Deploy and Operate

Once your company has a repository and hosting, your agent changes your product's code, ships it live, and runs its database, functions, and secrets.

Work on the Repository

Your repository holds your product's code. Your agent clones it, makes changes, checks them, and pushes them straight to the production branch, then deploys. New repositories use main, and existing ones keep their branch.

Your agent starts with cofounder repo status. It shows the production branch, the last deploy, and open pull requests, so your agent knows what's already in progress.

cofounder repo clone                        # clone with your configured SSH identity
cofounder repo status                       # production branch, last deploy, open PRs

Your agent reaches the repository one of two ways:

• Over HTTPS, with a short-lived token for the company's repository, including imported ones. Your agent keeps it out of the remote URL and gets a fresh one when it expires.
• Over SSH on managed repositories, with a key pair your agent makes where it runs. Only the public key is registered with Cofounder. You can list and revoke registered keys.

Your agent can leave a handoff note for whoever works on the branch next. To enter environment variables yourself, use the dashboard secrets page before continuing an import.

Bring Your Own Repository

If you already have code, your agent can copy a local folder into the repository Cofounder made, or import your GitHub repository.

Uploading a local folder needs no GitHub connection. Your agent previews the upload first, then sends it:

cofounder repo upload . --dry-run
cofounder repo upload . --yes --expected-head <base_sha>
cofounder repo clone <new-folder>

The upload replaces the files on the production branch and keeps the repository's history. Your local files, Git history, and remotes don't change. Git-ignored files, dependencies, build output, common secret files, and symlinks are left out. Environment examples are kept. An active import must be disconnected first. The push can start a deploy. Your agent then works in the new clone and follows the upload's instructions to fix the app, configure Vercel and Supabase, add missing secrets securely, deploy, and check the live app.

Over MCP, your agent gets an upload token with code_upload_token_create and runs the same upload with Git. The cofounder-repo-mcp skill has the steps.

Importing a GitHub repository makes it the company's app instead of the one setup made:

1. You connect GitHub and choose which repositories the Cofounder GitHub App can see.
2. If only one writable repository is available, your agent picks it. Otherwise you tell it which one. Browsing your repositories doesn't start an import.
3. For a single-app company, there's nothing to set up in Vercel. Cofounder deploys the repository whenever your agent deploys and whenever a commit lands on its default branch.
4. Otherwise, the repository connects to the existing Vercel project. If Vercel can't read it, the previous connection comes back and the import waits for you. Accept the Vercel invitation, open the Git settings link your agent gives you, and connect the repository to that project. For a personal GitHub repository, its owner must do this. Your agent then finishes the import.

Importing doesn't deploy the app, and any database setup stays attached. Your agent can cancel an unfinished import. After an import finishes, disconnecting switches back to the repository setup made. After a GitHub-only setup there is none to restore, so hosting and the database stay ready for another import.

cofounder repo import --json
cofounder repo import <owner/repo> --json
cofounder repo import continue --json

Deploy

A deploy runs your database migrations and ships your code to Vercel. It takes a while. Your agent follows it until it finishes, then checks that the app came up. Every deploy stays in the history, with its events.

Readiness describes one exact deployment. If a newer deployment owns the app address, the older one reports mismatch and tells your agent how to inspect the newer deployment. Follow that check to verify its health. Matching source revisions alone do not make the older deployment live.

Run the Database

Migrations, functions, secrets, and queries on your app's Supabase database run through your Cofounder login, so you need nothing extra on your machine. See Database for queries, branches, and storage.

Set App Secrets

App secrets go straight to your hosting without touching a local env file. Deploy secrets and local env files are different things. See Secrets and Environment Files.

Hosting and GitHub Credentials

When your agent needs to run the Vercel CLI or check workflow runs through GitHub's API, it can get the providers' own credentials. These are CLI and API only.

The GitHub token works only on the company's repository and expires after about an hour. Your agent keeps it out of logs and commits and gets a fresh one after it expires. On MCP, the push token gives only Git access with contents:write and can't edit workflow files.

Commands

cofounder database also covers query, branches, and storage, and cofounder database refs list lists the databases.

For Git over HTTPS, store the push token in COFOUNDER_GIT_TOKEN and use it through GIT_ASKPASS for clone, fetch, and push. The cofounder-repo-mcp skill shows the setup, and the cofounder-repo skill covers CLI access. Use the returned env.GH_TOKEN and env.GH_REPO from gh-credentials create with GitHub's API or gh.