com.codexguildPublished by codexguild.comOfficial publisherv1.17.0Updated Oct 29, 2026
What changed in your stack since the model's cutoff, error fixes, and security-scanned skills/MCPs
CodexGuild's hosted MCP server (api.codexguild.com), published by codexguild.com; API key required; Streamable HTTP; 7 tools.
No AI overview yet: these facts come from the registry entry and the server itself.
Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.
Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.
Read https://sourceweft.com/mcp/com.codexguild%2Fcodexguild/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.Add this to your client's mcpServers config.
{
"mcpServers": {
"codexguild": {
"type": "http",
"url": "https://api.codexguild.com/v1/mcp",
"headers": {
"Authorization": "Bearer <YOUR_TOKEN>"
}
}
}
}Security-audit the skills installed on THIS machine (~/.claude/skills, Claude plugins, ~/.codex/skills, ~/.agents/skills, ~/.hermes/skills, project skills…). Detects pipe-to-shell, credential exfiltration, hidden unicode, prompt injection, agent-config tampering and safety bypasses. Runs locally — nothing is uploaded.
pathsverboseLint the agent instruction files in this project (AGENTS.md, CLAUDE.md, GEMINI.md, .cursorrules…): size per session, missing build/test commands, README copy, generic advice, secrets, machine-specific paths, prompt-injection and other scanner findings. Runs locally — file contents are not uploaded.
filesSecurity-review the GitHub Actions workflows in this project that run coding agents (claude-code-action, run-gemini-cli, codex, opencode, aider…): triggers outside contributors control (pull_request_target, issue_comment, issues) combined with secrets, issue/PR text interpolated into prompts or shells (prompt injection), unrestricted agent tools, broad permissions, unpinned agent actions. Runs locally — nothing is uploaded.
filesFind deprecated and removed APIs in this project's code for the exact versions it runs (from the lockfiles): e.g. `app.mount` deprecated in hono 4.13, with the replacement and where it is used (file:line). Only package names and versions are sent to CodexGuild; the code is searched locally and never uploaded. codexguild_sync runs this automatically.
cwdPattern-scan this project's OWN code for common vulnerability classes (OWASP/CWE): hardcoded secrets, SQL injection via string concatenation, eval/shell injection, insecure deserialization, weak crypto, SSRF, path traversal, and IDOR-prone lookups — with file:line and a fix for each. Pattern matching, not proof: read a finding before changing code. Runs locally — nothing is uploaded. Run this before finishing a feature/PR that touches routes, queries, auth, serialization or file/network I/O; codexguild_sync also runs it once at session start.
cwdScore how well THIS repository is set up for a coding agent (0–100): instruction file quality and whether it names the build/test commands, test and type-check commands, lockfile, secrets kept out of git, CI, safe agent workflows, CodexGuild hooks — with the fixes worth doing, biggest first. Runs locally — nothing is uploaded.
cwdReview this project's recent agent sessions (Claude Code / OpenClaude transcripts on this machine) for where time was lost: the same error hit repeatedly, retry loops, refused tool calls (with allowlist suggestions), edits that missed, files re-read many times, compactions, sessions that ended with unchecked code, MCP servers that never get used — and what to change. Use it when the user asks how to make the agent work better here. Runs locally — transcripts are not uploaded.
allcwddays75% of the applicable checks met
How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.
Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.
Declare a license in the repository or the registry entry.