Quox store · GitHub Operations · v2.0.0
Your GitHub org, run by agents.
Repos, pull requests and releases, driven by agents and witnessed on WARD.
Buy once, get a licence key, and unlock the plugin from the marketplace inside your QuoxCORE install.
In plain words
What it is, where it lives, when to reach for it
- What is it
- A paid plugin for the QuoxCORE dashboard that manages GitHub issues, pull requests and releases across every repository.
- Where do I use it
- In the dashboard's GitHub view, once your organisation's GitHub personal access token is connected.
- When would I use it
- When your issues, pull requests and releases are spread across more repositories than you can watch by hand.
- How do I use it
- Buy it in the store for $29, then an org admin unlocks it with the licence key.
QuoxCORE is the free, self-hosted platform underneath this. What is QuoxCORE
What it does
One panel for the whole organisation.
Cross-repo issue board and PR view, the VULCAN agent with 13 MCP tools, PATs stored encrypted server-side in QuoxVault, a feedback pipeline, and release management with VOLT audit trails.
Every repository, every issue, every pull request and every release, pulled into QuoxCORE and put under the same governance as the rest of your agents.
Issue board
Every repo, one list.
Stop jumping between repository tabs. The cross-repo issue board pulls issues from every repository in your GitHub organisation into a single, filterable list. Issues sync on a configurable interval and render full markdown inline.
- Filter by repo, label, status and assignee
- Inline actions: close, reassign or label without leaving QuoxCORE
- Full markdown rendering in issue previews
- PR status shown per issue, so you can see if a fix is already open
REPO ISSUE STATUS ASSIGNEE PR ────────────────────────────────────────────────────── quox-dashboard #412 open adam #415 quoxflow #89 open unassigned - quoxagent #34 open adam - quoxterminal #201 open arun #207 quoxmcp #67 closed adam #70 quox-website #156 open unassigned - Showing 6 of 43 issues (filter: all repos, open+closed)
VULCAN agent
VULCAN, your GitHub agent.
VULCAN is an AI agent with 13 MCP tools and full access to your GitHub organisation. Ask questions in natural language and get answers with links. Create issues, draft release notes, check CI status or triage stale PRs, all from the chat panel.
VULCAN understands context across repositories. Ask what broke this week and get a triaged list of failed CI runs, newly opened bugs, and PRs waiting for review.
- Natural language queries against all GitHub data
- 13 MCP tools covering issues, PRs, actions, releases and repos
- Create and close issues from chat
- Draft release notes from merged PRs
- Check CI status and triage failures
You: "Draft release notes for quoxflow v2.1" VULCAN: "Release notes for quoxflow v2.1: ## What's new - Retry logic for webhook delivery (#91) - Rate limiting on workflow triggers (#88) - QuoxFlow SDK TypeScript types (#85) ## Bug fixes - Fix timeout on large DAG execution (#87) - Correct cron parsing for DST (#82) ## Contributors adam (5 commits), arun (3 commits) Based on 8 merged PRs since v2.0.0."
Credentials
Tokens never reach the browser.
Map GitHub organisations to Quox organisations. Each org gets its own encrypted PAT stored in QuoxVault. No browser tokens, no localStorage secrets. The server-side proxy routes all GitHub API calls through QuoxCORE, so credentials never leave the backend.
Multi-org support means teams working across several GitHub organisations can switch scope without reconfiguring, and scope filtering ensures each team only sees the repos they should.
Where that boundary actually sits: QuoxVault encrypts every stored PAT at rest, and the encryption key is derived once per instance rather than once per organisation. Separation between organisations is therefore an application-layer check on the route, not a cryptographic one, and anyone holding the instance master key and database can unwrap any organisation’s stored token.
Read this as “tokens are off the browser and encrypted on the server”, which is true, rather than as a per-tenant key boundary, which is not shipped.
- GitHub org to Quox org mapping
- Encrypted-at-rest credential storage in QuoxVault (one instance-wide key, not per-org)
- Multi-org support with scope filtering
- Token expiry detection warns before credentials stop working
GITHUB ORG QUOX ORG REPOS SCOPE ────────────────────────────────────────────────── quoxai Quox LTD 12 full acme-corp Acme Engineering 8 read-only internal-tools Quox LTD 3 full Vault: 3 PATs stored (encrypted, server-side only) Last rotated: 12 days ago Expiry warning: acme-corp PAT expires in 18 days
Feedback pipeline
Feedback becomes issues.
When users submit feedback through your website forms, the plugin creates a GitHub issue in the appropriate repository. The issue includes the user's message, page URL and session context. Email addresses are redacted automatically for public repositories.
- Website feedback forms create GitHub issues automatically
- 24-hour dedup window prevents duplicate submissions
- Email redaction for public repositories
- Source labels applied automatically (user-feedback, bug-report)
- Close-the-loop notifications when issues resolve
FORM SUBMIT > DEDUP CHECK > ISSUE CREATED > RESOLVED 1. User submits: "Dashboard charts don't load on Safari" 2. Dedup: no match in 24h window, proceed 3. Issue created: quox-dashboard #418 Labels: bug, browser-compat, user-feedback Context: Safari 17.4, macOS 15.1 Email: [redacted, public repo] 4. Developer fixes, closes #418 5. Notification sent to submitter
Capabilities
The full operations suite.
Twelve capabilities in one plugin. Everything below ships with the single $29 licence.
Issue board
Cross-repo issue list with filtering by repo, label, status and assignee.
PR view
Open pull requests across all repos with review status, CI results and merge readiness.
VULCAN agent
AI-powered GitHub agent with 13 MCP tools. Natural language queries, issue ops, release notes.
Release management
Governed releases with auto-generated changelogs and approval gates.
Deploy checklist
Pre-release checklist with CI pass gates, review requirements and sign-off.
Auto-generated notes
Release notes built from merged PRs and closed issues. One click.
Feedback pipeline
Website forms to GitHub issues with 24h dedup and email redaction.
Policy gates
Enforce branch protection, required reviews and CI checks across repos.
VOLT logging
Every destructive action logged with cryptographic receipts.
Org mapping
Map GitHub orgs to Quox orgs with scope filtering and multi-org support.
Changelog page
Auto-generated changelog from merged PRs, rendered in the dashboard.
Token expiry detection
Monitors PAT expiry and warns before credentials stop working.
How it installs
Three steps, no redeploy.
GitHub Operations is an installable plugin. It unlocks with a licence key inside a running QuoxCORE instance, so there is nothing to rebuild and nothing to redeploy.
Buy it in the store
Add it from the marketplace
Open the marketplace inside your QuoxCORE install, choose GitHub Operations, and enter the licence key. The plugin appears in your dashboard straight away.
Point it at your organisation
repo and read:org scopes, your organisation name, and a sync interval (15 minutes by default). The PAT is stored encrypted in QuoxVault.Requires QuoxCORE 1.0.0 or later and a GitHub account with repo and read:org scopes. Works with a fresh install or one already running.
Pricing
One price. One time.
Every capability on this page is included in the single licence. Pay once and the plugin is yours.
- All 12 capabilities, including the VULCAN agent
- Multi-org support with server-side encrypted PAT storage
- Governed releases with VOLT audit trails
- Licence key delivered with your order
Governed by design
Scoped, logged, witnessed.
This is not a raw API wrapper. Every action VULCAN or the panel takes runs through QuoxCORE's governance stack, the same one that governs every other agent on the platform.
- Scoped. Actions are limited to the repos in your org mapping. Read-only scopes stay read-only.
- Logged. Destructive actions (issue create, issue close, release create) each produce a VOLT receipt with a cryptographic hash.
- Witnessed. Receipts are witnessed on the WARD chain, so the record is tamper-evident after the fact.
- Gated. Publishing a release requires approval, and policy gates check CI, reviews and blockers before anything ships.
- Stoppable. A kill switch disables the plugin instantly if you ever need it to stand down.
VOLT RECEIPT · github.release.create ────────────────────────────────────── Action: release.create Target: quoxflow v2.1.0 Actor: [email protected] Timestamp: 2026-03-18T14:32:01Z Approval: required (1 of 1 received) Hash: sha256:a3f8c1... Status: COMMITTED Policy gates: 3/3 passed ✓ CI pipeline green ✓ 1 review approval ✓ No open blockers
Keep browsing