Public client profile · MCR-20260906-CODEX

Codex

A sourced client profile for the MCP capabilities and configuration paths documented for Codex hosts.

Evidence levelDocumented

Official publisher source only

Executed pairing tests: none published

No named Codex build was paired with a controlled MCP server for this profile. No connection, authentication, tool, workflow or approval result is claimed.

Publisher
OpenAI
Version boundary
Documentation snapshot: 6 September 2026; installed product version not specified
Protocol version
Not established by cited page
Documented transport
STDIO and Streamable HTTP
Documented authentication
Bearer token, OAuth, headers, or unauthenticated where supported
Profile updated
06 September 2026

Publisher-declared surface

What OpenAI documents.

Host surfaces

The ChatGPT desktop app, Codex CLI and IDE extension support MCP servers and share configuration for the same Codex host. ChatGPT web uses hosted plugin tools instead of local Codex configuration.

Transports

STDIO servers and Streamable HTTP servers are documented. STDIO can receive configured environment variables; HTTP accepts a server URL.

Authentication

For HTTP, the documentation describes bearer tokens, OAuth—including CIMD and DCR—configured headers, and unauthenticated connections when no credential source resolves.

Tool controls

The configuration includes server enablement, required startup, tool allow/deny lists, default and per-tool approval modes, timeouts and per-tool output limits.

Documented workflow notes

Configuration is not compatibility proof.

Codex stores MCP configuration in config.toml; trusted projects can also use project-scoped configuration. OAuth login, callback behavior and credential precedence depend on the server and configuration. Each must be tested in the buyer’s actual host and identity context.

Evidence register

Sources behind this profile.

CR-01

OpenAI Codex: Model Context Protocol

official documentation · accessed 06 September 2026 · Live documentation snapshot; product version not stated

Primary source for supported transports, authentication methods, shared host configuration, tool controls and OAuth behavior.

Still unknown

What requires an executed pairing.

  • The exact Codex application, CLI or extension build under test.
  • The server implementation and MCP protocol version negotiated.
  • OAuth discovery, registration, callback and scope behavior for that server.
  • Tool discovery, approvals, argument handling, errors and output behavior.
  • The end-to-end result for the named identity, permissions and workflow.

A documented feature is not a PASS result. Those facts become test evidence only after an authorized, version-recorded run.