Integrations

Works with the tools you have, through your host; even a workspace on a member's own computer, where your organisation turns that on, reaches git and AI only through the platform's brokers. Connect GitHub, model providers, identity providers, MCP servers and your SIEM, and see where each credential lives and what the workspace is handed instead.

Where the credential livesfrom the main branch

GitHub AppVerified

Workspace holdsA ticket that lives minutes and only the broker accepts. No GitHub token under guarded or strict.
Brokergit-broker, over the workspace's own socket. Mints a per-repository token for one operation.
Host keepsThe App's private key, root-owned, mode 0600, per organisation or host-wide.
ReachesGitHub: installation tokens last about an hour.

GitHub only: no GitLab, Bitbucket or Azure DevOps.

on the host

$ bin/gh-app-token --repo acme/api --dry-run
$ bin/git-broker status

Pick an integration. Where a broker exists, the real credential stays on the host and the workspace gets something useless anywhere else, or nothing. Two exceptions: the Antigravity CLI signs in inside the workspace, and the open and metered profiles mount the GitHub token.

What it is, and what it is not

Kodela connects to GitHub through a GitHub App, to Anthropic, OpenAI and Google models through host-side brokers or the console's chat, to identity providers through per-organisation OIDC, to MCP servers through the egress proxy, and to your SIEM through export files. Package registries (npm, PyPI) and Open VSX are reached through the egress allowlist.

There is no public API, SDK, webhook or personal API token, and nothing is sent to a third party on a schedule. We list only what works today; everything else is on the list at the bottom.

How it works

Each integration has one place on the host that holds its real credential: the git broker for GitHub, the Claude proxy for Anthropic, the key broker for OpenAI (off until an operator starts it), the console for identity providers and chat keys. A workspace is handed something narrower: a short-lived ticket, a per-workspace key the proxy issued, or nothing. Outbound traffic from a workspace on your host goes through the egress proxy, which logs it, and in observe mode lets it through; on a member's own computer it uses that computer's network and is observed, not enforced. The known exceptions, such as local model servers and some directly reachable AI APIs, are in the limits below.

Credentials resolve from the narrowest place that has one: the workspace, then the organisation, then the platform. An organisation can hold several accounts per provider and choose which is active.

Defaults

Integration settings and their defaults
Setting	Scope	Default	Allowed
`git_broker_enabled`	platform	`true`	`true`, `false`; restart the git broker
`claude_proxy_enabled`	platform	`false`: off until an operator turns it on	`true`, `false`; restart the Claude proxy
`claude_rate_limit_per_hour`, `claude_rate_limit_tokens_per_day`	platform, per workspace	`0`: no limit	integers
`key_broker_enabled`	platform	`false`: off until an operator turns it on	`true`, `false`; restart the key broker
`ai_platform_model`	platform, organisation	empty: no platform model is offered	model names, e.g. `claude-sonnet-5`
`ai_member_providers`	platform, organisation	`true`: members may add their own provider key	`true`, `false`
`ai_allowed_providers`	platform	empty: any host; the egress allowlist still applies	hostnames
`mcp_enabled`	platform, organisation	`false`: off until an admin turns it on	`true`, `false`
`docker_registries_allowed`	platform, organisation	`docker.io`, `ghcr.io`	registry hostnames, for workspaces with managed Docker
`egress_allowlist`	platform, organisation (add only)	GitHub's git, API and archive hosts, `.npmjs.org`, `pypi.org`, `files.pythonhosted.org`, `api.anthropic.com`, `open-vsx.org`, `openvsx.eclipsecontent.org`	hostnames; a leading dot for subdomains

Configure it

GitHub App

Create a GitHub App on your GitHub account or organisation, with its webhook turned off, installable only on that account. Install it on the repositories you choose.

Contents: Read and write: clone, fetch and push.
Metadata: Read-only.
Pull requests: Read and write: the broker's token scope and the pull-requests pane.
Issues: Read-only, only if you want the pane's issue view.

Then, in the organisation console, open Workspaces & repo access and the Organisation GitHub App card. Enter the numeric App ID (not the Client ID), the Installation ID and the private key, and press Connect GitHub App. Load repositories from GitHub adds what the App can see to the organisation's catalogue; Grant to member gives a repository to a workspace. Rotate App key replaces the key later.

A host-wide App is read from the directory in GH_APP_DIR: private-key.pem, owned by root with mode 0600, and app.env holding GH_APP_ID. GH_APP_INSTALLATION_ID is optional, and GH_API points at GitHub Enterprise Server. A key that group or others can read is refused.

on the host

# the plan, without reading the key or touching the network
$ bin/gh-app-token --repo acme/api --dry-run
# a real mint: prints {token, expires_at, repository}
$ bin/gh-app-token --repo acme/api --json
# what the pull-requests pane reads with
$ bin/gh-app-token --repo acme/api --read pulls --json

A personal access token is the fallback. Under the open and metered profiles a token is mounted into the container, where the developer can read it. Use the App with guarded or strict.

Anthropic

An organisation connects Anthropic on its AI keys tab: paste an API key or upload a credential file. Several accounts can be connected; Use this makes one active. The operator then turns the Claude proxy on so the credential stays on the host.

on the host

$ bin/policy set --key claude_proxy_enabled --value true
$ bin/claude-proxy status
# size a limit from what was actually used, then set it
$ bin/claude-proxy usage --workspace acme/dev01 --day 2026-09-28
$ bin/policy set --key claude_rate_limit_per_hour --value 600

OpenAI, Codex and Antigravity

Connect an OpenAI key on the same AI keys tab. Codex runs through the key broker once an operator starts it; the Antigravity CLI keeps its own sign-in.

on the host

$ bin/policy set --key key_broker_enabled --value true
$ bin/key-broker providers
$ bin/key-broker usage --provider codex --day 2026-09-28

Gemini in the chat

Paste a Google AI Studio key on the organisation's AI keys tab. The console's chat uses it through Gemini's OpenAI-compatible endpoint. Narrow who may use it with ai_members_gemini.

MCP servers

An organisation admin adds servers on the organisation's MCP servers tab: a short name, an https URL, the tools it offers with a read or write risk for each, the minimum agent profile (autonomous by default), and an optional secret. Then turn MCP on for the organisation under Agent features, or with mcp_enabled. Every connection goes through the egress proxy.

Identity providers, Cloudflare and SIEM

Per-organisation OIDC is set up on the administration page. SIEM export formats and the field map are on the audit page. Cloudflare Tunnel and Access sit in front of the host: see Front door & TLS. Access validation is opt-in, bin/front-door up --auth access with bin/access-auth up --team <team>.cloudflareaccess.com --aud <AUD tag>, and has been verified only against a stand-in issuer.

Runtimes, registries and members' computers

Docker registries: A workspace with managed Docker pulls only from docker_registries_allowed: docker.io and ghcr.io by default. Docker in a workspace is off until the organisation allows it; see Workspaces.
Postgres: The workspace database is Postgres 17, pinned by digest.
Language versions: Node.js, Go, Rust, Java, .NET and Deno, downloaded by the host and checked against the vendor's published checksums.
Members' computers: Off unless an operator grants it and the organisation turns it on. On Windows, workspaces use WSL2 and Rancher Desktop; Podman is refused as not available yet. On a Mac, the agent runs in a container beside the workspaces with Docker Desktop, OrbStack or Colima. There, egress is observed, not enforced; see Workspaces.
AI usage surfaces: The AI usage tab tells web chat, CLI and VS Code apart.

Tasks

Connect GitHub for an organisation

Create and install the App with the permissions above, on selected repositories.
Connect it. Workspaces & repo access, Organisation GitHub App, Connect GitHub App. Result: the card shows the App connected.
Load and grant repositories. Load repositories from GitHub, Add discovered, then Grant to member on a workspace. Result: the workspace can clone and push with no token prompt.
Prove a mint on the host. bin/gh-app-token --repo acme/api --json. Result: a token with an expires_at about an hour away.

Keep the Anthropic key off every container

Connect the key on the organisation's AI keys tab.
Turn the proxy on. bin/policy set --key claude_proxy_enabled --value true. Result: set claude_proxy_enabled = True (restart claude-proxy for this to take effect).
Recreate workspaces so they receive the proxy's address and their own key. Result: bin/claude-proxy status lists them.
Watch usage for a week, then set per-workspace limits from it.

Allow one MCP server

Add it on the MCP servers tab with an https URL and its tools.
Allow its host in the organisation's egress allowlist if egress is enforced.
Turn MCP on for the organisation. Result: members at or above the server's minimum profile see its tools; its connections appear in the egress log.

Verify it works

on the host

$ bin/gh-app-token --repo acme/api --dry-run
$ bin/git-broker status
$ bin/claude-proxy status --json
$ bin/key-broker status
$ bin/audit-log query --stream claude --day 2026-09-28

Good looks like: a dry run that names the App and repository; the broker and proxy listening; model requests appearing in the claude stream under each workspace's name; and, inside a workspace, no GitHub or Anthropic secret in the environment or on disk under guarded or strict.

Troubleshooting

GH_APP_ID is not set (env or $GH_APP_DIR/app.env)

The host-wide App has no ID. Add GH_APP_ID to app.env, or connect the App per organisation in the console.

private key … is group/other-accessible - chmod 600 it and re-run

The key is readable by others and is refused. chmod 600 it, owned by root.

the App is not installed on acme/api (no installation id)

Install the App on that repository in GitHub.

this ANTHROPIC_API_KEY is not a key issued by claude-proxy for a registered workspace

The key belongs to an earlier copy of the workspace, or was copied from somewhere else. A recreated workspace gets a new key; use the one it was given.

acme/dev01 has made … requests in the last hour, and the limit is …

The per-workspace rate limit. Raise it, or wait for the hour to roll.

claude-proxy: claude_proxy_enabled is false - refusing to start.

Turn the key on first; the key broker says the same for key_broker_enabled.

no credential found on any rung of the resolution ladder

The key broker found no key at workspace, organisation or platform level. Connect one on the AI keys tab.

an MCP server must be https

MCP calls are tunnelled and expect TLS. Use the server's https address.

What it does not do yet

Not yet: GitLab · Bitbucket · Azure DevOps · SAML · SCIM · Slack or Teams notifications · Jira or Linear · SIEM forwarding · Prometheus · Copilot · Cursor.
Some AI APIs are reachable directly from a workspace; not every provider goes through a broker.
No public API. About 240 internal routes serve the console; script against the bin/ tools instead.
cloudflared is not pinned to a checksum like the rest of the stack.

Integrations overview AI agents docs AI keys in the reference Every command

Verified against the main branch, 4 Oct 2026.

What it is, and what it is not

How it works

Defaults

Configure it

GitHub App

Anthropic

OpenAI, Codex and Antigravity

Gemini in the chat

MCP servers

Identity providers, Cloudflare and SIEM

Runtimes, registries and members' computers

Tasks

Connect GitHub for an organisation

Keep the Anthropic key off every container

Allow one MCP server

Verify it works

Troubleshooting

What it does not do yet

Related