-here guide (the codexguild skill)](https://api.codexguild.com/v1/start-here.md): connection, session sync, error lookup, skills, knowledge base, rules and limits - [Per-harness setup (JSON)](https://api.codexguild.com/v1/setup): exact MCP commands, config files and skill install for each harness; `https://api.codexguild.com/v1/setup/` for one - [Remote MCP server](https://api.codexguild.com/v1/mcp): Streamable HTTP, header `Authorization: Bearer $CODEXGUILD_API_KEY` - [Plans and limits (JSON)](https://api.codexguild.com/v1/plans) ## Getting started - [Introduction](https://codexguild.com/docs): CodexGuild keeps coding agents current and safe — fresh release knowledge, security-scanned skills, known fixes for errors and package checks, through one MCP server or a small REST API. - [Quickstart](https://codexguild.com/docs/quickstart): Create an agent key and let your coding agent set itself up — or connect it over MCP by hand. - [How CodexGuild works](https://codexguild.com/docs/how-it-works): The moving parts — API, MCP, sync workers, security scanner and the knowledge base — and how data flows between your agent and CodexGuild. - [Measured results](https://codexguild.com/docs/benchmark): The same coding agent on the same 20 tasks, with and without CodexGuild — solved tasks, cost and time, and exactly how it was measured. ## Connect - [Authentication](https://codexguild.com/docs/authentication): Agent keys, how to send them, how to rotate them, and how the dashboard session differs from an agent. - [MCP server](https://codexguild.com/docs/mcp): Connect any MCP-capable agent to CodexGuild — the local server (npx -y @codexguild/mcp@latest) on your machine, or the remote Streamable HTTP endpoint for cloud agents. - [Harness setup](https://codexguild.com/docs/harnesses): Exact MCP config, instruction files and skill folders for Claude Code, OpenClaude, Hermes, OpenCode, Kimi Code, OpenClaw, Codex, Gemini CLI, Cursor, GitHub Copilot, Windsurf, Cline and Aider. - [The codexguild skill](https://codexguild.com/docs/codexguild-skill): A standard Agent Skill (SKILL.md) that teaches any agent the CodexGuild API, when to use which tool, and the rules of engagement. ## Guides - [Sync & advise](https://codexguild.com/docs/sync-and-advise): The start-of-session sync call, what it returns, how to present it — and advise, which proposes setup changes for your harness. - [Freshness](https://codexguild.com/docs/freshness): Dated releases and breaking-change flags per topic, so your agent can answer "is this still current?" instead of guessing from training data. - [Skills & security scanning](https://codexguild.com/docs/skills-and-scanning): How CodexGuild indexes thousands of Agent Skills, what the security scanner looks for, and what passed / warn / flagged mean. - [Error lookup](https://codexguild.com/docs/error-lookup): When an agent is stuck on an error, codexguild_debug returns known causes and fixes — verified knowledge-base entries and deprecated APIs for your exact versions. - [Projects & teams](https://codexguild.com/docs/projects-and-teams): Track a project's tech stack without any agent running — pasted manifests or GitHub repositories, never source code — and share projects and a plan with your team. - [Agent training](https://codexguild.com/docs/agent-training): Every mistake CodexGuild stops becomes a lesson. Your coding agents start the next session with the lessons from their own mistakes, and one agent's hallucinated package warns every agent on CodexGuild. - [Agent notes](https://codexguild.com/docs/agent-notes): Coding agents forget everything between sessions. Agent notes let them keep short, encrypted lessons per repository — their own corrected mistakes and the project's unwritten rules — and start every session with them, on any machine and in any harness. - [Secure coding skills](https://codexguild.com/docs/secure-coding): CodexGuild's own security skills teach coding agents what to check before they write an endpoint, a query, auth code, an upload or an outbound request — matched to the project's framework, proposed by sync and advise, and reinforced by the pre-write hook. - [Tune-up: readiness & coach](https://codexguild.com/docs/tune-up): Measure how well a repository is set up for a coding agent and where your agent sessions lose time — readiness score, repeated errors, retry loops, refused commands, unchecked code, unused MCP servers. Runs locally with npx, no account needed. - [Package guard](https://codexguild.com/docs/package-guard): Check packages before an agent installs them — hallucinated names, malicious packages, known vulnerabilities and typosquats — via MCP, REST or a Claude Code, Cursor, Codex or Kimi Code hook. - [Command guard](https://codexguild.com/docs/command-guard): Stop coding agents from running destructive commands — rm -rf of your home directory, database resets, force pushes, infrastructure teardown, secrets sent over the network — and from switching off hooks, CI checks and git hooks. A local hook, no API key needed. - [Agent workflow review](https://codexguild.com/docs/workflow-review): Security review for GitHub Actions workflows that run coding agents — untrusted triggers with secrets, issue and PR text in prompts or shells, pull_request_target with fork code, unrestricted agent tools, broad permissions. - [MCP server catalog](https://codexguild.com/docs/mcp-catalog): Every server in the official MCP Registry, reviewed before an agent connects to it — package checks, metadata scan, tool-poisoning scan of public remotes and change tracking. ## Reference - [REST API](https://codexguild.com/docs/api): Every endpoint, grouped by area. Base URL, auth, request and response shapes. - [MCP tools](https://codexguild.com/docs/mcp-tools): All 25 remote codexguild_* tools with their arguments, plus the local-only tools of the stdio server. - [Stages & limits](https://codexguild.com/docs/limits): What each plan (Free, Guard, Pro, Team) includes, how daily and per-minute limits work, and how agents should behave when they hit one. - [Errors](https://codexguild.com/docs/errors): The error envelope, every error code, and what an agent should do for each. ## Security - [Security model](https://codexguild.com/docs/security-model): The threat model behind CodexGuild — untrusted content, skill supply chain, keys and data — and the rules every connected agent follows.