Devfolio Codex Plugin

This repository contains the Devfolio plugin for Codex. It lets Codex work with Devfolio through the Devfolio MCP server, including hackathon project submissions, profile side projects, active hackathon discovery, track/prize lookup, and upload URL generation.

What It Includes

• A devfolio skill for preparing and safely managing project submissions through Devfolio MCP.
• A Codex plugin manifest at plugins/devfolio/.codex-plugin/plugin.json.
• A hosted MCP configuration at plugins/devfolio/.mcp.json.
• MCP workflow guidance for Devfolio project and submission tools.

Install

Add the Devfolio plugin marketplace:

codex plugin marketplace add devfolioco/codex-plugin

Then open the Codex Plugins screen, choose Devfolio, and install the plugin.

For local development, clone this repository:

git clone git@github.com:devfolioco/codex-plugin.git

Then add the checkout as a local Codex plugin marketplace:

codex plugin marketplace add /path/to/codex-plugin

After installation, start a new Codex thread and invoke the plugin with:

@devfolio show my active hackathons

MCP Setup

The plugin declares the hosted Devfolio MCP endpoint:

{
  "mcpServers": {
    "devfolio": {
      "type": "http",
      "url": "https://mcp.devfolio.co/mcp"
    }
  }
}

Devfolio MCP requires an API key. In Devfolio, open Account Settings, open the MCP tab, generate an MCP URL, then run:

codex mcp add devfolio \
  --url "https://mcp.devfolio.co/mcp?apiKey=..."

If Codex says an MCP server named devfolio already exists, remove the existing entry and add the new one:

codex mcp remove devfolio
codex mcp add devfolio \
  --url "https://mcp.devfolio.co/mcp?apiKey=..."

Treat the MCP URL like a password. Anyone with it may be able to act on the user's Devfolio account. Revoke it in Devfolio if it is exposed.

The hosted server requires a Devfolio MCP API key at connection time. The MCP edge accepts x-api-key or apiKey and forwards it to Devfolio API as x-mcp-api-key. OAuth is not supported yet; the API key is the only supported authentication method for now.

Safety

Devfolio project publishing can make a project public immediately. The skill requires explicit confirmation before all create/update calls and before any status: "publish" action.

Compatibility Notes

Keep future MCP and plugin changes additive where possible:

• Preserve the unauthenticated onboarding path so users without MCP auth understand that Devfolio MCP actions require an API key.
• Preserve existing tool names and argument meanings; add new optional fields or new tools before changing current flows.
• Keep sign-in outside the plugin package until Devfolio MCP supports OAuth. Users should connect their own Devfolio MCP URL.
• Treat team support as an authorization-sensitive extension. Before create, update, or publish actions, the agent should read the current project/team state when available and ask for explicit confirmation.
• Keep draft-first behavior and explicit publish confirmation as stable safety guarantees.