Profile recipes

Codex with Context7 and Linear MCP

This profile starts Codex with its existing sign-in; Stashbase does not provide an OpenAI API key. It loads Context7 and Linear credentials from the selected Stashbase environment, then injects each only at its MCP host.

project = "project"
environment = "environment"
egress_hosts = ["api.openai.com", "chatgpt.com"]
deny_hosts = ["api.stashbase.dev"]

# Context7 expects its key in a custom header.
[secrets.CONTEXT7_API_KEY]
hosts = ["mcp.context7.com"]
header = "CONTEXT7_API_KEY"

# Linear accepts its API key as Authorization: Bearer <key>.
[secrets.LINEAR_API_KEY]
hosts = ["mcp.linear.app"]

The child receives CONTEXT7_API_KEY and LINEAR_API_KEY placeholders, never the real values. The Context7 value is exchanged only in its required custom header at mcp.context7.com; the Linear value is exchanged only as a Bearer token at mcp.linear.app.

Start Codex with the profile:

stashbase agent validate --profile codex-mcp --profile-source directory
stashbase agent run --profile codex-mcp --profile-source directory -- codex

The egress_hosts list supports the existing Codex sign-in. Do not add mcp.context7.com or mcp.linear.app to it: their secret-specific bindings authorize credential-bearing requests. If an additional Codex authentication host is denied, inspect it with stashbase agent logs list --action host_denied before adding the smallest necessary egress entry.

If your organization uses a custom Stashbase API endpoint, replace api.stashbase.dev with the hostname from STASHBASE_API_URL.