Source checked: 2026-06-19 Official source: https://developers.openai.com/codex/mcp
Codex supports MCP servers and should be verified against current OpenAI Codex MCP docs before changing this path.
Core-specific rule: prefer the Core local bridge when a scoped connector key is available. Main history shows native Codex setup was fragile, and Core has a smoke test for the bridge path.
Recommended setup path:
- Use native remote MCP:
codex mcp add core --url https://core.gradien.ai/mcp. - Run
codex mcp login coreonly when the protected-resource metadata advertises an authorization server. - If the user wants a guided CLI walkthrough, or native setup cannot be completed safely, run
npx -y @gradien/core-agent-setup install --base-url https://core.gradien.ai --yes --harness codex. - Do not pass
--oauth-resourcefor Core. Codex already discovers the OAuth resource from protected-resource metadata; adding it explicitly can make the provider reject the request becauseresourceappears twice. - Do not pass
--scopes profile,emailfor Core. Codex should prefer the server-advertisedscopes_supported; narrowing scopes can mint a token that logs in but cannot select the Core workspace. - Tell the user that
http://127.0.0.1:<port>/callback/...after browser login is normal: Codex receives the one-time OAuth code locally while the MCP server remains remote at the Core URL. - If Codex says OAuth needs an experimental flag, or an older Codex build fails while parsing OAuth metadata, check
codex --versionand tell the user to update Codex. Do not enable experimental OAuth flags as part of normal Core setup. - If
codex mcp login coresucceeds, do not inspect.codexauth/cache files and do not try to extract tokens for manual MCP calls. Codex owns those OAuth credentials. - Current Codex CLI versions do not expose a direct
codex mcp tools/listprobe. Verify withcodex mcp get coreandcodex mcp list, then tell the user to restart Codex or open a fresh session so Core tools can load. - If a fresh Codex session still reports AuthRequired, stop broad diagnostics and run
codex mcp logout core, thencodex mcp login core, then restart or start another fresh Codex session. - If native OAuth still fails after a clean logout/login, fresh session, and current Codex version, fetch troubleshooting and consider the Core local bridge fallback.
- The local bridge remains the proven fallback once a safe authenticated workspace credential is available.
If you cannot run commands, give the user a very short handoff and explain that it is a one-time local setup.
Troubleshooting: https://gradien.ai/core/docs/troubleshooting.md
