openproject-codex

openproject-codex is a skill for Claude Code, Codex from varaprasadreddy9676/openproject-codex-plugin. It costs 27 tokens per session (881 once invoked), scanned A, original, MIT.

A Codex skill for managing OpenProject, a project-management system, through its API instead of its web interface. It covers projects, teams, memberships, and work packages, which are tracked pieces of project work.

In plain words
What is it for?
Check the connection, configure access, inspect projects and teams, and manage memberships and work packages through available OpenProject tools.
Why use it?
It lets developers inspect and update OpenProject work from Codex without switching to the OpenProject interface.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: installed under .agents/ (shared by several agents); mentions Codex.

Good fit Check the connection, configure access, inspect projects and teams, and manage memberships and work packages through available OpenProject tools.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add varaprasadreddy9676/openproject-codex-plugin --skill openproject-codex
Clone the repo
git clone --depth 1 https://github.com/varaprasadreddy9676/openproject-codex-plugin

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for openproject-codex

README.md
[![agentmods](https://agentmods.dev/badge/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex/github.svg)](https://agentmods.dev/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex)
Your own site
<a href="https://agentmods.dev/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex"><img src="https://agentmods.dev/badge/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for openproject-codex

Your own site · 80×15
<a href="https://agentmods.dev/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex"><img src="https://agentmods.dev/badge/skills/varaprasadreddy9676/openproject-codex-plugin/openproject-codex.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 27 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 881 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00027 $0.00881
Opus 5.5 $0.00011 $0.00352
Sonnet 5.5 $0.00005 $0.00176
Haiku 4.5 $0.00003 $0.00088

Measured 1mo ago against content hash 203cb28ce2da, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

openproject-codex scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/plugins/plugins/openproject-codex/skills/openproject-codex/SKILL.md · 51 lines

How it starts

The opening of the file, as written. The whole thing — 51 lines — stays where its author put it; the contents beside it link to each section on GitHub.

OpenProject Codex

Use this plugin when the user wants to work with OpenProject from Codex instead of using the OpenProject UI.

The plugin is intended to cover common project-management actions directly and then fall back to the generic authenticated API tool for any OpenProject module that is not yet represented by a dedicated MCP tool.

Behavior

  • Prefer the MCP tools from this plugin for project, team, membership, and work package operations.
  • Default to the configured OPENPROJECT_DEFAULT_PROJECT when present, unless the user explicitly asks for another project.
  • Use openproject_connection_status first if credentials or connectivity are uncertain.
  • If configuration is missing, use openproject_setup_connection to capture the base URL and API token directly from chat before attempting other actions.
  • Use openproject_test_connection or openproject_whoami after setup when you need a quick verification step.
  • API token authentication is preferred, but UI-session authentication is supported when OPENPROJECT_UI_USERNAME and OPENPROJECT_UI_PASSWORD are configured.
  • Use openproject_list_types, openproject_list_statuses, openproject_list_priorities, and openproject_list_project_assignees before write operations when a value needs to be discovered.
  • Use assignee_name, responsible_name, status_name, priority_name, and customer on openproject_create_work_package and openproject_update_work_package when the user provides human-readable values.
  • Use openproject_list_custom_field_options or openproject_resolve_custom_field_option for Customer or other list-style custom fields instead of using the browser UI.
  • Use dedicated tools first for projects, users, groups, memberships, versions, categories, queries, work packages, relations, watchers, comments, documents, news, time entries, attachments, file links, boards, wiki pages, meetings, reporting, and bulk task operations.
  • Prefer openproject_my_work for “my items” or “items assigned to me” requests.
  • Prefer the query tools when the user refers to saved views or wants bulk actions across a query result set.
  • Prefer the bulk tools for repeated edits instead of issuing many single-item calls one by one.
  • Prefer the reporting tools for workload, overdue, burndown, and project health export requests instead of assembling ad hoc summaries by hand.
  • If the user needs an OpenProject action that does not yet have a dedicated tool, use openproject_call_api against the relevant /api/v3/... endpoint instead of sending the user back to OpenProject UI.
  • The official OpenProject /mcp endpoint is read-only, so write operations should continue to use this plugin's API tools.
  • Boards, wiki pages, and meetings may use authenticated UI-backed workflows when the public API surface is incomplete; ensure the UI credential env vars are configured before relying on those tools.

Read the full file on GitHub · 51 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 51 lines · 27 tokens per session scan A 203cb28ce2da

Subscribe to this mod's changes

openproject-codex is a skill published in the GitHub repository varaprasadreddy9676/openproject-codex-plugin (1 stars, last pushed 3mo ago), licensed MIT. It adds 27 tokens to every session and 881 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.