Codebahn

Codebahn CLI

Codebahn is the private GitHub alternative: fast Git and CI for developers and teams. Your code is stored and served. Not scanned, not trained on, not tracked. Swedish company, EU-only infrastructure, every sub-processor EU-incorporated. Built on Forgejo, easy to leave.

Command-line interface for Codebahn.

codebahn auth login

codebahn pr list codebahn issue create --title "ship it" codebahn ci dispatch --workflow ci.yml

One binary. OAuth login. No config files.

Install

Linux and macOS

curl -fsSL https://releases.codebahn.net/cli/install.sh | sh

This detects your platform, downloads the latest binary, verifies its SHA256 checksum, and installs to ~/.local/bin. Override the location with INSTALL_DIR:

curl -fsSL https://releases.codebahn.net/cli/install.sh | INSTALL_DIR=/usr/local/bin sh

Windows

irm https://releases.codebahn.net/cli/install.ps1 | iex

This downloads the latest binary, verifies its SHA256 checksum and GPG signature (if gpg is installed), installs to %LOCALAPPDATA%\Programs\codebahn, and adds it to your PATH. Override the install location with $env:INSTALL_DIR. Restart your terminal after install.

From source

Install from source (note: source builds skip auto-update):

go install github.com/codebahn/codebahn-cli/cmd/codebahn@latest

Updates

The CLI checks for new versions once every 24 hours and prints a notice when one is available. To update in place:

codebahn update

This downloads the new binary from releases.codebahn.net, verifies its GPG signature and SHA256 checksum, and replaces itself. No external tools required.

To check without installing: codebahn update --check. To silence the periodic check: set CODEBAHN_NO_UPDATE_CHECK=1 or add "check_updates": false to the config file (~/.config/codebahn/config.json, or %APPDATA%\codebahn\config.json on Windows).

Authentication

Log in through the browser. Tokens are saved to ~/.config/codebahn/config.json (%APPDATA%\codebahn\config.json on Windows).

codebahn auth login

codebahn auth status

For CI, set CODEBAHN_TOKEN instead.

Commands

When you run inside a Git repo, --owner and --repo are detected from the remote.

codebahn pr merge --index 42 --style squash

codebahn repo cat --ref main --filePath README.md codebahn ci logs --run_id 7

Review a pull request commit by commit:

codebahn pr commits --index 42

codebahn repo show --sha 1a2b3c4 --file_path internal/foo.go codebahn repo compare --base main --head feat/foo codebahn repo log --path internal/foo.go --limit 10

Every subcommand accepts --help.

MCP and AI agents

Codebahn has a built-in, hosted MCP server that connects AI coding agents to your repos, issues, pull requests, and CI:

https://codebahn.net/mcp

The tools/ package in this repo is the shared source of truth for both this CLI and the MCP endpoint. 103 tools, one set of types, zero drift.

The server authenticates over OAuth, discovered via /.well-known/oauth-protected-resource. Add the URL to your MCP client and approve the OAuth prompt in your browser on first use.

Claude Code

claude mcp add --transport http codebahn https://codebahn.net/mcp

Codex

codex mcp add codebahn --url https://codebahn.net/mcp

VS Code (Copilot)

Create .vscode/mcp.json in your project root:

{

"servers": { "codebahn": { "type": "http", "url": "https://codebahn.net/mcp" } } }

Cursor

Create .cursor/mcp.json in your project root:

{

"mcpServers": { "codebahn": { "type": "http", "url": "https://codebahn.net/mcp" } } }

Full docs: codebahn.net/docs/mcp/.

Release infrastructure

Codebahn is an EU-hosted Git platform. We apply that principle to our own tooling: the CLI's release artifacts are hosted on our own EU infrastructure, not on GitHub or any third-party CDN.

How releases work:

1. Source code lives here on GitHub (public, for discoverability).
2. When we tag a release, GitHub Actions cross-compiles binaries for Linux and macOS (amd64 and arm64).
3. The workflow uploads the binaries, a SHA256 checksums file, and a detached GPG signature to Scaleway Object Storage in fr-par (Paris, France), served at releases.codebahn.net.
4. codebahn update fetches from releases.codebahn.net. It never contacts GitHub.

Release artifacts are hosted on our own EU infrastructure so the CLI's update check stays within the EU. Source code is on GitHub because it's the standard home for open-source projects. GitHub Actions compiles the public source; no customer data is involved in the build.

Verifying releases

Every release includes a checksums.txt file signed with our GPG release key. The CLI verifies both the signature and the checksum automatically during codebahn update.

To verify manually:

# Import the public key

curl -sS https://codebahn.net/release-signing-key.asc | gpg --import

Download and verify

curl -O https://releases.codebahn.net/cli/v0.1.0/checksums.txt curl -O https://releases.codebahn.net/cli/v0.1.0/checksums.txt.asc gpg --verify checksums.txt.asc checksums.txt

Check the binary

sha256sum -c checksums.txt --ignore-missing

The public key is also embedded in the CLI binary itself, so codebahn update does not need to fetch it separately.

Cutting a release

Tag and push:

git tag v0.1.0

git push origin v0.1.0

The GitHub Actions workflow runs tests, builds with GoReleaser (parallel cross-compilation, GPG signing), and uploads everything to releases.codebahn.net. The latest.json manifest is updated so existing installs pick up the new version within 24 hours.

For a local release (bypassing CI): ./scripts/release.sh v0.1.0. Requires goreleaser, gpg (with the release key), and aws CLI configured for Scaleway.

Contributing

See CONTRIBUTING.md.

License

MIT