kardboard: a kanban board that summons coding agents
Write a card, and about a minute later a coding agent clones the repo, does the work, and opens a pull request. My job is mostly reviewing now.
published
length3 min read
At some point I had a dozen coding agent threads open across a few projects, and I'd lost track of what each project still needed. Every thread had one task in it, but there was nowhere I could see the whole project at once. I was basically doing project management by scrolling back through chats.
I built kardboard to get out of that. It's a kanban board with six columns and one twist: about a minute after you create, edit, comment on, or move a card, an agent starts working on it.
What happens when you save a card
A card has a Markdown description, comments, and eventually a pull request link and a preview URL. When you save one, kardboard waits a minute (so a quick second edit doesn't kick off a second session), then spins up a throwaway container. The container clones the repo onto a branch named after the card, then starts Claude Code or Codex with a workflow prompt and an MCP server. That MCP server lets the agent read every card, comment, and attachment on the board, and comment on, move, or create cards of its own.
The agent reads the request, does the work, runs the repo's acceptance command, pushes, and opens a pull request. Then it leaves one comment on the card and moves it to Review. If the request wasn't clear, it moves the card to Blocked and asks a question instead. That part turned out to be the most useful thing about it. A bad card gets a question back within a minute, before anyone spends twenty minutes on the wrong pull request.
When I hit Approve, kardboard squash-merges the PR, deletes the branch, and moves the card to Done. The agent also has a name and an avatar (Milo, by default). I thought that was a gimmick until I had more than one person on a board and needed to see at a glance who did what.
Guardrails
Agents can push branches, but they can never merge. Merging goes through a second GitHub app that only kardboard has, so even if a session goes completely off the rails, the worst it can do is open a pull request that a person still has to approve.
Approvals are tied to the exact commit the reviewer looked at. If anything gets pushed to the branch after you approve, the approval is thrown out and the card waits for you again.
The agent container never gets my provider credentials. An egress proxy adds the API key to requests on the way out. That gave me a bonus I didn't plan for: when my Claude subscription hits its usage limit, the proxy sees the rejection and the card gets picked back up on Codex. So the board keeps moving while I'm asleep.
Every session also has a CPU and memory limit, a time limit, and a repo token that expires after an hour.
Previews and bigger requests
With preview mode on, kardboard builds the branch's Dockerfile and hosts it at the card's own hostname. So if a card is about a form in the footer, it comes back with a link where you can actually go click on that form. Only board members can open it, and it gets torn down once the card hits Done.
If a request is too big for one pull request, it gets split into child cards. Each child starts its own session as soon as it's created, and the parent waits in Blocked. Once the children are done, the parent wakes back up and gets told which ones were merged and which were closed without changes.
What's different now
I still describe work in plain English, same as I used to write prompts. The difference shows up months later. If I want to know why a feature was built a certain way, or what it cost, I just open the card. The description, the questions, the pull request, and the full session transcript are all still there. With a chat thread, that would all be gone.
It's live at kardboard.cc, invite-only. kardboard itself is managed on a kardboard board, and some of its pull requests come from Milo.