Portable MCP Vault &
Fully Autonomous Agent

Encrypted Vault

AES-256-GCM encryption with Argon2id key derivation. All credentials, configs, and keys stay on your machine, never in the cloud.

9 AI Assistants, One App

Manage MCP configs for Claude Code, Antigravity CLI, ChatGPT / Codex CLI, Cursor, Cline, VS Code (Copilot), Windsurf, Continue, and Zed, from one interface. Works with your existing subscriptions, no separate API key required.

SSH Tunnels

Create, start, stop, and monitor SSH tunnels to reach remote MCP servers behind firewalls. Password and private key auth both supported.

Live Registry & Directory

Browse a dramatically larger, always-fresh catalog sourced live from the Official MCP Registry, Glama, and PulseMCP. Search, sort, and filter with trust badges and per-server detail views. Install with one click.

Built-in Router & Profiles

A single local endpoint backs switchable groups of servers. Keep a "work" profile and a "personal" profile, or separate Default, Development, Staging, and Production configs, and flip between them without touching your assistant's config or restarting anything.

Built-in MCP Server

A localhost HTTP server lets AI agents manage projects, add servers, and control tunnels programmatically via tool calls, secured with a bearer token.

Connection Testing

Test any server config before deploying it. Checks TCP reachability and MCP server process spawn health, with latency shown inline on each card.

Encrypted Backups

Export your entire vault (projects, credentials, tunnels, SSH keys) as an encrypted backup file with a separate password. Import to merge into any vault.

Auto-Lock

Configurable inactivity timeout locks the vault and closes all SSH tunnels. While locked, the MCP server returns 503 and no credentials remain in memory.

Import Existing Configs

Paste your existing ~/.claude.json into the import dialog and Kodex automatically detects all projects and MCP servers and loads them into the vault.

Debug Log

Real-time structured log viewer with level filtering (debug, info, warn, error). Logs rotate on disk with 14-day retention for diagnosing connection failures.

System Tray

Minimizes to the system tray instead of closing. Tray menu shows live tunnel status, a quick lock action, and show/quit. Active tunnel count updates every 15 seconds.

Auto-Resume on Usage-Limit Reset

When an AI agent hits a provider usage limit mid-task, kôdex records exactly where it stopped and automatically resumes the task the moment the limit resets, no need to come back and restart it yourself.

Long-running agent work no longer dies just because you hit a rate limit overnight. You kick off a task, walk away, and kôdex picks it back up on its own when your quota refreshes. Work finishes; you don't babysit it.

The Shadow Monitor

A non-interactive background watcher that continuously looks for trouble (failed CI checks, broken features, stalled tasks, and a red default branch) and automatically dispatches a fix when it finds one. No human prompt required.

It sees the problem, files the work, and routes it to be fixed. The difference between a tool you supervise and a platform that supervises itself, peace of mind that your automation keeps running even when you're not watching.

MITM-Proof Tunnels

SSH tunnels and SFTP transfers verify the remote server's identity against a known host key before sending anything, and refuse to connect if the key doesn't match. Your tunnels fail safe instead of trusting a stranger.

Secrets off the Command Line

Access tokens are no longer passed on the command line. They're handed over through a temporary, locked-down config file cleaned up immediately afterward, invisible to OS logging and process enumeration.

Hardened Agent Sandbox

Built-in agents can only read and write inside the project folder you assign. A loophole where a cleverly-placed symlink could trick an agent into reaching files outside that folder is closed. Agents stay in their lane.

Command-Injection Protection

Every value passed to an external AI tool (model names, effort levels) is validated against a strict allow-list before use. No unchecked setting can smuggle extra commands into a launched process.

Prototype-Pollution Protection

When kôdex merges configuration during vault sync, it rejects specially-crafted data designed to tamper with the app's internal behavior, blocking a well-known attack class at the data-ingestion layer.

Vault Hardening

Key derivation runs off the main thread so the UI never freezes, saving is a safe no-op if the vault auto-locks mid-write, and encrypted writes are fully awaited before the app moves on. Your secrets are always really saved.

License-Server Hardening

Access tokens are hashed before appearing in audit logs, never stored readable. Cross-device vault-sync endpoints are rate-limited against brute-force and flooding. Your account stays yours even if a log file leaks.

Reliability & Correctness

Durable crash logging, consistent tunnel-limit accounting, safer sync conflict handling, and accurate usage-limit detection. The app behaves predictably under real-world conditions, not just in tests.

Hosted MCP Servers on tbay.tk Cloud

kôdex deploys and runs MCP servers on tbay.tk cloud, directly from the app, and manages their full lifecycle (create, start, stop, update, tear down) from a dedicated Hosted control panel.

kôdex becomes the single pane of glass for both local and cloud-hosted servers. Hosted servers run on tbay.tk cloud infrastructure and are metered from your prepaid wallet, with no provider account and no API key for you to manage. Every metered event shows up in a live Usage panel, and the dashboard number is the bill.

Secure-by-Default Cloud Auth

kôdex authenticates to protected hosted services using short-lived identity tokens minted per request. There is no standing credential to store: no customer, and no agent, ever receives cloud credentials.

Every identity is scoped, minted on demand, and expires automatically. Because no long-lived key is ever issued, there is no cloud credential sitting in a config file to be leaked, copied, or forgotten.

End-to-End Encrypted Remote Control

Traffic is end-to-end encrypted with a pairing secret the relay never holds. The relay routes ciphertext it cannot read.

Remote turns are structurally restricted to read-only. Anything that writes requires a native approval on the desktop itself, and a streaming redactor drops any outbound frame that would leak a secret, even one split across stream chunks. This is remote agent access built like a security product, because it is one.

The relay fronts the kôdex web portal: real accounts, trial licences and hosted environments are provisioned on signup today, and a full browser-to-desktop turn has been proven end to end in production.

Live Token Streaming

A remote turn streams into the browser as it happens. Phase status, per-tool activity by name, and the agent's answer arrive token by token through a per-turn stream router.

Every frame passes the same redactor that guards a secret even when it is split across chunks. The portal is a live window on the run, not a spinner that resolves only at the end.

Scope-Limited Phone Sessions

A paired phone is cryptographically confined at the relay edge. It can approve or reject, but it can never originate a command that runs code on your machine. The restriction is enforced structurally on the frame kind, so a lost or hostile phone can only weigh in on what the desktop already proposed, never drive the agent itself.

Wildcard TLS Subdomains

Every hosted service gets its own address over managed TLS. Services are reachable at <name>.kodex.tbay.tk, proven end to end in production, so a hosted server has a stable public name without you configuring a certificate.

tbay.tk Serverless Models

Open-weight and frontier models, billed per token from the same prepaid wallet as cloud compute.

There is no provider account and no API key for you to manage. The chat agent and every role in the triage workflow can be pointed at a hosted model, and what you spend is metered into the same wallet and the same live Usage panel as everything else kôdex runs for you.

What Happens to Your Code

Our privacy guarantee for hosted model traffic:

• We do not collect or retain repository contents from model traffic.
• Our serverless infrastructure provider does not retain or train on it under its inference terms.
• Customer sessions are never used to train any model.

For teams that cannot send code to the large model vendors under their consumer terms, that is a materially different posture from pasting a repository into a chat window.

Semantic Cache

Every query is checked against a shared, model-agnostic cache before reaching any model. Identical and near-identical questions (≥ 85% similarity) return the stored answer instantly, at zero cost, and answers are shared across Claude, Antigravity CLI, and Codex automatically.

Temperature Lock

temperature: 0 and a fixed seed are written into the config files for every model currently assigned a role in the project, pinning each model's cold-cache output to its past behavior.

Ontological Code Requirement

Every prompt carries an instruction requiring the model to write ontological code: named domain types, never raw string / number / boolean. Output is self-documenting and structurally consistent across cache hits.

Role-Aware by Design

Deterministic Mode tracks your agent role assignments. Reassign the Orchestrator from Claude Code to Antigravity CLI and the temperature lock and prompt enforcement follow the role automatically. There is no per-model configuration to maintain.

Exploratory Mode Bypass

Need a creative, non-deterministic answer for brainstorming or architecture exploration? A single Exploratory Mode flag bypasses the cache and the ontological constraint. The model is called fresh and the result is never written to cache.

Ontological Code Generation

Every value is wrapped in a named domain concept, no raw string, number, or boolean. Code reads like a specification, stays structurally consistent across cache hits, and is part of Deterministic Mode (omitted automatically in exploratory mode).

Query Cache Manager

A built-in cache browser in Settings → Query Cache: real-time search, 200-character result previews, delete a wrong answer, or clear-all with confirm. Each entry shows its creation date and 7-day expiry, plus programmatic cache invalidation for CI gates.

Cross-Model Repeatability Testing

A verified determinism test suite proves the same question, run through the real Claude, Antigravity CLI, and Codex CLIs, hits the cache on calls 2 and 3 with the executor invoked exactly once per model. Includes near-duplicate detection and temperature-lock verification. No API keys: it uses the CLI subscriptions you already have.

Tool Multiplexing

Register multiple downstream MCP servers and expose all their tools through a single gateway endpoint. Each server's tools are namespaced (db__query_rows) to prevent collisions and avoid God-Mode context degradation in agents.

Rug-Pull Detection

Trust-on-first-use fingerprinting detects when a downstream MCP server silently modifies its tool definitions. Changed tool schemas are blocked with HTTP 409 until you explicitly consent to the update, protecting against supply-chain attacks.

Scoped Token Exchange

Issue short-lived tokens restricted to a named subset of tools (RFC 8693). A scoped token expires in minutes and can only call the tools you allowed, limiting blast radius if a token is ever compromised.

Stateless Protocol (SEP-1442)

Serverless functions and CI runners get the tool result and its full JSON Schema in a single round trip, no separate schema discovery step. Enables ephemeral clients that can't maintain session state.

Adaptive Output Pruning

Tool output is automatically trimmed based on the agent's remaining context budget (via the x-mcp-context-budget header). Truncated responses include a summary so the agent knows data was omitted.

Session Deduplication Cache

Identical read-only tool calls within a session are served from an in-memory cache for 60 seconds. Mutating tools always execute. Deduped responses carry x-mcp-deduped: 1 so agents can detect cache hits.

Prompt Caching

The /context endpoint returns Anthropic-compatible prompt-caching blocks (system instructions, CLAUDE.md, blueprint, symbol map), enabling up to 90% token cost reduction on repeated Claude API requests.

Semantic Query Cache

Knowledge-base lookups use a two-level cache with 7-day TTL: exact SHA-256 match first, then trigram fuzzy match at ≥ 85% similarity. Eliminates redundant AI API calls for similar codebase questions.

Tool Filtering

Code Mode exposes only two meta-tools (portal_search / portal_execute), hiding management overhead from coding agents. Scoped tokens restrict discovery to permitted tools only.

Rate Limiting & Health Cache

60 requests per minute per IP prevents runaway agent loops. Downstream server health is cached (healthy: 5 min, unhealthy: 30 s) so repeated timeouts don't burn agent context on unreachable servers.

Tiered Context Injection

Agents request only the layers they need (/context?layers=knowledge,blueprint), skipping static boilerplate entirely. No more sending the full system prompt when all the agent needs is the symbol map.

Sidecar Compressed Docs

CLAUDE.md is compressed at project-creation time using structural regex, cutting the largest context block by 40–60% before the first request is ever made. The unmodified original is preserved on disk.

Frequency-Ranked Symbol Map

TF-IDF scoring surfaces your most-called functions first in the knowledge block. When the 4,000-char cap kicks in, it cuts low-value symbols, not the ones your agents actually use.

Boilerplate Stripper

GitHub admonition blocks, HTML comments, and badge images are stripped server-side on request. Agents receive clean, signal-only documentation without any markup noise.

Async Tool Output Compression

JSON results are structurally compressed in a background thread (null fields dropped, homogeneous arrays collapsed) before being returned to the agent. First-call latency is zero; the compression happens out of band.

Milestone Checkpoint Blocks

Jules workflow state (waiting, PR opened, CI pass, merged) is persisted to .claude/checkpoints.json and surfaced as a single 100-token block, replacing the multiple tool calls that would otherwise reconstruct the same state.

Conversation Distillation

POST /context/distill extracts headings, decisions, and code summaries from a full conversation history, compressing 10,000 tokens to under 1,000 while preserving every actionable decision.

Orchestrator: Claude Code

Decomposes tasks, writes GitHub Issues with detailed specs, applies the jules label to trigger the Implementer, reviews PRs, and merges when CI passes.

Researcher: Antigravity CLI

Read-only codebase analysis and internet research using Antigravity CLI's massive context window. Preserves the Orchestrator's token budget by handling all exploratory reads.

Implementer: Jules

Async cloud implementation: creates branches, writes code, opens PRs, and self-heals CI failures, all without blocking your local machine. Watched by Kodex's Sentinel until the PR merges.

Triage Hook

A pre-edit hook intercepts every JS/TS file change and routes it by size: small edits bypass to Claude, medium edits optionally delegate, large edits enforce full triage. No oversized changes land without review.

Watch Sentinel

Armed automatically when a Jules issue is created, the Sentinel polls for the Implementer's PR, waits for CI, runs a security review, and auto-merges, no human follow-up required for routine changes.

Agent Monitor & Quotas

Tracks per-agent invocation counts across rolling windows (Claude: 5-hour / 7-day, Jules: 24-hour). Opt-in enforcement returns HTTP 429 when limits are hit. Includes a live Jules task dashboard synced against GitHub.

Auto-Deploy to New Projects

Adding a project through Kodex's onboarding wizard automatically scaffolds the full workflow: triage hook, sentinel arming, CLAUDE.md, AGENTS.md, blueprint, and CLI reference, ready on first use of Claude Code.

Approvals Anywhere

Every gated action becomes an interactive approve or reject card, mirrored to SMS and chat channels, so a decision an agent cannot make on its own reaches you on a phone instead of stalling the run until you are back at the keyboard.

Independent Code Review

A separately assigned reviewer model re-reads every change against the original constraints before merge, on a configurable schedule or on demand. The model that wrote the code is not the model that signs it off.

Always-On Heartbeat

Background jobs run agent tasks, PR monitors and health checks on a schedule. Autonomy survives an app restart and does not wait for a human to trigger it.

Quality Measured in CI

A golden-trajectory eval harness scores the agent loop against a baseline on every build, and a regression fails CI. The autonomy cannot quietly get worse between releases without someone finding out.

Auto-Deployed Workflow Scaffolds

Every project gets the same playbook, automatically. When you add a project to Kodex, the app silently drops a complete set of coordination files into the project directory. Triage hooks, monitor scripts, agent rules, all in place before you write your first prompt.

Update All Projects

One click. Every project. Latest features. Upgraded Kodex and want your existing projects to pick up the new coordination scaffolds? Click one button in Settings and watch the per-project, per-feature status table fill in. Idempotent, safe to run repeatedly.

Robust Jules PR Monitor

Never miss a Jules update. Four independent detection methods. The deployed monitor watches a Jules-labeled issue from creation through merge, using four parallel detection paths (Jules CLI session status, comment-keyword scan, PR search, and comment link extraction), so a failure in any one doesn't go silent.

PR Review Comment Feedback Loop

Talk to Jules the way Jules listens. Jules only responds to PR review comments with an @jules mention, not the plain comments most tools default to. Kodex's monitor uses a three-tier fallback chain (request-changes → review comment → re-label) to ensure every message gets through.

/loop Continuous Monitoring

Set Claude Code on autopilot for batch PR work. When you have 3+ Jules PRs in flight, /loop runs the orchestrator on a 15-minute interval, reviewing, merging, and requesting fixes without you having to ask. Bound by four hard rules that prevent silent bad merges.

Tightened Merge Policy

No script auto-merges. Every PR gets human-grade code review. Kodex's monitor flags merge-ready PRs but never pulls the trigger itself. The orchestrator reads every changed file first. Sensitive files require human approval in addition to orchestrator review.

Episodic Memory

Encrypted, agent-writable memory that survives the end of a session.

Decisions, preferences and project context are recalled across sessions and exposed as standard MCP tools, so any agent you use can read and write them. The next session starts knowing what the last one decided, instead of asking you again.

Code Knowledge Graph

A deterministic scanner builds a per-project map of symbols, imports, routes and call sites.

The map is browsable visually as a sunburst, a dependency graph or a tree, and the same map is served to agents as context. Deterministic means the map is built by scanning, not guessed by a model, so what an agent is told about your code is the code.

Skill Recall

Solve it once, not every time. Once a task pattern has been solved and verified, the distilled skill is injected into future runs, so the cost of working out how to do something is paid once rather than on every fresh session.

AI-Authored Project Scaffolds

kôdex writes and maintains each project's agent-facing documentation. Staleness is tracked at section level and updates are surgical, so a refresh never overwrites the edits you made by hand. One click propagates updated scaffolds to every project in the vault.

Guided Onboarding & Discovery

From install to a working multi-agent workflow in minutes. Setup wizards detect the assistants you already have installed, scan a project's environment, and recommend MCP servers with a confidence score attached rather than a bare list.

From One Failure to a Fleet-Wide Fix

With consent, failure signals flow to our central service, anonymized, fingerprinted, and never joinable to a customer identity.

Recurring failures across the fleet are scored there. Those that clear a statistical significance bar are decomposed into atomic engineering issues and handed to an async implementer automatically. High-value fixes graduate into the core product, while niche fixes ship back as signed automation rules restricted to a closed, audited set of safe operations.

Telemetry ingest and enrollment are serving in production today.

Signed Hot-Fixes

Critical fixes ship fleet-wide in hours as offline-signed, boot-guarded hot-patches.

The signing keys live offline and the server never holds them, so the distribution channel can serve a fix but can never forge one. Full releases follow through a staged auto-updater, live on Windows and Linux today. macOS updates await Apple code-signing and are manual-download until then.

Fleet Skill Sharing

The library of proven skills grows with the fleet, so no install starts from zero. Verified recipes distilled from successful agent runs can be published to a cloud skill registry and fetched on demand by other installs. Every shared skill is cryptographically signed.

Verified Skill Pipeline

Extraction is cheap; verification is the gate. A skill is only trusted after replaying successfully in a sandboxed harness. A skill arriving from the fleet lands quarantined as untrusted and must re-earn verified status on your machine before it influences any work.

Transparent AI Pricing

Metered AI is normal. Metered AI at a price you were never shown is not.

kôdex displays the rate for every hosted model at the moment you choose it, so you know what a model costs before you commit to it. No surprise bills.

Find it in Settings, then Cloud, then "Rate card: what you are charged". The same figures appear beside every hosted model in the Agent Chat composer and in the Triage Editor role pickers. Full rates are on the pricing page.

A Stop Button for Autonomous Spend

Every cloud task an agent starts is listed, and any of them can be cancelled mid-flight. Cancelling stops the work and releases both the cloud sandbox and the wallet hold.

The Cloud Tasks panel lists every task with its status, elapsed time, repository, branch and, when something went wrong, the actual reason it failed rather than a generic error. Anything still running carries a Cancel button. Anything finished carries Resubmit, disabled with a stated reason when the control plane would refuse it.

• A status we do not recognise counts as still running. A task can never disappear from the list by being unfamiliar to an older client.
• Queued counts as spending. A task holds a reservation before its machine exists, and "stop before it costs more" is the request being made.

Find it on the Agent Monitor screen, below the local quota panels.

Run a Build on Demand

Start a cloud CI build yourself, from the app. Pick a project, type a command, press Run. The build runs on the same infrastructure the automated verify step uses and is billed the same way, and progress streams into the runs list below it. If cloud CI is not switched on, the button says so immediately rather than spinning. Find it in Cloud CI, above "Your CI runs".

Device and Seat Management

Release a device from your licence without contacting support. A licence covers three activated devices, so replacing a laptop twice could lock you out of software you paid for. Releasing confirms first, states plainly that cloud features stop working on this machine while your projects and credentials stay in the local vault, and frees the seat immediately for another device. Find it in Settings, then Plans and Billing, below the pricing table.

Team Features

A seat-based team plan with invites, roles and shared configuration. Plans are enforced both client side and server side, with offline grace so a dropped connection does not lock you out of your own machine, and a remote revocation path for a seat that needs to be withdrawn.

Vault Sync That Merges Instead of Overwriting

When two machines change the same vault, kôdex merges them. Independent work on both sides is kept, only genuinely contested fields are put to you, and any earlier synced version can be restored.

Encrypted sync usually forces an unpleasant choice: keep this machine's copy or the other one's, and lose everything the loser did. That is because the server holds only ciphertext, so it cannot merge anything. kôdex merges on the client instead, against a snapshot of the last state both machines agreed on. If you added a project on your laptop while your desktop edited a setting, both survive with nothing to decide.

• Secret-bearing records are always chosen whole. Credentials, SSH keys, tunnels and server configurations are never merged field by field, so a merge can never assemble a credential that existed on neither machine.
• Choosing nothing keeps your version. An abandoned dialog moves no data.

Point-in-time restore. Sync History lists every synced version with its device and timestamp, and any earlier one can be restored. Restoring re-points the shared copy for the whole licence and pulls it down here, and the confirmation says exactly that before anything happens.

Find it in Settings, then Vault Sync. Conflicts open automatically on sync, and Sync History has a Restore control on every version that is not the current one.

Answer Your Agent From Your Phone

When an agent needs a decision, it texts you, and your reply goes back into the session that asked.

kôdex notifies you when an agent genuinely needs an answer and cannot continue without one. The message names the project and the file, states the question, and asks for a yes or no. Replies are delivered back into the conversation that raised them, so answering from a phone continues the work rather than merely acknowledging it.

The notification lane is deliberately quiet. It stays silent when you are at the keyboard and can see the question on screen, when the same decision is already waiting on an answer, and when a fully autonomous run is authorising its own work and no human decision exists. Messages are transliterated to plain characters so they arrive readable on any handset and carrier.

Find it in Settings, then SMS Gateway. Approvals also arrive on a paired phone through kôdex Pocket.