Korve × Codex
Codex can run in a shell where a loopback browser handoff is not guaranteed. Korve gives the native CLI a device-code login, while Codex authorizes the remote MCP server through its own separate OAuth flow. Skills and a managed AGENTS.md block keep the operating procedure with the repository.
Korve is a paid-only cloud for agent-built applications. Codex deploys a repository to a stable *.korve.app URL and provisions only the managed resources the app declares — Postgres, object storage, caches, queues, cron jobs, budgets, and custom domains — through one typed operation spec shared by the API, dashboard, native CLI, MCP server, and manifest. Pricing is pure usage with a $5/month minimum and no free tier.
Written by winterrx, founder and builder of Korve · Last updated July 29, 2026.
korve login --device authenticates the Korve CLI only. It prints a short code and a URL that a person can approve on another device. If the process is interrupted, rerunning reuses the pending code only while it has more than 60 seconds left; otherwise the CLI starts a new device request.
Once the CLI is signed in, korve init can inspect the repository, write a korve.toml manifest, print the plan with pricing, and deploy on approval. Exit 3 means the CLI has no credential and exit 5 means billing is inactive, so a shell-driven loop can branch on the code. This credential does not sign Codex into MCP.
$ curl -fsSL https://korve.dev/install.sh | sh$ korve login --device→ open https://korve.dev/authorize/device?code=WDJB-MJHT→ confirm the code WDJB-MJHT · checking every 5s✓ CLI signed in · grant limited to the approved scopes$ korve init→ wrote korve.toml · plan + pricing printed✓ Live at https://demo-app.korve.appCodex takes remote MCP servers as TOML, loads skills from its own directory, and reads AGENTS.md. Korve meets each of those without a wrapper in between.
Remote servers live under [mcp_servers.<name>] in ~/.codex/config.toml. Adding the URL does not reuse korve login: run codex mcp login korve for a separate MCP OAuth grant. Two tools then cover the platform instead of one tool per endpoint.
MCP Code ModeThe installer takes --agent codex and writes six skills into ~/.codex/skills. korve link separately mirrors three skill trees — korve, korve-cli, korve-debug — into both .agents/skills, for Codex and any Agent Skills client, and .claude/skills.
Agent skillskorve is a single native binary with nothing to install underneath it. Add --json for machine-readable output; destructive commands require an explicit confirmation — --yes in an unattended session, or typing the project slug interactively — so a non-interactive run fails closed rather than deleting a database.
CLI reference[mcp_servers.korve]url = "https://mcp.korve.dev/mcp" # separate from `korve login --device`:$ codex mcp login korve$ curl -fsSL https://korve.dev/skills.sh | sh -s -- --agent codex --global→ Installed 6 skills to ~/.codex/skills<!-- KORVE:START -->## Korve platform - **Project:** `demo-app` (org `acme`, runtime class `scale-to-zero`) — live at `https://demo-app.korve.app`- `korve whoami` first; exit 3 → `korve login`; exit 5 → billing, stop.- After any deploy, verify with a real HTTP request to the live URL, not just status `ready`; on failure run `korve deploys diagnose <deploy-id>`.<!-- KORVE:END -->korve link renders a block between KORVE:START and KORVE:END markers in ./AGENTS.md: the project slug, the organization, the live URL, and the checks to run after every deploy.
Everything outside the markers is preserved byte for byte, so your own notes survive. Re-run korve link after switching projects and the block is replaced in place rather than appended again; delete the closing marker by hand and the next run repairs it instead of leaving two copies. The block carries no credentials — only the slug, the organization, the runtime class, and public URLs.
An unattended run fails differently, so the guarantees it needs are the ones that hold with nobody at the keyboard.
The device flow returns a short-lived access token and a rotating refresh token, stored 0600 outside the config file. Reusing a refresh token revokes the whole family, so a copied credential stops working rather than quietly persisting.
search returns an operation's id, method, path, auth, minimum role, risk, parameters, and body schema straight from the published spec. What Codex reads there is what the CLI and API accept, because all three are generated from it.
Every operation is classified read, write, dangerous, or destructive in the published spec, dangerous and destructive ones come back from search with approvalRequired set, and the platform agent records mutations as pending actions. A long autonomous run leaves a reviewable trail instead of a surprise.
Deleting a project or database asks for an explicit confirmation: --yes in a script, or typing the project slug when a terminal is attached. With no TTY and no flag the command refuses instead of guessing, so an unattended Codex run cannot destroy a resource by falling through a prompt.
Decide by what has to be true once the code is written and nobody is watching: a credential the sandbox can obtain, an exit code to branch on, and a production change someone can review afterwards.
| Decision | Korve fits when | Look elsewhere when |
|---|---|---|
| Sandbox reach | The session can make outbound HTTPS requests and run a native CLI, while browser approval may happen on another device. | The environment cannot reach external services, cannot retain credentials, or requires all execution to stay inside a private network. |
| Autonomous operations | Codex should discover the live contract, deploy, inspect bounded logs, diagnose failures, and verify the URL without a dashboard handoff. | Production changes must remain a human-only process, or an existing internal tool already exposes the approved workflow. |
Choose another backend if Codex only needs somewhere to place static output, if your organization already owns the deploy control plane, or if the workload needs machine-level control, custom networking, or accelerators. Korve fits when an unattended Codex run should branch on exit 3 and exit 5 instead of parsing prose.
| If you need | On Korve | Where else people look |
|---|---|---|
| A sandbox that cannot reach the public internet at all | Not supported — the CLI and MCP server are reached over outbound HTTPS. | A self-hosted control plane inside the private network, such as InsForge's. |
| A free hobby tier | Not offered — paid-only, with a $5/month minimum credited against usage. | Render, Railway, and Supabase publish free tiers. |
| Whole-backend branch and merge | Database branches only; they cover one database, not the whole project. | InsForge branches the entire backend and merges it back. |
| Transactional email, vector search, and edge-function catalogs | Not shipped as first-party product surfaces. Bring the application dependency you prefer. | InsForge and Supabase ship broader backend component catalogs. |
| Managed Postgres with 14-day point-in-time recovery and rolling HA resizes | Included in every database SKU; high availability adds two replicas. | Nothing to move for — this is the case Korve is built for. |
Korve is pure usage against a public rate card — no seats, no per-user meter, no free tier — with a $5/month minimum credited against usage. The two published worked examples are a Hobby full-stack app at $24.59/month and a Production API at $143.98/month. See the full rate card.
Keep reading