Your tracker. Your repository. Your keys.

Kandryn stores every credential against your user record, tests it before it is saved, and tells you plainly what each one can reach.

Tracker — pick one

Jira

Syncs the epic→story→task hierarchy into a board, resolves parents in two passes, and writes new items and test cases back when you ask it to.

JIRA_DOMAIN · JIRA_EMAIL · JIRA_API_TOKEN

Uses the enhanced JQL search endpoint; your domain is normalised for you.

Azure DevOps

The same sync against Azure Boards, with Feature mapped onto epic so the hierarchy lines up with Jira projects.

AZURE_DEVOPS_ORG · AZURE_DEVOPS_PROJECT · AZURE_DEVOPS_PAT

Work-item creation and test-case push both supported.

Repository — pick one

GitHub

Branch, commit and pull request. Stack detection reads the repository on connect, and the test-script commit stacks onto the existing PR rather than overwriting it.

GITHUB_TOKEN (PAT) or the OAuth token from sign-in

The primary provider, and the one we test first on every release.

Azure Repos

Commits and pull requests against an existing file tree, for teams whose code lives beside their boards.

AZURE_REPOS_ORG · AZURE_REPOS_TOKEN

Edits to existing files are reliable; brand-new file adds can fail. To use the security gate here, the token also needs permission to post pull request statuses — Code alone is not enough.

Documentation — optional

Confluence

A destination for generated runbooks. Without it, a runbook is still written and can be committed to the pull request branch as Markdown.

CONFLUENCE_DOMAIN · CONFLUENCE_EMAIL · CONFLUENCE_API_TOKEN · CONFLUENCE_SPACE_KEY

Nothing is published to Confluence unless you choose it as the target.

Notion

The same, against a Notion parent page. Also optional, and also never written to unless you pick it.

NOTION_API_TOKEN · NOTION_PARENT_PAGE

Markdown to the pull request branch needs no credentials at all.

The agents run on your keys

Kandryn does not resell model capacity. Every call is made with a key you saved, so usage appears on your own account and the provider terms that apply are the ones you already agreed to.

AnthropicRequired

Change planning, generation, ranking, review, security scanning and runbooks. Without it, every agent except Fovea refuses to run.

OpenAIRequired for the second opinion

The second generation agent. Without it a run still completes, but with one suggestion instead of two competing ones.

What each provider supports

Capability	Jira	Azure DevOps	GitHub	Azure Repos
Read hierarchy	Yes	Yes	—	—
Create work items	Yes	Yes	—	—
Push test cases	Yes	Yes	—	—
Status write-back	On close	On close	—	—
Branch and commit	—	—	Yes	Existing files
Open pull request	—	—	Yes	Yes
Stack detection	—	—	Yes	Yes
Security gate (stop gate)	—	—	Yes	Yes
Runbook push	—	—	Markdown to PR	Markdown to PR

Security gate: Aegis posts the kandryn/security check on both providers, and it blocks a merge only once you require it — a GitHub ruleset or branch protection rule, or an Azure DevOps branch policy. On Azure Repos the check attaches to the pull request, so a run with no pull request has nothing to post to. GitHub is the primary, auto-synced provider: on Azure Repos a commit edits existing files, and adding a brand-new file can fail. Runbook push to Confluence and Notion requires separate credentials in Settings.

We will connect the first one with you.

Book a walkthrough