Codex connection guide

The Codex CLI connects to AgenticMailCenter as a remote MCP server. These steps were last checked with Codex CLI 0.166.0-alpha.6 on November 4, 2026. Check the Codex MCP documentation if your version behaves differently.

Set AGENT_API_KEY in the environment you launch Codex from. Codex reads the key from that variable and does not save it. Add the server, substituting your deployment origin:

codex mcp add agenticmailcenter --url https://YOUR_AGENTICMAILCENTER_ORIGIN/mcp --bearer-token-env-var AGENT_API_KEY

That command writes this entry to ~/.codex/config.toml, which you can also add by hand. Do not add type = "http": it is not a Codex field, and --strict-config rejects it.

[mcp_servers.agenticmailcenter]
url = "https://YOUR_AGENTICMAILCENTER_ORIGIN/mcp"
bearer_token_env_var = "AGENT_API_KEY"

Codex asks for approval before these tool calls. When it cannot ask, such as codex exec with approval_policy = "never", the call fails with MCP tool call requires approval. To run read tools unattended, approve them one at a time and leave draft and send tools prompting:

[mcp_servers.agenticmailcenter.tools.list_accounts]
approval_mode = "approve"

Start with a read-scoped key and use tool discovery to confirm the runtime catalog. Draft creation and sending require the corresponding scopes. send_with_policy requires approval and passing policy checks; the separately gated send_direct mode can send before review when enabled by the server.

Verification is non-production and read-only: connect to a test tenant, ask Codex to call list_accounts, then revoke the short-lived key. codex mcp list confirms the entry is saved but does not contact the server. Do not send outbound email or use Production credentials during setup verification.