Maintainer of this skill?
by kody-hq
🐨 Your agents' cloud — the memory, keys, code, and automations your AI agent keeps, portable across every MCP host.
# Add to your Claude Code skills
git clone https://github.com/kody-hq/kodyLast scanned: 10/18/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hiogawa/vite-plugin-fullstack: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@pitlane/dev: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "axios: Axios: Prototype pollution gadget in fetch adapter can alter outbound requests",
"severity": "high"
},
{
"type": "npm-audit",
"message": "braces: braces vulnerable to stack-exhaustion denial of service through deeply nested patterns",
"severity": "high"
},
{
"type": "npm-audit",
"message": "concurrently: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "dompurify: DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS",
"severity": "low"
},
{
"type": "npm-audit",
"message": "find-yarn-workspace-root: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "katex: KaTeX: Existing prototype pollution can bypass trust restrictions",
"severity": "low"
},
{
"type": "npm-audit",
"message": "mermaid: Vulnerability found",
"severity": "low"
},
{
"type": "npm-audit",
"message": "micromatch: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "nx: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "oxfmt: Vulnerability found",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "patch-package: Vulnerability found",
"severity": "high"
},
{
"type": "npm-audit",
"message": "shell-quote: shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "srvx: srvx is vulnerable to middleware bypass via absolute URI in request line ",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "tinypool: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution",
"severity": "critical"
}
],
"status": "FAILED",
"scannedAt": "2026-10-18T08:34:10.797Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how kody compares with popular alternatives.
kody is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by kody-hq. 🐨 Your agents' cloud — the memory, keys, code, and automations your AI agent keeps, portable across every MCP host. It has 809 GitHub stars.
kody failed SkillsLLM's automated security scan, which flagged one or more high-severity issues. Review the Security Report section carefully before using it.
Clone the repository with "git clone https://github.com/kody-hq/kody" and add it to your Claude Code skills directory (see the Installation section above).
kody is primarily written in TypeScript. It is open-source under kody-hq on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh kody against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
Kody is Your agents' cloud: the memory, keys, code, and automations your AI
agent keeps, portable across every MCP host. Built on Cloudflare Workers and the
Model Context Protocol (MCP), it ships a Remix UI, Worker-based request routing,
package runtime plumbing, and OAuth-protected MCP endpoints. The project favors
a compact MCP surface with powerful search and Code Mode execute flows over
a large static tool catalog.
Kody works for individuals and teams (orgs, teams, grants): each account holds isolated packages, jobs, credentials, memories, and related state. Tests and fixtures may seed deterministic local accounts, but no account is privileged at runtime. The repo follows several epicflare starter conventions.
The repo is organized as an Nx monorepo, with shared modules in
packages/shared (@kody-internal/shared), the origin app worker under
packages/worker, sibling workers under packages/platform-worker,
packages/runtime-worker, and packages/jobs-worker, and mock Workers under
packages/mock-servers/*. Production topology lives in
docs/contributing/architecture/index.md.
npm install
npm run dev
The dev server runs at localhost:3742 by default (the CLI picks the next free
port and prints the resolved URL). Wrangler handles the local Cloudflare Workers
runtime and D1 database automatically.
To scaffold a new project from the epicflare template instead, run
npx create-epicflare.
See
docs/contributing/getting-started.md
for the full setup paths and expectations. Contributors and agents should start
with AGENTS.md for repo-specific guidance.
If you are trying to understand what this repository is for, start with
docs/contributing/project-intent.md.
| Layer | Technology |
|---|---|
| Runtime | Cloudflare Workers |
| UI Framework | Remix 3 (beta) |
| Package Manager | npm |
| Workspace | Nx + npm workspaces |
| Database | Cloudflare D1 |
| Session/OAuth | Cloudflare KV |
| MCP State | Durable Objects on kody-platform |
| E2E Testing | Playwright |
| Bundler | Vite |
kody.codes → kody-production (origin: Remix, /mcp HTTP, OAuth, email, queues)
├─→ kody-platform (MCP / mailbox / meter / repo-session DOs)
├─→ kody-runtime (package apps, invoke API, StorageRunner)
└─→ kody-jobs (cron + JobManager; calls back via JobsHost)
kody.run → kody-runtime (package-app zone routes)
packages/worker/src/index.ts is the origin entrypoint; platform, runtime,
and jobs have sibling entrypoints (see
architecture)packages/worker/public/ and served via the
ASSETS binding| Document | Description |
|---|---|
docs/contributing/getting-started.md |
Setup, environment variables, deploy |
docs/contributing/environment-variables.md |
Adding new env vars |
docs/contributing/cloudflare-offerings.md |
Optional Cloudflare integrations |
docs/contributing/project-intent.md |
Scope, goals, and non-goals |
docs/contributing/index.md |
Developing and extending Kody |
docs/use/index.md |
Using Kody over MCP |
docs/contributing/setup/ |
Local development and verification |
Outside pull requests to this repository need a signed inbound Contributor License Agreement. Public packages do not use that CLA.
See CONTRIBUTING.md and
docs/contributing/index.md.
Kody is licensed under the Functional Source License, Version 1.1, ALv2 Future License (FSL-1.1-ALv2). You can use, copy, modify, create derivative works from, publicly perform, publicly display, and redistribute the software for any purpose other than Competing Use. Competing Use means making the software available to others in a commercial product or service that substitutes for Kody, substitutes for another product or service the licensor offers using Kody that existed when the version was made available, or offers the same or substantially similar functionality. Each version becomes available under the Apache License 2.0 on the second anniversary of the date that version was made available.
Public packages published through Kody do not use this repository's CLA and have no license gate; that is separate from this repository's license.