Skip to main content
Codex starts as a local MCP process. The Codex desktop app, CLI, and IDE extension share the same MCP configuration. Read MCP setup first to choose the right identity and keep its sensitive configuration outside your project.

​
Add to one project

For a project you trust, create .codex/config.toml and add the local server command:
Use your user config.toml when you want the integration in all of your projects. Add the selected human or Service Account identity through Codex’s local secure configuration, following MCP setup. Do not mix the two identity modes. You can also add a local server in the Codex desktop app through Settings > MCP Servers. Choose STDIO and enter the same command and arguments.

​
Verify the connection

In a Codex chat, send this request:
Codex should call the safe status tool. If you use a Service Account, ask it to list metadata from one assigned project instead of asking for accounts.

​
Use it safely

Keep the configuration in a trusted project. State the account, project, and resource you intend to use. Ask for a read before any write, and review the proposed operation before approving it. Never include a token, passphrase, provider key, or decrypted value in chat.

​
Troubleshoot or remove it

Open the MCP server list in Codex to confirm that is enabled. If it cannot start, verify Node.js and the local secure configuration. A 403 response means the selected identity lacks permission; changing an ID cannot grant it. Delete the airctrl entry from the relevant config.toml, or remove the server in Settings > MCP Servers. See the Codex MCP documentation for client-specific options.