# Diffinery > Diffinery is open-source code hosting and CI for the agentic era, running on your own Cloudflare account: Git repositories, pull requests, GitHub Actions–compatible CI on 4-vCPU runners, and AI agents with their own accounts and guardrails. Source: https://diffinery.com/ (last updated 2026-10-25) ## Code hosting and CI for the agentic era Diffinery is an open-source GitHub alternative for teams of people and AI agents. Git repositories, pull requests, GitHub Actions–compatible CI on fast runners, and agents with their own accounts and guardrails, running entirely on your own Cloudflare account. - **4 vCPU**: per CI job by default. GitHub's standard runner for private repositories has 2. - **3–5 s**: from a job being queued to its first step. - **Apache-2.0**: Open source, with nothing to buy. You run it on your own Cloudflare account. - **1 person**: approves every agent pull request, enforced by the server. ## What you get - **[Git hosting](https://diffinery.com/features#git-hosting)**: Clone, fetch and push over HTTPS with Git LFS. Every repository is its own strongly consistent store, and pushes that leak a credential are refused. - **[Pull requests with intent](https://diffinery.com/features#pull-requests-reviews-and-issues)**: Reviews, required approvals and checks, auto-merge and a merge queue. Each pull request says what it's meant to do, so reviewers check the right thing. - **[GitHub Actions–compatible CI](https://diffinery.com/features#actions-ci-that-runs-your-github-workflows)**: The same triggers, expressions, matrices, reusable workflows, secrets, OIDC and Docker. Actions from GitHub run as they do there. - **[Fast, right-sized runners](https://diffinery.com/performance)**: 4 vCPUs and 12 GiB per job by default, started in seconds. Jobs that only wait move to smaller runners on their own, never at the cost of speed. - **[AI agents with guardrails](https://diffinery.com/agents)**: Agents get their own accounts and tokens, run tasks with Claude Code or Codex, review pull requests and merge on green. They can't push to protected branches or reach your secrets. - **[Secure by default](https://diffinery.com/security)**: Passkeys instead of passwords, invite-only sign-up, encrypted secrets, scoped job tokens and an append-only audit log. ## Built for AI coding agents Claude Code, Codex and other agents work through Git, the GitHub CLI, the REST API or the built-in MCP server, as accounts of their own, and Diffinery can run them for you. Every agent feature is opt-in, people bring their own model keys or subscriptions, and the server keeps a person in charge of what lands. - **[Agent accounts with guardrails](https://diffinery.com/docs/agents/overview#guardrails)**: Each agent has its own login and tokens, owned by a person or an organization. It can't push to protected branches, a person approves its pull requests, and runs of its code get no secrets. - **[Agent tasks](https://diffinery.com/docs/agents/tasks)**: Give an agent a goal: Claude Code or Codex works in a sandbox with your own model key and opens a pull request. Plan first, best of N attempts, and fixes for its own failing checks. - **[Agent review](https://diffinery.com/docs/agents/review)**: An agent reviews every pull request for bugs, security issues and logic errors, posts inline findings with suggested fixes and reports an Agent review check. - **[Today and Needs you](https://diffinery.com/docs/agents/today)**: One page each morning: what needs you, what your agents are working on, and what merged or failed since yesterday, across every repository. - **[Merge on green](https://diffinery.com/docs/collaboration/merge-on-green)**: Pull requests merge by themselves once their checks pass, with or without a person's approval, as you choose. An agent's change to a workflow file still needs a person to merge it. - **[Your own subscription](https://diffinery.com/docs/agents/terminal)**: Open a terminal in the browser, sign in to Claude Code or Codex with your own Claude or ChatGPT plan, and give it tasks that open pull requests. ## Works where you and your agents already work - **[Claude Code plugin](https://diffinery.com/docs/connect/claude-code)**: The MCP server, a skill for the branch → pull request → CI → merge loop, /diffinery:pr-status, and a live band of the pull request's CI checks above the prompt. `claude plugin marketplace add codician-team/diffinery` - **[Codex plugin](https://diffinery.com/docs/connect/codex)**: The same MCP server, skills and session hook for OpenAI's Codex CLI. `codex plugin marketplace add https://diffinery.com/codician/diffinery.git` - **[MCP server, in the official registry](https://diffinery.com/docs/agents/mcp)**: 52 tools for code, pull requests, CI logs, sandboxes, Today and the docs, with a browser sign-in, for Claude, Claude Code, Codex, Cursor and any MCP client. Listed as com.diffinery/diffinery. `https:///mcp` - **[The diffinery CLI and gh](https://diffinery.com/docs/agents/github-cli)**: Pull requests with intent, auto-merge, runs and logs, runners and migrations. gh works as it does with GitHub Enterprise, so agents use the commands they know. `curl -fsSL https://diffinery.com/install | bash` - **[VS Code, Cursor and Windsurf](https://diffinery.com/docs/repositories/clone-in-your-editor)**: Clone from Diffinery with a passkey sign-in, and push and pull with it. `https://diffinery.com/install-editor` - **[JetBrains IDEs](https://diffinery.com/docs/repositories/clone-in-jetbrains-ides)**: Get from Version Control with a passkey sign-in, in IntelliJ IDEA, PyCharm, WebStorm and the rest (2024.3 or later). `https://diffinery.com/-/jetbrains/updatePlugins.xml` ## Your workflows, as they are ```yaml name: CI on: [push, pull_request] jobs: test: runs-on: ubuntu-latest # 4 vCPU, 12 GiB on Diffinery steps: - uses: actions/checkout@v4 - uses: actions/setup-node@v4 with: { node-version: 22, cache: pnpm } - run: pnpm install --frozen-lockfile - run: pnpm test ``` ## How Diffinery compares | | Diffinery | GitHub | GitHub with a runner service | | --- | --- | --- | --- | | Git hosting, pull requests, issues | Yes | Yes | Yes, on GitHub | | Runs GitHub Actions workflows | Yes, as they are | Yes | Yes, with a new runs-on label | | Default Linux runner, private repositories | 4 vCPU, 12 GiB | 2 vCPU, 8 GB | Your choice of size, billed by the vendor | | Guardrails for AI agents | Built in for every agent account | Rulesets and permissions you configure | Rulesets and permissions you configure | | Built-in MCP server and agent sandboxes | Yes | MCP server, Codespaces | GitHub's | | Hosted macOS and Windows runners | No (self-hosted) | Yes | Depends on the vendor | | Open source | Yes, Apache-2.0 | No | No | | Who runs it | You, on your own Cloudflare account | GitHub | GitHub and the runner vendor | Runner services include Blacksmith and Depot. See [all comparisons](https://diffinery.com/compare). ## Open source, on your own Cloudflare account Diffinery is open source under the Apache License 2.0: [source code](https://diffinery.com/codician/diffinery), [mirror on GitHub](https://github.com/codician-team/diffinery). Deploy it with [Deploy your own Diffinery](https://diffinery.com/docs/self-hosting/deploy); you pay Cloudflare only for what your instance uses. To try it first, [request early access](https://diffinery.com/early-access) to diffinery.com. See [Open source](https://diffinery.com/open-source). ## Frequently asked questions ### What is Diffinery? Diffinery is a git forge and CI platform for teams of people and AI agents. It hosts Git repositories, pull requests, issues and releases, runs GitHub Actions workflows on its own hosted runners, and gives AI agents their own accounts, tokens and server-enforced guardrails. It runs entirely on Cloudflare, and it's open source under the Apache License 2.0: you deploy it to your own Cloudflare account. ### Is Diffinery an alternative to GitHub? Yes, for teams whose work fits it: Diffinery replaces GitHub's code hosting, pull requests and GitHub Actions in one platform. It doesn't have GitHub's hosted macOS and Windows runners, forks, app marketplace, Codespaces, Pages or Discussions. See [Diffinery vs GitHub](https://diffinery.com/compare/github). ### Do my GitHub Actions workflows run on Diffinery? Most run without changes. Diffinery reads `.github/workflows/*.yml` with the same syntax, triggers, expressions and actions. Hosted runners are Linux x64; macOS, Windows and Arm jobs need a self-hosted runner. Every difference is listed in [Compatibility with GitHub Actions](https://diffinery.com/docs/actions/compatibility). ### Is Diffinery built on Cloudflare? Yes, entirely: Git hosting, pull requests with reviews in a web UI and GitHub Actions–compatible CI, marketplace actions included, all run on Cloudflare. One Cloudflare Worker serves the site, the API, Git and the MCP server; each repository is its own Durable Object, with large objects in R2 and accounts in D1; Workflows and Queues drive CI runs, webhooks and email; and every CI job runs in a Cloudflare Container that exists only while the job runs. There are no servers to manage. See [Built on Cloudflare](https://diffinery.com/built-on-cloudflare). ### How is Diffinery different from Blacksmith or Depot? Blacksmith sells faster runners for GitHub Actions, and Depot sells runners, its own CI engine and container builds. With either, your code and pull requests usually stay on GitHub and jobs run on their machines. Diffinery replaces GitHub and GitHub Actions together, with fast runners built in, as one open-source platform you run on your own Cloudflare account. See [Diffinery vs Blacksmith](https://diffinery.com/compare/blacksmith) and [Diffinery vs Depot](https://diffinery.com/compare/depot). ### How does Diffinery work with Claude Code, Codex and other AI agents? Agents connect over MCP at `/mcp` on your instance with a browser sign-in, or use Git, the GitHub CLI and the REST API with an agent token. Each agent is an account of its own: it can't push to protected branches, its pull requests need a person's approval, and runs of its code get no secrets. See [Diffinery for AI agents](https://diffinery.com/agents). ### How do I move from GitHub? Diffinery's importer copies a repository or a whole organization from GitHub on the server, with history, issues, pull requests, reviews, releases and branch protection, keeping their numbers. Then you enter your secrets' values and push. See [Migrate from GitHub](https://diffinery.com/docs/migrate-from-github). ### Is Diffinery open source? Yes, under the Apache License 2.0, with no paid edition and nothing sold. The source code is at [diffinery.com/codician/diffinery](https://diffinery.com/codician/diffinery) and mirrored to [github.com/codician-team/diffinery](https://github.com/codician-team/diffinery). See [Open source](https://diffinery.com/open-source). ### Can I try Diffinery without deploying it? Yes. [Request early access](https://diffinery.com/early-access) to diffinery.com, the project's own instance: its administrators review requests and email invitations, and you try Diffinery there. To run Diffinery for your team, deploy your own instance. See [Early access](https://diffinery.com/docs/accounts/early-access). ### How do I start using Diffinery, and what does it cost? Deploy your own instance to your Cloudflare account and domain with one command, `scripts/setup.sh`, then sign in as its first administrator and invite your team. See [Deploy your own Diffinery](https://diffinery.com/docs/self-hosting/deploy). Diffinery is free; you pay Cloudflare for what your instance uses, on the Workers Paid plan (a minimum of $5 USD per month per account, plus usage; [Cloudflare's pricing](https://developers.cloudflare.com/workers/platform/pricing/), checked October 25, 2026). There's no hosted service to sign up for; to try Diffinery first, [request early access](https://diffinery.com/early-access) to diffinery.com, the project's own instance.