Codex

Fit

Codex is a strong current fit for SecureMCP-Lite.

OpenAI documents MCP support for Codex in the CLI and IDE extension, with shared configuration.

Recommended setup

Configure a local MCP server entry whose command is the SecureMCP-Lite wrapper.

Wrapper command:

npx securemcp-lite start \
  --target "npx -y @modelcontextprotocol/server-filesystem ." \
  --target-cwd /absolute/path/to/project \
  --config /absolute/path/to/project/secure-mcp.yml

If your Codex UI wants split command and args, use:

{
  "command": "npx",
  "args": [
    "securemcp-lite",
    "start",
    "--target",
    "npx -y @modelcontextprotocol/server-filesystem .",
    "--target-cwd",
    "/absolute/path/to/project",
    "--config",
    "/absolute/path/to/project/secure-mcp.yml"
  ]
}

Rollout steps

1. create a read-only secure-mcp.yml
2. register SecureMCP-Lite as the MCP command Codex launches
3. verify one safe call and one blocked call

What to test first

Ask Codex to:

• list available MCP tools
• read a source file from the current repo
• try an out-of-scope path or non-allowlisted tool

Recommended first rollout

• start with read-only filesystem tools
• verify read_file works inside the repo
• verify out-of-scope paths are blocked
• keep includeArguments off if logs could contain sensitive input

Documentation sources

• OpenAI MCP docs: https://developers.openai.com/learn/docs-mcpExternal
• OpenAI Docs MCP page with Codex examples: https://platform.openai.com/docs/docs-mcpExternal