Codex CLI

Add the server to OpenAI's Codex CLI in config.toml with an http_headers table, because codex mcp add cannot express an ApiKey header.

Codex CLI configures MCP servers in TOML.

~/.codex/config.toml:

[mcp_servers.vulnetix]
url = "https://mcp.vulnetix.com/mcp"
http_headers = { Authorization = "ApiKey <orgId>:<hex>" }

The sub-table form is equivalent:

[mcp_servers.vulnetix]
url = "https://mcp.vulnetix.com/mcp"

[mcp_servers.vulnetix.http_headers]
Authorization = "ApiKey <orgId>:<hex>"

The table is mcp_servers with an underscore. Every string is double-quoted, including the header value with its colon.

Check it

codex mcp get vulnetix

The output should show transport: streamable_http, the URL and http_headers: Authorization=*****. http_headers: - means the table name is wrong. Then start codex and ask:

Look up CVE-2021-44228 and summarise the remediation deadline.

Codex’s sandbox governs shell and file access, not MCP calls, but its approval policy can still prompt before a tool runs. The prompts need the shell, so they are subject to the sandbox.

Troubleshooting

Symptom	Fix
Server not found	`mcp_servers`, underscore
TOML parse error	Double-quote every string
401	`ApiKey <orgId>:<hex>`