Configure the server on the correct host
Current Codex documentation supports local STDIO servers and Streamable HTTP. Desktop, CLI and IDE share the corresponding configuration on the same Codex host. This does not imply automatic availability in arbitrary cloud or web environments. Record the server address or command, owner and required tools. Keep secrets outside versioned configuration files.
Understand remote permissions beyond local file boundaries
A ticketing-system tool can modify remote data without writing a local file. Assess its connected identity, service permissions and required action approval separately. The local command sandbox is not complete protection for that operation. Test an allowed read and an unauthorised remote change using suitable test data.
Accept connection and operation
An initial example reads an approved test ticket’s status. A second uses a ticket outside the permitted scope. Also check expired sign-in, revocation and error reporting. A successful tool call is insufficient if the server exposes more data than needed. Add write tools after a separate test of their effects.
Decision matrix
| Decision point | Proceed when | Stop when |
|---|---|---|
| Access and data path | Documented: tool scope, authentication, network, schema, approval and logging. | Scope, data or accountability remains unresolved. |
| Connection under test | A permitted tool call and a deliberately disallowed attempt demonstrate the intended scope. Documentation links authentication, network access and approval to the actual call. | There is only an unevaluated demo without acceptance evidence. |
| External effect | Owner, approval, fallback and next review date are defined. | The local command sandbox does not automatically constrain all effects of a remote MCP service. Missing service restrictions or action controls require separate remediation. |
Keep it verifiable
Primary sources
- OpenAI: Model Context ProtocolSource checked:
- OpenAI: Agent approvals and securitySource checked:
- Model Context Protocol: Authorization 2026-07-28Source checked:
