A Codex cron teammate that catches when your dependencies' real changelogs drift from your code — every flag backed by the vendor's own cited URL. A standing weekday teammate that tells you, with the vendor's own source link in hand, exactly which of your dependencies changed and which of your code's usages that affects — before it breaks in prod.
A self-contained Codex Automation: a TOML cron task (default '0 7 * * 1-5') plus a memory file, that on each run (a) reads the repo's actual dependency surface (package.json / requirements.txt / imports / model-SKU strings like 'claude-opus-4-x' or 'gpt-5.x'), (b) queries the connected Synorb MCP for the latest cited changelog/release-note manifests for exactly those vendors over the window since the last run, (c) diffs what the vendor announced against what the code uses, and (d) writes a ranked 'drift report' to the Triage inbox — and, when a change is actionable, opens a draft PR whose body cites the real vendor source_url for every claim. Persistent memory means it only reports NEW drift each run and auto-archives quiet days.
This is the single product that turns Codex's two best-in-class features — native cron Automations with persistent memory, and the Context7/OpenAI-Docs-MCP 'read current third-party docs' pattern — into something only Synorb can power: change-detected, CITED documentation drift. Every other source the agent could pull (web search, scraped docs) is uncited and stale; Synorb returns the vendor's own changelog as a provenance-linked manifest with a real source_url and a claim_type, so the agent can open a PR a human will trust. It is a live demo that writes itself: point it at any real repo with an OpenAI/Anthropic/Vercel dependency and it files a cited drift PR on the first run.
No setup to learn. Codex asks a handful of normal-person questions — each with a smart default, so “you pick” always works — then builds it with live Synorb data flowing in.
Smart default: Auto-detect from package.json / requirements.txt / imports and model-SKU strings; prioritize AI vendors (OpenAI, Anthropic, Vercel/AI SDK) first.
Smart default: Every weekday at 7am; file a quiet Triage note for minor changes and open a draft PR only when a change actually affects code you use.
Smart default: Open a draft PR (titled 'Docs drift: <vendor> <change>') with every claim citing the vendor's real source URL, plus a Triage summary.
Smart default: Engineer — terminal-style monospace report + a clean HTML drift digest with a per-vendor change chart.
Monospace, dark, terminal-native: a tight ranked drift list in the Triage note (BREAKING / NEW / INFO chips), plus a self-contained HTML digest with a per-vendor change-count bar chart. Built for a dev reading at 7am.
Clean changelog-style cards — one card per drifted dependency with a 'what changed / what it affects in your code / read the vendor's note' layout and a prominent source-link button. Reads like a polished internal release brief.
No HTML at all: a single crisp Markdown drift summary in the Triage inbox and the PR body, each line ending in its cited vendor source_url. Maximum signal, zero chrome.
Runtime MCP via Codex's native config. The product is a Codex Automation (TOML cron + prompt + memory file) plus the Synorb MCP server registered in ~/.codex/config.toml under [mcp_servers.synorb] with url='https://mcp.synorb.com/mcp' (Streamable HTTP) and a bearer token via bearer_token_env_var=SYNORB_MCP_TOKEN (or 'codex mcp login synorb'). On each cron fire, Codex runs locally/in a worktree, calls the connected Synorb MCP live (synorb-stream-search to map vendors to streams the first run, then synorb-manifests for the cited changelog window), reasons over the repo, and writes to Triage / opens a PR. Inventory/discovery calls are keyless and zero-quota; the MCP token is requested once at setup in plain terms with a link to https://synorb.com/connect (free, no card) and stored as a local env var server-side — never committed, never in any shipped artifact.
Credential safetySynorb credentials stay server-side or local — never in client/frontend code. You only enter them when the agent asks, with credentials from synorb.com/connect.
Provenance is the product. Every drift line in the Triage note, every row of the HTML digest, and every bullet in the PR body ends with a 'Read the vendor's changelog ->' link that is the exact source_url Synorb returned (anthropic.com/news, vercel.com/changelog, ai-sdk.dev/docs, etc.) — never a guessed URL. The HTML report renders each as a source-domain pill (e.g. 'vercel.com') that opens the original. Any gap-filled web line is visually separated and labeled '[web, unverified]' so a reviewer can tell Synorb-cited ground truth from a web guess at a glance.
Yes. The build prompt connects Synorb at build time to learn the real data shape, then wires live Synorb data into the running product. A standing weekday teammate that tells you, with the vendor's own source link in hand, exactly which of your dependencies changed and which of your code's usages that affects — before it breaks in prod.
Only where they are safe. Runtime MCP via Codex's native config. The product is a Codex Automation (TOML cron + prompt + memory file) plus the Synorb MCP server registered in ~/.codex/config.toml under [mcp_servers.synorb] with url='https://mcp.synorb.com/mcp' (Streamable HTTP) and a bearer token via bearer_token_env_var=SYNORB_MCP_TOKEN (or 'codex mcp login synorb'). On each cron fire, Codex runs locally/in a worktree, calls the connected Synorb MCP live (synorb-stream-search to map vendors to streams the first run, then synorb-manifests for the cited changelog window), reasons over the repo, and writes to Triage / opens a PR. Inventory/discovery calls are keyless and zero-quota; the MCP token is requested once at setup in plain terms with a link to https://synorb.com/connect (free, no card) and stored as a local env var server-side — never committed, never in any shipped artifact.
Provenance is the product. Every drift line in the Triage note, every row of the HTML digest, and every bullet in the PR body ends with a 'Read the vendor's changelog ->' link that is the exact source_url Synorb returned (anthropic.com/news, vercel.com/changelog, ai-sdk.dev/docs, etc.) — never a guessed URL. The HTML report renders each as a source-domain pill (e.g. 'vercel.com') that opens the original. Any gap-filled web line is visually separated and labeled '[web, unverified]' so a reviewer can tell Synorb-cited ground truth from a web guess at a glance.
A real app. Synorb is the cited data core; it also composes the platform's own tools: Codex Automations cron + persistent memory file (native scheduler; tracks last-seen-per-vendor, reports only new drift, auto-archives quiet runs), Codex repo/worktree file access (reads package.json / requirements.txt / source imports / model-SKU string literals to build the real dependency surface), Codex GitHub/PR authoring (opens a draft PR with the cited drift summary in the body) + Triage inbox write, Locally-generated self-contained HTML drift report with an embedded Chart.js bar of 'changes per vendor this window' (no hosting; written to ./drift-report.html), supports_parallel_tool_calls to fan out one synorb-manifests call per vendor, web-search MCP used ONLY to fill a gap when Synorb returns coverage.status=partial for a dependency, and any web-sourced line is visibly tagged '[web, unverified]' and kept separate from Synorb-cited lines.
A few plain-English questions, each with a smart default so you can just say 'you pick': Which tools/services does this project depend on that you most worry about silently changing? (I can also just read your dependency files and figure it out.); How often should I check, and how loud should I be?; When I find an important change, do you want a draft PR opened, or just a written summary I read?; Pick the report look..
The same Synorb MCP connects to every major coding agent. Pick yours.
Generate credentials, connect Codex, and ship something with live, cited intelligence.