Codex for Joomla 6

A Codex workspace for planning, building, reviewing, and modernizing Joomla 6 extensions. It packages durable repository instructions, reusable Joomla skills, specialized review agents, and optional MCP integrations.

Highlights

• Joomla 6 native MVC, PSR-4, and dependency-injection guidance
• PHP 8.3/8.4 and strict typing
• Security workflows for CSRF, XSS, SQL injection, ACL, uploads, and input validation
• Bootstrap 5 and vanilla ES2020+ frontend guidance
• Specialized planning, standards, security, quality, performance, and lint agents
• A read-only multi-agent Joomla review workflow

Repository structure

.
├── AGENTS.md                 # Durable Joomla 6 rules for Codex
├── .codex/
│   ├── config.toml           # Agent registry and optional MCP servers
│   └── agents/               # Specialized Codex agent profiles
└── .agents/
    └── skills/               # Reusable Joomla 6 and Bootstrap skills

Getting started

1. Clone the repository and open its root as a trusted workspace in Codex.
2. Start a new Codex task so the workspace configuration and skills are discovered.
3. Ask Codex to plan, build, migrate, or review a Joomla 6 extension.

Example prompts:

Create an architecture plan for a Joomla 6 component named com_example.

Review the changed extension files using $joomla6-review.

Migrate this legacy Joomla component to native Joomla 6 MVC without FOF or jQuery.

Skills

• joomla6-general-concepts
• joomla6-extensions
• joomla6-security
• joomla6-component-architect
• joomla6-code-reviewer
• joomla6-review
• joomla6-version-bump
• pr-summary
• bootstrap5

Codex loads the relevant SKILL.md when a task matches its description. AGENTS.md requires the core Joomla skills to be consulted before Joomla code is changed.

Specialized agents

The profiles under .codex/agents/ cover architecture, orchestration, administrator/site/API implementation, plugins, modules, CLI commands, packaging, testing, debugging, language management, comprehensive review, security, Joomla standards, PHP, JavaScript, comments, performance, and linting. They are registered in .codex/config.toml and can be delegated to by Codex when parallel work is appropriate.

Upstream inspiration

The specialist coverage was expanded after reviewing Irata/claudeCode. Because that repository had no license at the reviewed revision, this project uses clean-room Codex/Joomla 6 implementations rather than copied content. See docs/UPSTREAM-INSPIRATION.md.

MCP configuration

The project declares optional MCP servers for a read-only MySQL connection, Context7, sequential thinking, and text humanization.

The MySQL server is disabled by default. Before enabling it:

1. Edit .codex/config.toml locally.
2. Replace every CHANGE_ME value.
3. Set enabled = true only after confirming the account is read-only.
4. Never commit real database credentials.

Project MCP servers use npx; review the packages and your organization policy before enabling them.

Core guarantees

• Joomla 6 APIs only
• no Joomla core modifications
• no legacy J* classes or FOF
• no jQuery
• prepared and bound database queries
• CSRF and ACL checks on state-changing actions
• escaped output and filtered input
• Web Asset Manager for CSS and JavaScript

See AGENTS.md for the complete policy.

Contributing

See CONTRIBUTING.md. Security issues should follow SECURITY.md.

Licensing

No repository-wide license has been selected yet. Before accepting third-party contributions or distributing modified copies, the repository owner should add an appropriate license and verify the licensing and attribution requirements of bundled reference material, including Bootstrap and Joomla documentation.