Kody Personal Assistant Platform

The security policy makes userId-scoped access a core invariant and identifies OAuth/PKCE, tokens, secret storage, credential stripping, and runtime isolation as security boundaries. Workflows use scoped GitHub permissions, commit-pinned github-script actions, disabled checkout credential persistence, and controlled environment-based secret synchronization. Deductions apply because the supplied material does not show user confirmation before agent actions, least-privilege scopes for each production token, a complete data-retention/data-flow policy, or the secret-handling implementation. Deployment performs migrations, resource creation, secret synchronization, and multi-worker updates with SHA guards, sequencing, and health checks, but no explicit application rollback procedure is shown; backup and restore are visible only as script names. Copyright and licensing attribution are clear, but the publisher is unverified by the stated registry, so attribution is not full-score.

The README, package manifest, and deployment workflow align closely on Node 26, Cloudflare Workers, the multi-worker topology, MCP, and validation commands, supporting full self-consistency. Dependency versions, npm and engine requirements, overrides, and an audit command are handled well, but several dependencies use compatible ranges, Remix is identified as beta, and no lockfile content is supplied, so dependency availability is not full-score. Deployment uses strict shell behavior, timeouts, retries, exit-code handling, commit-SHA validation, health checks, and specific diagnostic messages, thoroughly supporting failure messaging.

The material identifies a multi-user personal-assistant audience, ChatGPT and other compatible MCP hosts, and distinct user, contributor, and local-development scenarios, but provides limited end-user task examples or deployment variants. Scope and non-goals are unusually clear: this is not a general-purpose agent harness, is MCP-first, and favors a compact search/execute surface, justifying full capability-boundary credit. Trigger precision is mostly an architectural assertion; tool schemas, invocation conditions, and ambiguity handling are absent from the supplied evidence. Cloudflare, D1, KV, Durable Objects, Node 26, and local-port expectations are explicit, but the environment is infrastructure-heavy and cross-host compatibility is qualified as practical rather than demonstrated.

The README supplies a clear repository map, topology, stack summary, and layered documentation index, while package, worker, script, and deployment names remain consistent. The quick start is adequate for ordinary local startup, but detailed environment and deployment requirements are deferred to files not included here, preventing full installation credit. Examples are mostly commands and topology, with no complete user workflow or FAQ. Scope, supported-version policy, and selected security boundaries are documented, but a comprehensive limitations treatment is not present in the supplied material. The complete FSL-1.1-ALv2 terms, copyright, use restrictions, and two-year Apache-2.0 transition justify full license credit. Versioning is weak because the root package remains 0.0.0 and no releases or changelog are provided. SECURITY.md clearly identifies a solo maintainer, latest-main support policy, and private reporting paths, so maintenance responsibility is thorough.

The repository describes a usable Remix UI, OAuth-protected MCP endpoints, memory/keys/code/automation storage, and compact search plus Code Mode execute flows, supporting practical output usability across MCP hosts. Centralized, portable agent state offers plausible marginal value over a large static tool catalog, but no concrete input/output examples, adoption evidence, or measured outcomes are supplied, preventing full scores. The multi-worker architecture, D1, KV, Durable Objects, queues, OAuth, and optional external services imply substantial deployment and operating costs; the evidence neither quantifies those costs nor compares lighter alternatives, so cost-benefit support is thin.

Major claims can be traced to concrete README, SECURITY.md, LICENSE, package.json, and deployment-workflow statements, and the stack, versions, topology, and operational controls corroborate one another across multiple files. Deductions apply because key isolation, sandboxing, encryption, and portability claims are primarily documentary assertions in this excerpt, without the corresponding implementation or tests; CI badges and script names do not establish successful execution. The prose generally distinguishes goals, conventions, and procedures, but it does not systematically label verified facts versus design intent or guarantees still requiring implementation evidence.