Your whole product, in one Project.
Canopy is a development pane for teams that ship across many repositories. Group them into a Project, run agents through Workflows you define, and set budgets, access and models for everyone from one place.
Every repo a product needs, with its work items, connections, checks and people.
checkout
Shared with Payments · 6 people
| Repo | Branch | Working tree | Checks |
|---|---|---|---|
| api Go | pay-412 | 7 changed | passing |
| web TypeScript | pay-412 | 4 changed | running |
| mobile Kotlin | main | clean | passing |
| infra Terraform | main | clean | passing |
Work items
- PAY-412Let customers save cards at checkout Run active
- PAY-415Show card brand icons in order historyStart Run
- PAY-409Retry failed refund webhooksStart Run
- #1288Checkout button jumps on slow networksStart Run
Let customers save cards at checkout
- Set up Project0:414 repos ready · checks detected
- Plan2:10Approved by you
- Edit api, web6:52implementer · 11 files · +318 −24editapi/internal/cards/vault.go+88 −3editapi/internal/orders/checkout.go+41 −12editweb/src/checkout/SavedCards.tsx+121rungo build ./...ok› Passing saved card IDs through the order API▍
- Run checksgo test ./... · pnpm test · pnpm lint
- Review Change Set1 approval per repo
- Mergeapi, then web
Let customers save cards at checkout
Revisions
- rev 3Stop logging card tokens, add logger testimplementer · 14m
- rev 2Store tokenized card IDs per customerimplementer · 1h
- rev 1Saved cards table, API and checkout UIimplementer · 2h
Don't log the token, even at debug. Logs ship to a third party.
Removed the log line and added a test that fails if a token reaches the logger.
Think in Projects, not repositories.
A Project holds the repos one product needs, whether that's one or twenty, and a repo can belong to as many Projects as use it. Open a Project and every repo is there, so a change across them is one change.
Acme · 3 Projects6 repos
payments
Go
mobile
Kotlin
api
Go
in 2 Projects
web
TypeScript
in 2 Projects
cms
PHP
docs
MDX
Working in Checkout
Explorer · 4 repos
- paymentsmain
- mobilepay-412-save-cards4 M
- apipay-412-save-cards9 M
- webpay-412-save-cards8 M
Save cards at checkout
- api9 files+212 −18
- web8 files+148 −6
- mobile4 files+64 −2
Working in Storefront
Explorer · 3 repos
- apishop-77-stock-levels4 M
- webshop-77-stock-levels6 M
- cmsshop-77-stock-levels3 M
Show stock levels on product pages
- cms3 files+41 −5
- api4 files+86 −12
- web6 files+97 −31
Working in Docs
Explorer · 1 repo
- docsdoc-31-saved-cards2 M
Document saved cards
- docs2 files+54 −3
Workflows that do exactly what you wrote.
Every Run follows a Workflow your team owns, from the first step to the merge.
- You write the steps. Agents only do the steps you give them, with the repos, tools and models you allow.
- Your checks decide. A confident wrong answer stops at the gate.
- People sign off. Put an approval wherever you want one.
Run steps in parallel, loop back when something fails and stop for a person wherever you want. Each step picks its own runtime.
1name: Implement ticket2on: work_item.assigned3budget: { usd: 8.00, minutes: 45 }4defaults:5 model: gateway/default # every AI call goes through Gateway6 7steps:8 - id: plan9 agent: planner10 runtime: claude-code11 mode: plan # reads code, can't change it12 - id: approve-plan13 human: approve14 on_reject: plan15 16 - id: build17 agent: implementer18 parallel: # one branch per repo19 - repo: api20 runtime: claude-code21 - repo: web22 runtime: codex23 - repo: mobile24 runtime: opencode25 26 - id: checks27 run: project.checks # your tests decide, not the model28 gate: true29 on_fail: retry(build, 2)30 31 - id: review32 agent: reviewer33 runtime: codex34 on_findings: build35 36 - id: approve-prs37 human: approve # nothing merges without a yes38 39 - id: merge40 action: github.merge41 order: [api, web, mobile]42 - id: close43 action: jira.transition44 to: Done› Plan PAY-412: let customers save cards at checkout
● Read Project context · 3 repos, 2 notes
● Read api/internal/cards/store.go
● Read web/src/checkout/PaymentForm.tsx
● Read mobile/checkout/CardSheet.kt
✕ Write to store.go denied: plan mode is read only
✓ Plan ready
- 1 api: store tokenized card IDs per customer
- 2 web: “Save this card” in the payment form
- 3 mobile: saved cards in the card sheet
Plan approved by Maya
~cards/store.go+48 −3
~cards/handler.go+31
?Cards for guests too?
↳Maya: signed-in only
+store_test.go+64
●go test ./cardsok
✓Done · 3 files
●Read api handler.go
~PaymentForm.tsx+52 −6
+SavedCards.tsx+71
~api/client.ts+12
●pnpm test checkoutok
✓Done · 3 files
~CardSheet.kt+40 −2
+SavedCardRow.kt+24
●./gradlew testok
✓Done · 2 files
✕ web · PaymentForm › pre-selects the saved card
Retry 1 of 2 · Codex is fixing web
↻ Retry 1 of 2 · Codex fixed PaymentForm.tsx +4 −1
Gate passed: every repo’s checks are green
› Review PAY-412 at revision 2 · 3 pull requests
● api no findings
● web 1 note: rename savedCardId
● mobile no findings
✓ No blocking findings. Approval stays with a person.
Waiting for approval · revision 2
Approve 3 pull requests for PAY-412?
- api#482+143 −3 checks
- web#1290+135 −6 checks
- mobile#233+64 −2 checks
$1.84 of $8.00 spent · 14 min · nothing merges without this
Run complete · 16 min · $1.84 of $8.00
Every AI call goes through one gateway.
Agents and editor chat reach model providers through Canopy Gateway. Your organization holds the keys, sets the limits and picks the models.
planner
Agent step in a Run
implementer
Agent step in a Run
Editor chat
Ask and edit in the pane
Canopy Gateway
- Keys held by your organization
- Spend limits on every call
- Approved models only
- Every call logged
- Anthropic
- OpenAI
- Google
- Self-hosted
Every rule, budget and connection, in one pane.
Set rules for the whole organization, a team or a single Project. Mandatory ones hold all the way down, and every Run, agent and AI call checks them before it acts.
See every rule that applies to a Project, where it was set, and whether a team or Project may change it.
Policy
Effective for Checkout| Rule | Value | Set by | Type |
|---|---|---|---|
| Approval before merge | A person, every time | Org Acme | Mandatory |
| Agents push to protected branches | Never | Org Acme | Mandatory |
| Models | 4 approved in Gateway | Org Acme | Mandatory |
| Independent review | api and payments | Team Payments | Mandatory |
| Run budget cap | $5$10 | Team Payments | Default |
| Network in Runs | npm and Go proxy only | Project Checkout | Default |
| Default runtime | Claude Code | Project Checkout | Default |
Nothing below can weaken a mandatory rule: not a team, Project, Agent, step or approval.
Tighten a rule and running work picks it up before its next protected step.
Checkout
Project · owned by PaymentsRepos
| Repo | People | Agents |
|---|---|---|
| api | Payments write · Mobile read | Write in Runs |
| web | Payments, Web write | Write in Runs |
| mobile | Mobile write | Write in Runs |
| payments | Payments write | Read only |
People without access to a repo see the Project's status, never its code.
Run defaults
- Workflow
- implement-ticket v12
- Runtime
- Claude Code
- Model
- gateway/default
- Run budget
- $5
- MCP servers
- Sentry, Postgres staging
- Work items
- Jira · PAY
A Run pins these when it starts. Later edits apply to the next one.
Budgets
October · metered at the Gateway- Acme $2,000 / mo
- Payments $800
- Checkout $400
- Each Run $5
| Scope | This month | At the limit |
|---|---|---|
Acme Organization | $1,284 / $2,000 | Pause new Runs |
Payments Team | $512 / $800 | Pause new Runs |
Checkout Project | $318 / $400 | Ask the owner |
Mobile Team | $298 / $600 | Notify |
Run #152 paused at its $5.00 cap
Sam asked for $3 more to finish “Retry checks”. Approving is recorded and grants nothing else.
Gateway
Models, keys and every AI callApproved models
- ClaudeAnthropicDefault
- GPTOpenAI
- GeminiGoogleMobile only
- LlamaSelf-hosted
- 7 moreNot approved
Organization keys
Anthropic
Use: All teams · Manage: Platform
OpenAI
Use: Payments, Web · Manage: Platform
Self-hosted
Use: All teams · Manage: Platform
Agents and laptops never see a key.
Recent calls
| 14:02 | planner · Run #148 | Maya | Claude | $0.09 | Payments |
| 14:03 | implementer · Run #148 | Maya | GPT | $0.31 | Payments |
| 14:05 | Editor chat | Sam | Claude | $0.02 | Mobile |
| 14:06 | reviewer · Run #151 | Priya | GPT | $0.12 | Web |
MCP servers
What agents can call, tool by tool- get_issueAllowAsk a personOff
- search_eventsAllowAsk a personOff
- resolve_issueAllowAsk a personOff
- delete_projectAllowAsk a personOff
A Run only reaches the servers its Project binds. Two servers can share a tool name without crossing over.
Review rules
For Change Sets in every Project| Repo | Approvals | From | Self-approve |
|---|---|---|---|
| payments | 2, one from Security | Payments, Security | |
| api | 1 independent | Payments | |
| web | 1 | Web | |
| docs | 1 | Anyone in the Project |
- Agents can review, never approve
- A new revision clears earlier approvals
- Show status to people without repo access
PAY-412Waiting on 1 review
- apiSam at rev 2
- webNeeds 1 from Web
- mobilePriya at rev 2
Shared Workflows
Acme libraryimplement-ticket v13 adds a security scan after the checks
4 of 9 Projects have adopted it. Checkout stays on v12 until its maintainers do, and running work keeps its version.
- id: checks+ - id: security-scan+ run: semgrep --config acme - id: review| Workflow | Used by | Owner |
|---|---|---|
| implement-ticketv12Update | 9 Projects | Platform |
| plan-a-changev4 | 14 Projects | Platform |
| run-checksv7 | 17 Projects | Platform |
| investigate-bugv3 | 6 Projects | Platform |
| review-changesv5 | 11 Projects | Platform |
| release-trainv2 | 3 Projects | Mobile |
Everything a change needs, in the same pane.
Work items
Jira and GitHub Issues, in the Project they belong to.
Agents
Define one once and reuse it across Workflows.
Change Sets
One reviewable change across every repo it touches.
Review
Threads and approvals tied to the revision you read.
Delivery
Pull requests, GitHub Actions and merges in order.
History
Work offline, sync later, keep the record.
Desktop and browser. Same Project.
Desktop
Built on Code OSS for macOS and Windows. Runs execute on your machine, with only the commands you allow.
Browser
Follow Projects and Runs, make decisions and manage controls from anywhere.
Questions, answered.
What is Canopy?
A development pane for teams whose product lives in more than one repository. Projects group those repos, Workflows run agents under your rules, and admins manage budgets, access and models from one place.
How is a Project different from a monorepo?
Nothing moves. Each repo keeps its own history, CI and permissions. The Project sits on top and coordinates work across them.
How do Workflows keep agents on track?
An agent only works inside a step you wrote, with the access you allowed. Your own checks decide whether its work passes, and an approval step can stop anything before it ships.
What is Canopy Gateway?
The route every AI call in Canopy takes to a model provider, from agent steps to editor chat. Your organization holds the keys, sets spend limits and chooses which models are allowed.
When can I use it, and what does it cost?
Canopy is in development. Join the waitlist for early access. We will publish pricing before launch.
Bring your repos under one canopy.
Canopy is in development. Join the waitlist for early access to the desktop app, the browser workspace and Canopy Gateway.
We only use your email to tell you about early access. Privacy policy