Allow ChatGPT-hosted MCP servers to use session auth by aibrahim-oai · Pull Request #29733 · openai/codex

aibrahim-oai · 2026-06-23T21:59:16Z

Why

ChatGPT session authentication was inferred from the reserved Codex Apps server name. That couples credential routing to Codex Apps-specific behavior and prevents other MCP endpoints hosted by ChatGPT from explicitly using the current session.

The opt-in also needs a clear security boundary: an arbitrary MCP configuration must not be able to redirect ChatGPT credentials to another origin.

What changed

Add use_chatgpt_auth to HTTP MCP server configuration, defaulting to false.
Honor the setting only when the parsed server URL has the same HTTP(S) origin as the configured chatgpt_base_url; otherwise remove the capability before startup.
Resolve bearer tokens and static or environment-backed authorization headers before selecting authentication, with configured authorization taking precedence over ChatGPT session auth.
Enable the setting for the built-in Codex Apps and hosted plugin runtime endpoints while keeping Codex Apps caching and tool normalization scoped to the reserved server.
Persist the setting through MCP config rewrite paths and expose it in the generated config schema.
Load the current login state for codex mcp list so reported auth status matches runtime behavior.

Verification

Core integration coverage exercises the complete streamable HTTP MCP startup path and verifies that:

a same-origin opted-in server receives the current ChatGPT access token;
an explicitly configured authorization header takes precedence;
a different-origin server completes MCP initialization and tool listing without receiving any ChatGPT authorization header.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0f4e82fea3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f6b8e34170

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

aibrahim-oai · 2026-06-23T22:53:12Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: fcb808d555

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 86514162c1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 39e74efbd7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

aibrahim-oai · 2026-06-24T01:35:38Z

@codex review this

pakrym-oai · 2026-06-24T02:11:45Z

    env_vars: Vec<McpServerEnvVar>,
 ) -> McpServerConfig {
    McpServerConfig {
+        use_chatgpt_auth: false,


very nit: consider grouping into an enum with oauth being another auth alternative.

good idea. didn't want to cause breaking changes but maybe I can process the information after config. will look into it

Allow MCP servers to use ChatGPT auth

0f4e82f

aibrahim-oai requested a review from a team as a code owner June 23, 2026 21:59

Preserve ChatGPT auth for hosted plugin runtime

34682ff

chatgpt-codex-connector Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread codex-rs/codex-mcp/src/mcp/mod.rs

Comment thread codex-rs/config/src/mcp_types.rs Outdated

Comment thread codex-rs/codex-mcp/src/connection_manager.rs

aibrahim-oai added 2 commits June 23, 2026 15:10

Initialize ChatGPT auth in MCP test config

a65d126

Persist MCP ChatGPT auth setting

f6b8e34

chatgpt-codex-connector Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread codex-rs/codex-mcp/src/connection_manager.rs Outdated

Comment thread codex-rs/config/src/mcp_types.rs

Respect resolved MCP authorization

fcb808d

chatgpt-codex-connector Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread codex-rs/codex-mcp/src/connection_manager.rs

Comment thread codex-rs/codex-mcp/src/connection_manager.rs

Comment thread codex-rs/codex-mcp/src/mcp/auth.rs

Cover MCP ChatGPT auth startup

8651416

chatgpt-codex-connector Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread codex-rs/config/src/mcp_types.rs Outdated

Comment thread codex-rs/codex-mcp/src/connection_manager.rs

Restrict MCP ChatGPT auth to ChatGPT origin

39e74ef

chatgpt-codex-connector Bot reviewed Jun 24, 2026

View reviewed changes

Comment thread codex-rs/codex-mcp/src/mcp/mod.rs

Test MCP ChatGPT auth origin isolation

bd82ad8

Keep MCP ChatGPT auth coverage integration-only

367ff02

aibrahim-oai changed the title ~~Allow MCP servers to use ChatGPT auth~~ Allow ChatGPT-hosted MCP servers to use session auth Jun 24, 2026

pakrym-oai reviewed Jun 24, 2026

View reviewed changes

aibrahim-oai mentioned this pull request Jun 24, 2026

Represent MCP authentication with an enum #29924

Merged

aibrahim-oai merged commit 4c0706e into main Jun 25, 2026
31 checks passed

aibrahim-oai deleted the codex/configurable-chatgpt-mcp-auth branch June 25, 2026 02:21

github-actions Bot locked and limited conversation to collaborators Jun 25, 2026

Uh oh!

Conversation

aibrahim-oai commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why

What changed

Verification

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

aibrahim-oai commented Jun 23, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

aibrahim-oai commented Jun 24, 2026

Uh oh!

pakrym-oai Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

aibrahim-oai Jun 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

aibrahim-oai commented Jun 23, 2026 •

edited

Loading