diff --git a/.gitignore b/.gitignore
index fe166502f..7f7861ef8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,4 +1,5 @@
 node_modules/
+.pnpm-store/
 dist/
 __pycache__/
 .pytest_cache/
diff --git a/.ona/automations.yml b/.ona/automations.yml
index a9355768d..45ded8b40 100644
--- a/.ona/automations.yml
+++ b/.ona/automations.yml
@@ -12,10 +12,26 @@ tasks:
       pnpm --dir sdk/typescript install --frozen-lockfile
       npm ci --prefix plugins/codex-security/mcp-app --no-audit --no-fund
       python -m pip install --disable-pip-version-check --no-input -e 'plugins/codex-security[test]'
+      docker compose build codex-security findings
     triggeredBy:
       - manual
       - prebuild
 
+  compose-up:
+    name: Compose up
+    command: docker compose up --detach --no-build && ona environment port open 3000 --name findings --admission creator_only
+    dependsOn:
+      - install
+    triggeredBy:
+      - manual
+      - postDevcontainerStart
+
+  compose-down:
+    name: Compose down
+    command: docker compose down
+    triggeredBy:
+      - manual
+
   build:
     name: Build
     command: pnpm --dir sdk/typescript run build
diff --git a/compose.yaml b/compose.yaml
index d69aa3535..d10e23122 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -1,9 +1,12 @@
 services:
   codex-security:
     image: ${CODEX_SECURITY_IMAGE:-codex-security:local}
+    profiles:
+      - scan
     build:
       context: .
     init: true
+    network_mode: host
     user: ${CODEX_SECURITY_USER:-10001:10001}
     cap_drop:
       - ALL
@@ -38,3 +41,19 @@ services:
       - /input/repositories.csv
       - --output-dir
       - /output
+
+  findings:
+    image: ${CODEX_SECURITY_FINDINGS_IMAGE:-codex-security-findings:local}
+    build:
+      context: .
+      target: findings-service
+    init: true
+    network_mode: host
+    environment:
+      OPENAI_API_KEY:
+      CODEX_API_KEY:
+    volumes:
+      - findings-state:/state
+
+volumes:
+  findings-state: