@cubis/foundry
Advanced tools
Workflow-first installer for multi-platform AI agent environments.
Last updated: 2026-03-04.
cbx installs workflows, skills, wrappers, and rule files for:
Official install targets: codex, antigravity, copilot, claude, gemini.
Skill install default is profile-based:
full--skill-profile web-backend for broader web/backend stack--all-skills for full workflow + MCP catalog installcbx init)cbx remove all)/plan, /create, etc.)AGENTS.md, GEMINI.md, etc.)ENGINEERING_RULES.md, TECH.md)Generated rule files are intentionally route-first and lazy about skill loading:
Source of truth inside this repo:
workflows/skills/<id> is the canonical source for skill packages.workflows/workflows/agent-environment-setup/shared/{agents,workflows} is the canonical source for custom agents and workflows.workflows/workflows/agent-environment-setup/platforms/* contains generated platform adapters and mirrors, not the authoring source.codex, antigravity, copilot, claude, and gemini.cursor or windsurf folders under platforms/* should be treated as legacy artifacts, not active CLI targets.Recommended edit and verification loop:
workflows/skills/* and workflows/workflows/agent-environment-setup/shared/* only.npm run generate:all.npm run test:ci.npm install -g @cubis/foundry
Recommended environment setup:
export POSTMAN_API_KEY_DEFAULT="<your-postman-api-key>"
export STITCH_API_KEY_DEFAULT="<your-stitch-api-key>"
cbx workflows config keys persist-env --service all --scope global
cbx init)cbx init is the interactive guided installer for first-time setup and multi-platform onboarding.
cbx init
Wizard flow:
codex, antigravity, copilot, claude, gemini)core, web-backend, full)Cubis Foundry, Postman, Stitch, Playwright)--skills-scope / --mcp-scope flags are accepted for compatibility)cbx mcp serve local, Docker pull, Docker local build) when any MCP integration is enabledNon-interactive default mode:
cbx init --yes --dry-run --no-banner
Non-interactive scripted selection:
cbx init \
--yes \
--dry-run \
--overwrite \
--no-banner \
--bundle agent-environment-setup \
--platforms codex,antigravity,gemini \
--skill-profile web-backend \
--mcps cubis-foundry,postman,stitch,playwright \
--postman-mode minimal \
--postman-workspace-id null \
--mcp-runtime local
cbx workflows install remains the canonical explicit/scriptable installer.
Use cbx init when you want step-by-step guided setup.
Detailed wizard behavior and platform matrix:
docs/cli-init-wizard.mdcbx workflows install --platform codex --scope global --bundle agent-environment-setup --postman --postman-mode full
Important:
--yes if you want interactive Postman workspace selection.workspaceId.cbx workflows install --platform antigravity --scope global --bundle agent-environment-setup --postman --postman-mode full
Postman and Stitch both route through the Cubis Foundry MCP gateway on this platform as well.
cbx workflows install --platform copilot --scope global --bundle agent-environment-setup --postman --postman-mode full
cbx workflows install --platform claude --scope global --bundle agent-environment-setup --postman --postman-mode full
cbx workflows install --platform gemini --scope global --bundle agent-environment-setup --postman --postman-mode full
cbx workflows install defaults to project.
Behavior:
--scope global is accepted for compatibility on install, but workflow and rule placement is normalized to workspace-oriented behavior.cbx workflows config, cbx mcp, and credential/profile commands still support explicit global scope where applicable.ENGINEERING_RULES.md, TECH.md) are workspace files.Codex:
<workspace>/.codex/agents~/.codex/agents<workspace>/.agents/skills~/.agents/skills<workspace>/AGENTS.md~/.codex/AGENTS.mdAntigravity:
<workspace>/.agents/rules/GEMINI.md<workspace>/.agents/skills~/.gemini/antigravity/skills<workspace>/.gemini/commands~/.gemini/GEMINI.mdCopilot:
<workspace>/.github/agents~/.copilot/agents~/.copilot/skills<workspace>/.github/skills<workspace>/.github/prompts<workspace>/AGENTS.md and <workspace>/.github/copilot-instructions.md~/.copilot/copilot-instructions.mdGemini CLI:
<workspace>/.gemini/commands<workspace>/.gemini/GEMINI.md~/.gemini/GEMINI.mdClaude:
<workspace>/.claude/agents~/.claude/agents<workspace>/.claude/skills~/.claude/skills<workspace>/.claude/hooks~/.claude/hooks<workspace>/CLAUDE.md~/.claude/CLAUDE.mdSecrets are now machine-scoped only.
cbx_config.json stores non-secret metadata such as active profile name, env-var alias, Postman workspace id, MCP URL, and runtime preferences.~/.cbx/credentials.env stores the actual Postman/Stitch API key values managed by the CLI.X-Goog-Api-Key values.Paths:
~/.cbx/cbx_config.json<workspace>/cbx_config.json~/.cbx/credentials.env{
"postman": {
"profiles": [
{
"name": "default",
"apiKeyEnvVar": "POSTMAN_API_KEY_DEFAULT",
"workspaceId": null
}
],
"activeProfileName": "default",
"mcpUrl": "https://mcp.postman.com/mcp"
},
"stitch": {
"profiles": [
{
"name": "default",
"apiKeyEnvVar": "STITCH_API_KEY_DEFAULT"
}
],
"activeProfileName": "default",
"mcpUrl": "https://stitch.googleapis.com/mcp"
},
"mcp": {
"server": "cubis-foundry",
"runtime": "docker",
"fallback": "local",
"docker": {
"image": "ghcr.io/cubetiq/foundry-mcp:<package-version>",
"updatePolicy": "pinned"
},
"catalog": {
"toolSync": true
}
}
}
Inline keys are rejected on new writes and scrubbed during migration.
# List profiles
cbx workflows config keys list --service all --scope global
# Add profile (env-alias-first)
cbx workflows config keys add --service postman --name team-a --env-var POSTMAN_API_KEY_TEAM_A --scope global
cbx workflows config keys add --service stitch --name prod --env-var STITCH_API_KEY_PROD --scope global
# Switch active profile
cbx workflows config keys use --service postman --name team-a --scope global
# Remove non-active profile
cbx workflows config keys remove --service postman --name old-profile --scope global
# Migrate legacy inline keys to env aliases
cbx workflows config keys migrate-inline --scope global --redact
# Doctor check for inline keys / unsafe headers
cbx workflows config keys doctor --scope global
# Persist selected env values into ~/.cbx/credentials.env (mode 600)
cbx workflows config keys persist-env --service all --scope global
Alias commands are also available:
cbx workflows config keys ... commands only.cbx workflows install --platform codex --scope global --bundle agent-environment-setup --postman --postman-mode full
If active Postman env var (for example POSTMAN_API_KEY_DEFAULT) is available and --yes is not used, installer can show workspace chooser and save selected workspaceId in active Postman profile.
--postman and --stitch now install gateway-backed MCP topology by default:
cubis-foundry as the client-facing MCP server for the selected platformpostman.*, stitch.*, and status/catalog passthrough tools through that gateway.cbx/mcp/*/{postman,stitch}.json artifacts when present--postman still installs the postman skill. --stitch now installs the canonical stitch skill. Managed platform rules route through those skills first when the prompt clearly targets those domains.
postman.* and stitch.* execution should happen through Foundry passthrough tools, not direct standalone client wiringcbx workflows config keys doctor scans cbx_config.json, generated artifacts, and client runtime configs for leaked inline credentialscbx workflows config keys migrate-inline scrubs leaked inline keys, rewrites profiles to env aliases, and reapplies secure Foundry MCP wiringQuota-safe execution facts:
cbx workflows install --platform codex --scope global --bundle agent-environment-setup --postman --postman-mode full --postman-workspace-id "<workspace-id>" --yes
Clear workspace ID:
cbx workflows install --platform codex --scope global --bundle agent-environment-setup --postman --postman-mode full --postman-workspace-id null --yes
If config already exists and you want to overwrite saved values:
cbx workflows install --platform codex --scope global --bundle agent-environment-setup --postman --postman-mode full --overwrite --yes
Stitch is supported on all active Foundry platforms: codex, claude, copilot, gemini, and antigravity.
cbx workflows install --platform codex --bundle agent-environment-setup --stitch --yes
cbx workflows install --platform claude --bundle agent-environment-setup --stitch --yes
cbx workflows install --platform copilot --bundle agent-environment-setup --stitch --yes
cbx workflows install --platform gemini --bundle agent-environment-setup --stitch --yes
cbx workflows install --platform antigravity --bundle agent-environment-setup --stitch --yes
The selected client receives cubis-foundry MCP wiring, and Stitch access flows through the Foundry gateway plus the stitch skill. See docs/stitch_mcp.md for the platform details and workflow guidance.
--playwright patches a PlaywrightMCP entry into the selected platform runtime target without requiring Postman credentials or a generated Postman MCP definition file.
cbx workflows install --platform codex --bundle agent-environment-setup --playwright
Default managed URL:
http://localhost:8931/mcp
Playwright MCP patching is supported for Codex, Antigravity, Gemini CLI, Copilot, and Claude runtime targets.
Runtime target patching:
Codex:
~/.codex/config.toml (via codex mcp add/remove)<workspace>/.vscode/mcp.jsoncubis-foundry (command: cbx mcp serve --transport stdio --scope <global|project>)
global or project) in this command.docker, install points cubis-foundry at the local Docker endpoint (http://127.0.0.1:3310/mcp) instead of the stdio command.Antigravity:
~/.gemini/settings.json (mcpServers)<workspace>/.gemini/settings.json (mcpServers)cubis-foundry (command template)
global or project) in this command.Copilot:
~/.copilot/mcp-config.json (servers)<workspace>/.vscode/mcp.json (servers)cubis-foundry (stdio command server)
global or project) in this command.Claude:
~/.claude/mcp.json (mcpServers)<workspace>/.mcp.json (mcpServers)cubis-foundryGemini CLI:
~/.gemini/settings.json (mcpServers)<workspace>/.gemini/settings.json (mcpServers)cubis-foundryLegacy direct Postman/Stitch definitions under .cbx/mcp/<platform>/ are cleanup targets only and are no longer the default install model.
cbx workflows install --platform <codex|antigravity|copilot|claude|gemini> --bundle agent-environment-setup
cbx workflows remove <bundle-or-workflow> --platform <platform>
cbx workflows remove-all --scope <project|global|all> --platform <platform|all>
cbx workflows prune-skills --platform <platform> --scope <project|global> --skill-profile <core|web-backend|full> [--dry-run]
cbx workflows doctor --platform <platform> --scope <project|global>
cbx workflows sync-rules --platform <platform> --scope <project|global>
MCP runtime flags (install):
cbx workflows install --platform codex --bundle agent-environment-setup --postman \
--postman-mode full \
--mcp-runtime docker \
--mcp-fallback local \
--mcp-image ghcr.io/cubetiq/foundry-mcp:<package-version> \
--mcp-update-policy pinned \
--mcp-build-local # optional: build image locally instead of docker pull
When --mcp-runtime docker is selected and Docker is available, install now prepares the image automatically:
docker pull)--mcp-build-local is setMCP tool catalog commands:
cbx mcp tools sync --service all --scope global
cbx mcp tools list --service postman --scope global
cbx mcp tools list --service stitch --scope global
Notes:
cbx mcp tools sync requires POSTMAN_API_KEY_DEFAULT.--service stitch or --service all, it also requires STITCH_API_KEY_DEFAULT.MCP manifest + managed rules block maintenance:
# Generate/refresh MCP manifest snapshot
npm run generate:mcp-manifest
# Validate MCP skill catalog + rule references
npm run validate:mcp-skills
npm run validate:mcp-manifest
# Inject/check managed MCP block in platform rule files
npm run inject:mcp-rules:all
npm run check:mcp-rules:all
Generated MCP artifacts:
mcp/generated/mcp-manifest.json (catalog snapshot used by managed rule blocks)mcp/generated/README.md (artifact notes)Foundry local serve command (canonical entrypoint for MCP client registration):
# stdio (default)
cbx mcp serve --transport stdio --scope auto
# http for local smoke/debug
cbx mcp serve --transport http --scope auto --host 127.0.0.1 --port 3100
# verify vault only
cbx mcp serve --scan-only
MCP Docker runtime commands:
# Inspect runtime/container state
cbx mcp runtime status --scope global --name cbx-mcp
# Start runtime container (pull/build image first as needed)
cbx mcp runtime up --scope global --name cbx-mcp --port 3310 --fallback local
# Recreate existing container
cbx mcp runtime up --scope global --name cbx-mcp --replace --fallback local
# Force an explicit skill vault mount source
cbx mcp runtime up --scope global --name cbx-mcp --replace --skills-root ~/.agents/skills
# Stop/remove runtime container
cbx mcp runtime down --name cbx-mcp
Docker E2E MCP check (single command):
npm run test:mcp:docker
If port 3310 is already in use (for example by an existing cbx-mcp runtime), use a different port:
CBX_MCP_PORT=3999 npm run test:mcp:docker
Optional strict key mode:
CBX_MCP_REQUIRE_KEYS=1 npm run test:mcp:docker
Use host skill vault instead of the script's isolated sample vault:
CBX_MCP_USE_HOST_SKILLS=1 npm run test:mcp:docker
# or an explicit path
CBX_MCP_USE_HOST_SKILLS=1 CBX_MCP_HOST_SKILLS_DIR="$PWD/.agents/skills" npm run test:mcp:docker
Context budget reporting (from MCP skill tools):
structuredContent.metrics with deterministic estimates.fullCatalogEstimatedTokensresponseEstimatedTokensselectedSkillsEstimatedTokens or loadedSkillEstimatedTokensestimatedSavingsVsFullCatalogestimatedSavingsVsFullCatalogPercentskill_budget_report for consolidated Skill Log + Context Budget.token.full_catalog, token.selected, token.loaded, token.savings, etc.) for quick visibility.ceil(char_count / charsPerToken) (default charsPerToken=4), not provider billing tokens.Install profile flags:
# default full profile
cbx workflows install --platform codex --bundle agent-environment-setup
# expanded workflow profile
cbx workflows install --platform codex --bundle agent-environment-setup --skill-profile web-backend
# explicit full profile
cbx workflows install --platform codex --bundle agent-environment-setup --all-skills
# Show config (+ computed status block)
cbx workflows config --scope global --show
# Edit active Postman workspace ID
cbx workflows config --scope global --edit
cbx workflows config --scope global --workspace-id "<workspace-id>"
cbx workflows config --scope global --clear-workspace-id
# Set Postman MCP mode without jq edits (also patches MCP artifacts/targets)
cbx workflows config --scope global --platform codex --postman-mode full
# Switch MCP runtime preference quickly
cbx workflows config --scope project --mcp-runtime local
cbx workflows config --scope project --mcp-runtime docker --mcp-fallback local
--show now includes computed status:
cbx rules init --platform <platform> --scope project --overwrite
cbx rules tech-md --overwrite
cbx rules tech-md --overwrite --compact
The following aliases were removed:
cbx skills ...cbx installcbx platformscbx workflows initUse these canonical replacements:
cbx init (guided interactive installer)cbx workflows ...cbx workflows installcbx workflows platformscbx remove all)Use this when you want to remove all CBX-managed generated artifacts in one step.
# Preview
cbx remove all --scope all --platform all --dry-run
# Apply
cbx remove all --scope all --platform all --yes
Equivalent workflow command:
cbx workflows remove-all --scope all --platform all --yes
What it removes (by scope/platform selection):
AGENTS.md, ENGINEERING_RULES.md, TECH.md) where applicable..cbx metadata artifacts created by installer flows.~/.cbx/credentials.env) when --include-credentials is provided.To keep generated artifacts out of git in app repositories, add these ignore entries:
.cbx/
.agents/
.codex/
.claude/
.gemini/
.github/agents/
.github/skills/
.github/prompts/
AGENTS.md
ENGINEERING_RULES.md
TECH.md
MCP startup failed: Environment variable POSTMAN_API_KEY_* ... is not setCause:
Fix:
export POSTMAN_API_KEY_DEFAULT="<key>"
cbx workflows config --scope global --show
Then confirm status.postman.effectiveSource is env.
Stitch or Postman key leaked into cbx_config.json or client configUse the credential doctor and migration flow:
cbx workflows config keys doctor --scope project
cbx workflows config keys migrate-inline --scope project
This scans cbx_config.json, generated .cbx/mcp artifacts, .vscode/mcp.json, .mcp.json, .gemini/settings.json, ~/.copilot/mcp-config.json, and ~/.codex/config.toml, then scrubs inline keys and reapplies secure Foundry MCP wiring.
apiKeySource looks unset even after exportUse:
cbx workflows config --scope global --show
Check these fields:
status.postman.storedSourcestatus.postman.effectiveSourcestatus.postman.effectiveEnvVarIf stored source is env but effective source is unset, your env var alias is missing in the running process.
If installer says config was skipped:
--overwrite, orcbx workflows config / cbx workflows config keys ... to mutate existing config.Cause:
/workflows/skills.Fix:
# Ensure host skill vault exists
ls ~/.agents/skills
# Recreate runtime
cbx mcp runtime up --scope global --name cbx-mcp --replace
# Check mount hint
cbx mcp runtime status --scope global --name cbx-mcp
# Force mount from an explicit path
cbx mcp runtime up --scope global --name cbx-mcp --replace --skills-root ~/.agents/skills
If ~/.agents/skills is missing, runtime still starts but will warn and skill discovery may return zero.
cbx mcp runtime up runs HTTP transport in Docker for shared local endpoint (http://127.0.0.1:<port>/mcp).cbx mcp serve --transport stdio runs local stdio transport for command-based MCP clients.cubis-foundry) for direct client integrations; use Docker runtime for explicit HTTP endpoint use cases.127.0.0.1:<port>/mcpIf Docker runtime starts but MCP endpoint is unreachable:
# Check health and hints
cbx mcp runtime status --scope project --name cbx-mcp
# Switch this project to local runtime
cbx workflows config --scope project --mcp-runtime local
# Use direct local server path
cbx mcp serve --transport stdio --scope auto
Installer now auto-cleans nested duplicate skills (for example duplicates under postman/*).
Run refresh install:
cbx workflows install --platform codex --bundle agent-environment-setup --overwrite --yes
cbx_config.jsonBehavior is now hard-fail. Create/repair cbx_config.json first:
cbx workflows config --scope global --clear-workspace-id
cbx_config.json is now metadata-only for Postman/Stitch; persisted secrets belong in ~/.cbx/credentials.env.profiles[] + activeProfileName).config keys commands added (list/add/use/remove).config keys doctor, migrate-inline, and persist-env now enforce secure credential storage and cleanup.config --show now reports stored vs effective auth source.skills, root install/init/platforms, workflows init).src/cli with compiled output under dist/cli.ENGINEERING_RULES.md now auto-refreshes generated/legacy templates on cbx rules init without requiring --overwrite.npm install -g @cubis/foundry
cbx workflows install --platform codex --bundle agent-environment-setup --overwrite --yes
cbx workflows config --scope global --show
FAQs
Cubis Foundry CLI for workflow-first AI agent environments
The npm package @cubis/foundry receives a total of 1,555 weekly downloads. As such, @cubis/foundry popularity was classified as popular.
We found that @cubis/foundry demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.
Security News
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.
Research
/Security News
Since January 31, 2026, we identified at least 72 additional malicious Open VSX extensions, including transitive GlassWorm loader extensions targeting developers.