SpyBara
Go Premium

Documentation 2026-09-16 20:58 UTC to 2026-09-17 10:05 UTC

30 files changed +1,091 −827. View all changes and history on the product overview
2026
Wed 30 23:01 Tue 29 22:59 Sun 27 23:59 Fri 25 23:02 Thu 24 23:02 Wed 23 23:58 Tue 22 23:00 Sat 19 23:02 Fri 18 22:59 Thu 17 10:05 Wed 16 20:58 Tue 15 21:01 Mon 14 20:57 Sun 13 21:58 Fri 11 20:00 Thu 10 16:58 Wed 9 21:01 Fri 4 19:59 Thu 3 23:00 Wed 2 22:59 Tue 1 07:57
Details

8 8 

9## Fast mode9## Fast mode

10 10 

11GPT-5.5 retires from ChatGPT, ChatGPT Work, and Codex on all plans on

12October 14, 2026. The OpenAI API isn't affected. See

13[GPT-5.5 retirement](https://learn.chatgpt.com/docs/models#gpt-55-retirement) for migration guidance.

14 

11Codex offers the ability to increase the speed of the model for increased15Codex offers the ability to increase the speed of the model for increased

12credit consumption.16credit consumption.

13 17 

14Fast mode increases supported model speed by 1.5x and consumes credits at a18For GPT-5.6, GPT-5.5, and GPT-5.4, Fast mode increases model speed by 1.5x.

15higher rate than Standard mode. It currently supports GPT-5.6, GPT-5.5, and19GPT-5.6 and GPT-5.5 consume credits at 2.5x the Standard rate; GPT-5.4 consumes

16GPT-5.4. GPT-5.6 and GPT-5.5 consume credits at 2.5x the Standard rate;20credits at 2x the Standard rate.

17GPT-5.4 consumes credits at 2x the Standard rate.21 

22GPT-6 Astra Fast mode consumes credits at 2.5x the Standard rate where

23available. See [Models](https://learn.chatgpt.com/docs/models) for model availability and

24[Pricing](https://learn.chatgpt.com/docs/pricing#token-rates) for token rates.

18 25 

19Use `/fast on`, `/fast off`, or `/fast status` in the CLI to change or inspect26Use `/fast on`, `/fast off`, or `/fast status` in the CLI to change or inspect

20the current setting. You can also persist the default with `service_tier =27the current setting. You can also persist the default with `service_tier =

Details

154 154 

155<ContentModeSwitch group="codex-surface" ids="app,cli,ide">155<ContentModeSwitch group="codex-surface" ids="app,cli,ide">

156 156 

157If you don't pin a model or `model_reasoning_effort`, Codex can choose a setup157If you don't configure a subagent model or `model_reasoning_effort`, the

158that balances intelligence, speed, and price for the task. It may favor `gpt-5.6-terra` for fast scans or a higher-effort `gpt-5.6` configuration for more demanding reasoning. When you want finer control, steer that choice in your prompt or set `model` and `model_reasoning_effort` directly in the agent file.158subagent inherits the parent agent's model and reasoning effort. If an explicit

159spawn request or an `[agents]` default selects a model without an

160explicit or configured reasoning effort, the subagent uses that model's default

161reasoning effort. To balance intelligence, speed, and price for each task,

162request a specific model or reasoning effort in your prompt,

163configure `[agents]` defaults in `config.toml`, or set `model` and

164`model_reasoning_effort` directly in the custom agent file.

165For example, use `gpt-5.6-terra` for fast scans or a higher-effort `gpt-5.6` configuration for more demanding reasoning.

159 166 

160For most tasks in Codex, start with 167For most tasks in Codex, start with

161 `gpt-5.6`. Use 168 `gpt-5.6`. Use


235- Ask Codex directly to steer a running subagent, stop it, or close completed242- Ask Codex directly to steer a running subagent, stop it, or close completed

236 subagent threads.243 subagent threads.

237 244 

238<Illustration description="Codex desktop chat showing two subagents working in parallel.">

239 <SubagentWorkflowIllustration ariaLabel="Codex desktop chat showing two subagents working in parallel." />

240</Illustration>

241 245 

242<Illustration description="Codex desktop Subagents panel with no active subagents and three completed audits.">246 

243 <SubagentWorkflowIllustration247> Illustration: Codex desktop chat showing two subagents working in parallel.

244 ariaLabel="Codex desktop Subagents panel with no active subagents and three completed audits."248 

245 class="mt-4"249 

246 variant="results"250 

247 />251 

248</Illustration>252 

253> Illustration: Codex desktop Subagents panel with no active subagents and three completed audits.

254 

255 

249 256 

250</ContentModeSwitch>257</ContentModeSwitch>

251 258 


342- `developer_instructions`349- `developer_instructions`

343 350 

344If a custom agent file sets `model` or `model_reasoning_effort`, the value in351If a custom agent file sets `model` or `model_reasoning_effort`, the value in

345the file takes precedence. Otherwise, Codex resolves each setting independently:352the file takes precedence. Before applying the file, Codex resolves each setting

346an explicit spawn value, then the corresponding `[agents]` default, then the353from an explicit spawn value, then the corresponding `[agents]` default, then

347parent's value. If a spawn selects a different model and neither an explicit nor354the parent's value. If an explicit spawn request or an `[agents]` default

348configured effort is present, Codex uses that model's default effort. Other355selects a model and neither supplies a reasoning effort, Codex uses

349session settings, such as `sandbox_mode`, `mcp_servers`, and `skills.config`,356that model's default effort. A custom agent file that sets only `model`

350inherit from the parent when the custom agent file omits them.357preserves this previously resolved effort. Set `model_reasoning_effort` in the

358file too if the selected model doesn't support that effort or you want a

359different one. Other session settings, such as `sandbox_mode`, `mcp_servers`,

360and `skills.config`, inherit from the parent when the custom agent file omits

361them.

351 362 

352### Global settings363### Global settings

353 364 

automations.md +69 −22

Details

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5Schedule recurring tasks to run in the background. Review active, paused, and5Schedule recurring tasks to run in the background. On ChatGPT web and mobile,

6completed tasks and recent runs in **Scheduled**. You can combine scheduled6eligible plans can also run tasks from supported app events. Review active,

7tasks with [skills](https://learn.chatgpt.com/docs/build-skills) for more complex work.7paused, and completed tasks and recent runs in **Scheduled**. You can combine

8scheduled tasks with [skills](https://learn.chatgpt.com/docs/build-skills) for more complex work.

9 

10<ContentModeSwitch group="codex-surface" ids="app,web">

11 

12GPT-5.5 retires from ChatGPT, ChatGPT Work, and Codex on all plans on

13October 14, 2026. Review scheduled tasks that use GPT-5.5 and choose an

14available replacement before that date. For Codex with ChatGPT sign-in,

15replace `gpt-5.5` with `gpt-5.6-sol` (GPT-5.6 Sol). The OpenAI API isn't

16affected. See [GPT-5.5 retirement](https://learn.chatgpt.com/docs/models#gpt-55-retirement).

17 

18</ContentModeSwitch>

19 

20 

21 

22[Watch: Schedule tasks with ChatGPT](https://www.youtube.com/watch?v=CToxp125mhc)

8 23 

9<ContentModeSwitch group="codex-surface" id="app">24<ContentModeSwitch group="codex-surface" id="app">

10 25 


78Review the first few runs, then adjust the prompt, tools, or cadence if the93Review the first few runs, then adjust the prompt, tools, or cadence if the

79results are too broad or need additional context.94results are too broad or need additional context.

80 95 

96## Trigger tasks from app events

97 

98On eligible plans, scheduled tasks can run when a supported Gmail, Slack, or

99GitHub event occurs. Event-triggered tasks are available in ChatGPT on the web

100and mobile. They aren't available in the ChatGPT desktop app, Codex CLI, or the

101IDE extension.

102 

103Ask ChatGPT to create the task, then describe the event to watch for and what

104to do when it happens. The trigger determines when the task runs; the saved

105prompt determines what each run does. One task can use multiple event triggers,

106but it can't combine event triggers with a time-based schedule.

107 

108Supported event triggers include:

109 

110- **Gmail:** New incoming messages, optionally filtered by sender or subject.

111- **Slack:** New messages in selected channels, optionally filtered by author

112 and whether thread replies are included. Reactions, edits, deletes, and

113 direct messages aren't supported.

114- **GitHub:** Pull request activity in a repository. Filter by pull request,

115 author, title, or label, and choose whether reviews, comments, commit updates,

116 or only merges should trigger the task.

117 

118Connect and authorize the app before creating the task. For Slack, add

119`@ChatGPT` to every channel the task watches. For GitHub, the connected app

120must have access to the repository.

121 

122When several matching events arrive close together, ChatGPT may combine them

123in one run. Open **Scheduled** to review pending events or choose **Run now**

124to process them.

125 

126Availability depends on your plan and workspace settings. In managed

127workspaces, administrators can control access with the **Allow event-triggered

128scheduled tasks** permission.

129 

81</ContentModeSwitch>130</ContentModeSwitch>

82 131 

83<ContentModeSwitch group="codex-surface" id="app">132<ContentModeSwitch group="codex-surface" id="app">


104update it before those models retire on August 31, 2026. Replace `gpt-5.4` with153update it before those models retire on August 31, 2026. Replace `gpt-5.4` with

105`gpt-5.6-terra` and `gpt-5.4-mini` with `gpt-5.6-luna`.154`gpt-5.6-terra` and `gpt-5.4-mini` with `gpt-5.6-luna`.

106 155 

107<Illustration description="ChatGPT composer ready to create a scheduled task with 5.6 Sol Extended selected.">156 

108 <CodexScheduledTasksIllustration157 

109 variant="manage"158> Illustration: ChatGPT composer ready to create a scheduled task with 5.6 Sol Extended selected.

110 ariaLabel="ChatGPT composer ready to create a scheduled task with 5.6 Sol Extended selected."159 

111 />160 

112</Illustration>

113 161 

114Scheduled tasks run unattended with your default sandbox settings. Start with the162Scheduled tasks run unattended with your default sandbox settings. Start with the

115narrowest access that lets the task succeed, and grant network or broader file163narrowest access that lets the task succeed, and grant network or broader file


123The **Scheduled** view acts as your inbox. Scheduled task runs with findings171The **Scheduled** view acts as your inbox. Scheduled task runs with findings

124appear there, and an unread indicator shows when a run needs your attention.172appear there, and an unread indicator shows when a run needs your attention.

125 173 

126<Illustration description="Scheduled tasks page with All, Active, and Paused filters and three scheduled tasks.">174 

127 <CodexScheduledTasksIllustration175 

128 variant="inbox"176> Illustration: Scheduled tasks page with All, Active, and Paused filters and three scheduled tasks.

129 ariaLabel="Scheduled tasks page with All, Active, and Paused filters and three scheduled tasks."177 

130 />178 

131</Illustration>

132 179 

133Standalone scheduled tasks start a new chat for each scheduled run and report180Standalone scheduled tasks start a new chat for each scheduled run and report

134results in **Scheduled**. Use them when each run should be independent or when one181results in **Scheduled**. Use them when each run should be independent or when one


150<ContentModeSwitch group="codex-surface" ids="app,web">197<ContentModeSwitch group="codex-surface" ids="app,web">

151 198 

152Scheduled tasks created with ChatGPT Work on the web, or with ChatGPT Work or199Scheduled tasks created with ChatGPT Work on the web, or with ChatGPT Work or

153Codex in the desktop app, can use plugins. Scheduled tasks can also use200Codex in the desktop app, can use plugins. Scheduled tasks can also use skills.

154skills. To keep scheduled tasks maintainable and shareable across teams, use201To keep scheduled tasks maintainable and shareable across teams, use

155[skills](https://learn.chatgpt.com/docs/build-skills) to define the action and provide tools and context.202[skills](https://learn.chatgpt.com/docs/build-skills) to define the action and provide tools and context.

156Select or invoke a specific skill in the task prompt when the workflow shouldn't203Select or invoke a specific skill in the task prompt when the workflow shouldn't

157rely on automatic tool selection.204rely on automatic tool selection.


159## Ask ChatGPT to create or update scheduled tasks206## Ask ChatGPT to create or update scheduled tasks

160 207 

161You can create and update scheduled tasks from a ChatGPT or Codex chat.208You can create and update scheduled tasks from a ChatGPT or Codex chat.

162Describe the work, the schedule, and whether each scheduled run should return to209Describe the work, when it should run, and whether each run should return to the

163the current chat or start a new chat. ChatGPT can draft the prompt, choose the210current chat or start a new chat. ChatGPT can draft the prompt, choose the

164right destination, and update the scheduled task when its scope or cadence211right destination, and update the task when its scope or cadence

165changes.212changes.

166 213 

167For example, ask ChatGPT to schedule a follow-up from the current chat while a214For example, ask ChatGPT to schedule a follow-up from the current chat while a


185Schedule a task inside a chat for:232Schedule a task inside a chat for:

186 233 

187- checking a long-running operation until it finishes234- checking a long-running operation until it finishes

188- polling Slack, GitHub, or another connected source when the results should235- checking a connected source on a fixed cadence when you need a periodic

189 stay in the same chat236 snapshot rather than a response to one supported app event

190- reminding ChatGPT to continue a review loop at a fixed cadence237- reminding ChatGPT to continue a review loop at a fixed cadence

191- running a skill-driven workflow that uses plugins, such as checking PR status238- running a skill-driven workflow that uses plugins, such as checking PR status

192 and addressing new feedback239 and addressing new feedback

browser.md +121 −74

Details

15 15 

16Browser is available in ChatGPT on the web and in the ChatGPT desktop app.16Browser is available in ChatGPT on the web and in the ChatGPT desktop app.

17 17 

18[GPT-6 Astra](https://learn.chatgpt.com/docs/models#gpt-6-astra) improves visual judgment for tasks such

19as checking a page against a screenshot or completing a workflow across sites.

20Choose it when available in your model selector, and describe how to verify the

21finished result.

22 

23For managed desktop environments, administrators can restrict browser origins,

24uploads, downloads, and developer access. See

25[managed browser controls](https://learn.chatgpt.com/docs/enterprise/managed-configuration#control-browser-and-computer-use).

26 

18Treat page content as untrusted context. Review the site and proposed action27Treat page content as untrusted context. Review the site and proposed action

19before sharing sensitive information or allowing ChatGPT to act.28before sharing sensitive information or allowing ChatGPT to act.

20 29 


34Browser**, you can choose another download location, reset it to the system43Browser**, you can choose another download location, reset it to the system

35default, or turn on **Ask where to save downloads**.44default, or turn on **Ask where to save downloads**.

36 45 

37Use the [Chrome extension](https://learn.chatgpt.com/docs/chrome-extension) instead when ChatGPT needs46Use the [browser extension](https://learn.chatgpt.com/docs/chrome-extension) instead when ChatGPT needs

38to work in an existing Chrome tab or use your regular Chrome profile.47to work in an existing Chrome, Edge, Brave, Opera, or Vivaldi tab or use your

48regular browser profile.

39 49 

40Open the built-in browser from the toolbar, by clicking a URL, by navigating50Open the built-in browser from the toolbar, by clicking a URL, by navigating

41manually, or by pressing <kbd>Cmd</kbd>+<kbd>Shift</kbd>+<kbd>B</kbd>51manually, or by pressing <kbd>Cmd</kbd>+<kbd>Shift</kbd>+<kbd>B</kbd>

42(<kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>B</kbd> on Windows).52(<kbd>Ctrl</kbd>+<kbd>Shift</kbd>+<kbd>B</kbd> on Windows).

43 53 

44<CodexScreenshot54 

45 alt="ChatGPT desktop app showing a browser comment on a local web app preview"55

46 lightSrc="/images/codex/app/in-app-browser-light.webp"56 

47 darkSrc="/images/codex/app/in-app-browser-dark.webp"57> Illustration: ChatGPT desktop app showing a browser comment on a local web app preview

48 maxHeight="420px"58 

49 variant="no-wallpaper"59 

50/>60 

51 61 

52## Search from the address bar62## Search from the address bar

53 63 


79inspect rendered state, take screenshots, and verify the result of its work in89inspect rendered state, take screenshots, and verify the result of its work in

80the page.90the page.

81 91 

82Select ChatGPT and turn on Work in the switcher, or select Codex. Open the Plugins92Browser is included with the desktop app and installs automatically. Ask ChatGPT

83Directory and install **Browser**. Then ask ChatGPT or Codex to use the browser93or Codex to use the built-in browser in your task, or reference it directly with

84in your task, or reference it directly with `@Browser`.94`@Browser`.

85 95 

86For example:96For example:

87 97 


153 163 

154 164 

155 165 

156<CodexScreenshot166 

157 alt="ChatGPT desktop app showing built-in browser annotation style controls"167

158 lightSrc="/images/codex/app/iab-annotations-light.webp"168 

159 darkSrc="/images/codex/app/iab-annotations-dark.webp"169> Illustration: ChatGPT desktop app showing built-in browser annotation style controls

160 maxHeight="420px"170 

161/>171 

172 

162 173 

163</section>174</section>

164 175 


213 224 

214 225 

215 226 

216<CodexScreenshot227 

217 alt="ChatGPT desktop app Browser settings showing Developer mode with full CDP access enabled"228

218 lightSrc="/images/codex/app/browser-developer-mode-light.webp"229 

219 darkSrc="/images/codex/app/browser-developer-mode-dark.webp"230> Illustration: ChatGPT desktop app Browser settings showing Developer mode with full CDP access enabled

220 maxHeight="420px"231 

221/>232 

233 

222 234 

223</section>235</section>

224 236 


226 238 

227<ContentModeSwitch group="codex-surface" id="web">239<ContentModeSwitch group="codex-surface" id="web">

228 240 

229With ChatGPT Work on the web, ChatGPT can use a cloud-operated browser to241## Use ChatGPT Work to get things done across the web

230research and interact with public websites. It runs separately from the242 

231browser on your device, so you can delegate web tasks without giving ChatGPT243ChatGPT Work can complete tasks across websites, including sites where you need to sign in.

232access to your open tabs or personal browser history.244 

245Work uses its own browser, running on a separate computer in the cloud, not the browser on your phone or laptop.

246 

247Start a task from ChatGPT Work on web or mobile, and ChatGPT can continue working even if you step away and close your computer. Using its computer, Work can accomplish a wide variety of tasks on the internet by reading, clicking, and typing into web pages. Depending on your request, it may use a plugin, its browser, or both.

248 

249For example, ChatGPT can help you:

250 

251- Find and book a DMV appointment.

252- Sign in to your utility account and compare plans.

253- Find and save apartments that match your criteria.

254- Research competitors on social media.

255- Close the books in your accounting software.

256 

257You control which websites ChatGPT can access, and it is trained to ask for confirmation before consequential actions, such as completing a booking or payment. If ChatGPT is ever blocked for any reason, you can take over its computer and use it yourself on mobile and desktop.

258 

259The ability for ChatGPT Work to navigate to websites that need authentication is available on web and mobile on Plus and Pro plans.

260 

261Availability depends on rollout. Website sign-in isn't available for Enterprise or Edu workspaces.

262 

263## How ChatGPT Work's computer works

264 

265When your task requires a website, ChatGPT uses its own browser to navigate pages, gather information, and complete steps online.

266 

267By default, ChatGPT asks before accessing a new website. You can choose to approve requests individually or adjust your settings to let ChatGPT automatically approve websites relevant to your task. ChatGPT Work will always ask for confirmation before consequential actions, such as submitting your information to book an appointment or completing a payment.

268 

269## Sign in to a website

270 

271If a website requires you to sign in, ChatGPT Work will ask you to sign in. After you authenticate, it will continue working on the signed-in website. Your session will remain active for future tasks, so you do not need to sign in every time.

272 

273### Use the secure sign-in form

274 

275ChatGPT cannot see your username or password, and they are never seen by the model or used in model training. ChatGPT does not store your username or passwords. You can delete your browsing history from all sites or one site individually at any time from **Settings** > **Cloud browser** > **Browser data**, which will log you out from that site.

276 

277When ChatGPT encounters a login screen, it pauses and asks you to enter your credentials and two-factor authentication codes as needed. On iOS, you can use a supported password manager to sign in seamlessly.

278 

279Use the sign-in form provided by ChatGPT. Don't send passwords in the chat.

280 

281![ChatGPT Work on iOS pausing a DMV task and showing a secure sign-in form with the website address and a masked password.](https://developers.openai.com/images/codex/cloud-browser-auth/sign-in.webp)

282 

283### Sign in on the web page

284 

285If offered, select **Sign in on web page instead** to sign in directly in the cloud browser. The task pauses while you sign in. Select **I'm done** to return control to ChatGPT, or skip or cancel the request.

233 286 

234<a id="start-a-browser-task"></a>287<a id="start-a-browser-task"></a>

288<a id="start-browser-work"></a>

289<a id="web-start-browser-work"></a>

235 290 

236## Start browser work291## How to get started with a task in ChatGPT Work

237 292 

2381. Select **ChatGPT**, switch to **Work** in the switcher, and describe the result you want. Include relevant2931. Open ChatGPT on web or mobile and start a task in Work.

239 websites or constraints when they matter.2942. Describe what you want ChatGPT to do.

2402. If ChatGPT needs a website, review the site-access request before allowing2953. Approve website access if prompted.

241 it.2964. Sign in directly if a website requires it.

2423. Follow the browser's progress in the chat. Open **Cloud browser** to inspect2975. Follow the task's progress in the conversation.

243 the page screenshots and replay.2986. Review the result and approve any consequential actions.

2444. Review the result and any sources before using the information.

245 299 

246For example:300You don't need to select the browser separately. ChatGPT decides when to use it based on your request.

247 301 

248```text302Some websites block access. If that happens, ChatGPT will let you know and, when possible, try another way to complete the task.

249Compare the publicly listed prices and cancellation terms for these three303 

250venues. Return a table with links to each source and flag anything that needs a304<a id="website-permissions-and-confirmations"></a>

251phone call to confirm.305<a id="web-website-permissions-and-confirmations"></a>

252```

253 306 

254Other useful browser tasks include checking public inventory or appointment307## Security and user controls

255times, gathering details from an interactive site, and comparing options whose

256information is spread across several pages.

257 308 

258## Website permissions and confirmations309In ChatGPT settings, open **Cloud browser** to manage website permissions. Available options include:

259 310 

260ChatGPT asks before accessing a new website by default. The permission applies311- **Always ask**: Review every website access request manually.

261to the site shown in the request, so check the hostname before allowing it.312- **Auto approve**: Let ChatGPT automatically approve access after it checks for the relevancy of the website to your task.

313- **Always allow**: Allow website access without that additional review step. We offer this option for minimal friction, but do not recommend this option.

262 314 

263In ChatGPT settings, open **Cloud browser** to manage website permissions. You315![Cloud browser settings showing the Always ask, Auto approve, and Always allow website permission options.](https://developers.openai.com/images/codex/cloud-browser-auth/website-permissions.webp)

264can choose **Always ask**, **Auto approve**, or **Always allow**, and you can

265allow or block individual sites. **Auto approve** lets ChatGPT approve requests

266after its risk checks; **Always allow** removes that review step for website

267access. Use the least-permissive setting that works for your task.

268 316 

269A website permission doesn't approve every action. ChatGPT may ask separately317You can also allow or block individual websites to override your default permissions.

270for permission before performing consequential actions.

271 318 

272## Browser data319Before ChatGPT asks you to sign in to any website, an additional review model checks the sign-in request and where your information will be entered for signs of phishing or deception. We test the agent against risks including prompt injection, phishing, and unintended actions.

273 320 

274The cloud-operated browser keeps its cookies and browser data separate from the321For full transparency, you'll see the website's address and a preview of its sign-in form, and you can inspect the live website before continuing. Credentials entered through the secure sign-in form go directly to the browser and are not visible to the model.

275browser on your device. Clearing cloud browser data doesn't clear cookies from

276your device. To remove its cookies, open **Cloud browser** in ChatGPT settings,

277select **Browser data**, and choose **Clear all**.

278 322 

279Don't rely on open pages or browser history being available in a later chat.323<a id="browser-data"></a>

280Include the important sites and context when you start new work.324<a id="web-browser-data"></a>

325 

326## Privacy and browser data

327 

328ChatGPT Work's computer runs separately from the browser on your device. It maintains its own cookies, browser data, and signed-in sessions. Information ChatGPT uses while completing a task follows the ChatGPT data-control settings you choose. You can review these in ChatGPT web and mobile under **Settings** > **Data controls**.

329 

330It doesn't use your personal browser's open tabs, browsing history, saved passwords, cookies, extensions, or existing signed-in sessions.

331 

332To clear browser data, go to **Settings** > **Cloud browser** > **Browser data** > **Clear all**. This signs you out of websites in ChatGPT Work's browser, so you'll need to sign in again for future tasks.

333 

334![Cloud browser settings with a Browser data section and a Cookies control for managing cookies saved by the cloud browser.](https://developers.openai.com/images/codex/cloud-browser-auth/browser-data.webp)

281 335 

282## Limitations336## Limitations

283 337 

284- The browser supports public, signed-out websites. It can't sign in to an338- Website sign-in isn't available in every workspace or rollout. If a task requires a sign-in method that isn't supported, complete that step yourself or use another available tool.

285 account, ask for credentials, or use the signed-in session from your browser.339- Some sites block automated browsers or require a CAPTCHA. ChatGPT may not be able to complete a task on those sites.

286- Some sites block automated browsers or require a CAPTCHA. ChatGPT may not be340- Availability of cloud browsing can depend on your plan, workspace settings, and rollout. Cloud browsing is available in all regions on paid plans other than Free and Go. Enterprise admins must enable cloud browsing for their workspace.

287 able to complete a task on those sites.341 

288- The browser is separate from the browser on your device. It can't use your342During rollout, the browser might not appear immediately even when your plan supports it.

289 open tabs, extensions, saved passwords, or local browser history.

290- Availability can depend on your plan, workspace settings, and rollout. It is

291 available in all regions on paid plans other than Free and Go. Enterprise

292 admins must enable it for their workspace.

293 

294During rollout, the browser might not appear immediately even when your plan

295supports it.

296 343 

297</ContentModeSwitch>344</ContentModeSwitch>

build-plugins.md +32 −20

Details

22products. During development, use a local marketplace to test the package22products. During development, use a local marketplace to test the package

23before submitting it to the universal directory.23before submitting it to the universal directory.

24 24 

25For workspace distribution through GitHub, see

26[Plugin management](https://learn.chatgpt.com/docs/enterprise/plugin-management).

27 

25Start with a skill when you are still iterating on one personal workflow.28Start with a skill when you are still iterating on one personal workflow.

26Build a plugin when you want to share that workflow, package related skills,29Build a plugin when you want to share that workflow, package related skills,

27connect to an external service, or distribute a stable capability to a team.30connect to an external service, or distribute a stable capability to a team.


31For the fastest setup, use the built-in `@plugin-creator` skill in ChatGPT Work34For the fastest setup, use the built-in `@plugin-creator` skill in ChatGPT Work

32mode or `$plugin-creator` in Codex.35mode or `$plugin-creator` in Codex.

33 36 

34<CodexScreenshot37 

35 alt="Plugin creator skill in ChatGPT"38

36 lightSrc="/images/codex/plugins/plugin-creator.png"39 

37 darkSrc="/images/codex/plugins/plugin-creator-dark.png"40> Illustration: Plugin creator skill in ChatGPT

38/>41 

42 

43 

39 44 

40Describe the outcome, the skills or MCP server to include, and whether you want45Describe the outcome, the skills or MCP server to include, and whether you want

41a local marketplace entry for testing. For example:46a local marketplace entry for testing. For example:


46Add it to a personal marketplace so I can test it locally.51Add it to a personal marketplace so I can test it locally.

47```52```

48 53 

49The skill creates the required `.codex-plugin/plugin.json` manifest, organizes54The skill creates a supported `.codex-plugin/plugin.json` compatibility

50the plugin folder, and can add the plugin to a local marketplace.55manifest, organizes the plugin folder, and can add the plugin to a local

56marketplace. This scaffold differs from the portable root `plugin.json` format

57used in the manual example. See the [scaffold layout](https://developers.openai.com/plugins/build/plugins#plugin-creator-output)

58for optional files and directories.

59 

60 

61

62 

63> Illustration: Invoking the plugin creator skill

64 

65 

51 66 

52<CodexScreenshot

53 alt="Invoking the plugin creator skill"

54 lightSrc="/images/codex/plugins/plugin-creator-invoke.png"

55 darkSrc="/images/codex/plugins/plugin-creator-invoke-dark.png"

56/>

57 67 

58After it finishes:68After it finishes:

59 69 

601. Review `.codex-plugin/plugin.json`.701. Review `.codex-plugin/plugin.json`.

612. Check each bundled skill under `skills/`.712. Check each bundled skill under `skills/` against the

72 [instruction-following guidance](https://developers.openai.com/plugins/build/skills#review-instruction-following).

623. Refresh ChatGPT or Codex and install the plugin from its local marketplace733. Refresh ChatGPT or Codex and install the plugin from its local marketplace

63 source.74 source.

644. Test the plugin in a new conversation with representative requests.754. Test the plugin in a new conversation with representative requests.


70 81 

71## Create a skills-only plugin manually82## Create a skills-only plugin manually

72 83 

73A minimal plugin contains a manifest and at least one skill:84A minimal portable Agent Plugins package contains a root manifest and at least

85one skill:

74 86 

75```text87```text

76meeting-follow-up/88meeting-follow-up/

77├── .codex-plugin/89├── plugin.json

78│ └── plugin.json

79└── skills/90└── skills/

80 └── meeting-follow-up/91 └── meeting-follow-up/

81 └── SKILL.md92 └── SKILL.md

82```93```

83 94 

84Create `.codex-plugin/plugin.json`:95Create `plugin.json` at the plugin root:

85 96 

86```json97```json

87{98{

99 "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",

88 "name": "meeting-follow-up",100 "name": "meeting-follow-up",

89 "version": "1.0.0",101 "version": "1.0.0",

90 "description": "Turn meeting notes into decisions and next steps",102 "description": "Turn meeting notes into decisions and next steps"

91 "skills": "./skills/"

92}103}

93```104```

94 105 

95Then add `skills/meeting-follow-up/SKILL.md`:106Portable packages discover skills in `skills/` automatically. Add

107`skills/meeting-follow-up/SKILL.md`:

96 108 

97```md109```md

98---110---

build-skills.md +12 −12

Details

9 9 

10Skills are the authoring format for reusable workflows. Plugins distribute10Skills are the authoring format for reusable workflows. Plugins distribute

11reusable skills and connectors through the universal plugin directory shared11reusable skills and connectors through the universal plugin directory shared

12by ChatGPT and Codex. Plugins are available with ChatGPT Work on the web, with12by ChatGPT and Codex. Plugins work in Chat and Work across ChatGPT on the web,

13ChatGPT Work and Codex in the ChatGPT desktop app, and through Codex CLI. Use13desktop, and mobile, in Codex in the ChatGPT desktop app, and through Codex

14skills to design the workflow itself, then package it as a14CLI. Use skills to design the workflow itself, then package it as a

15[plugin](https://developers.openai.com/plugins/build/plugins) when you want15[plugin](https://developers.openai.com/plugins/build/plugins) when you want

16other people to install it.16other people to install it.

17 17 

18Standalone skills are available in the ChatGPT desktop app, Codex CLI, and IDE18Standalone skills are available in the ChatGPT desktop app, Codex CLI, and IDE

19extension. Skills bundled in plugins are also available through supported19extension. Skills bundled in plugins are also available in Chat and Work across

20plugin surfaces, including ChatGPT Work on the web.20ChatGPT on the web, desktop, and mobile.

21 21 

22In the ChatGPT desktop app, open **Skills** in the sidebar to view and explore skills22In the ChatGPT desktop app, open **Skills** in the sidebar to view and explore skills

23created across your projects.23created across your projects.

24 24 

25<CodexScreenshot25 

26 alt="Skills picker showing available skills in the ChatGPT desktop app"26

27 lightSrc="/images/codex/app/skill-selector-light.webp"27 

28 darkSrc="/images/codex/app/skill-selector-dark.webp"28> Illustration: Skills picker showing available skills in the ChatGPT desktop app

29 maxHeight="400px"29 

30 class="my-8"30 

31/>31 

32 32 

33Skills use **progressive disclosure** to manage context efficiently. ChatGPT and33Skills use **progressive disclosure** to manage context efficiently. ChatGPT and

34Codex start with each skill's name and description, then load the full34Codex start with each skill's name and description, then load the full

Details

1# Chrome extension1# Browser extension

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5Use the Chrome extension to let ChatGPT control your Chrome browser. ChatGPT can5Use the ChatGPT browser extension to work in Google Chrome, Microsoft Edge,

6read or act on sites where you're already signed in, such as LinkedIn,6Brave, Opera, or Vivaldi from the ChatGPT desktop app. ChatGPT can read or act

7Salesforce, Gmail, or internal tools.7on sites where you're already signed in, such as LinkedIn, Salesforce, Gmail,

8or internal tools.

9 

10All five browsers support tab mentions and browser control from the desktop

11app. Chrome, Edge, Brave, and Vivaldi also support side chat. **Opera doesn't

12support side chat**; start its tasks in the desktop app instead.

13 

14Update the ChatGPT desktop app before setting up another browser. Browser

15availability can depend on rollout and your workspace settings.

8 16 

9To let ChatGPT control its built-in browser instead, use `@Browser`. The17To let ChatGPT control its built-in browser instead, use `@Browser`. The

10[built-in browser](https://help.openai.com/en/articles/20001277-using-the-built-in-browser-in-the-chatgpt-desktop-app)18[built-in browser](https://help.openai.com/en/articles/20001277-using-the-built-in-browser-in-the-chatgpt-desktop-app)

11supports sign-in and keeps browsing work inside ChatGPT without using your19supports sign-in and keeps browsing work inside ChatGPT without using your

12Chrome profile.20regular browser profile.

13 21 

14ChatGPT can also switch between tools as a task requires, using plugins when a22ChatGPT can also switch between tools as a task requires, using plugins when a

15dedicated integration is available, Chrome when it needs logged-in browser23dedicated integration is available, your browser when it needs signed-in browser

16context, and the built-in browser for localhost.24context, and the built-in browser for localhost.

17 25 

18 26 


26 34 

27 35 

28 36 

29## Use ChatGPT from Chrome37<a id="use-chatgpt-from-chrome"></a>

38 

39## Use side chat in your browser

40 

41Side chat is available in Chrome, Edge, Brave, and Vivaldi.

30 42 

31Open ChatGPT beside the page you're viewing to ask about the page or continue43Open ChatGPT beside the page you're viewing to ask about the page or continue

32into tasks that can use its context alongside local files and connected apps.44into tasks that can use its context alongside local files and connected apps.

33ChatGPT can use context from your open tabs when a task needs it.45ChatGPT can use context from your open tabs when a task needs it.

34 46 

351. Open the page you want to work with.471. Open the page you want to work with.

362. Select ChatGPT from the Chrome toolbar or **Extensions** menu. On macOS, you482. Select ChatGPT from the browser toolbar or **Extensions** menu. On macOS, you

37 can also press <kbd>Cmd</kbd>+<kbd>Shift</kbd>+<kbd>.</kbd>.49 can also press <kbd>Cmd</kbd>+<kbd>Shift</kbd>+<kbd>.</kbd>.

383. Ask a question about the page or give ChatGPT a task.503. Ask a question about the page or give ChatGPT a task.

39 51 

40The panel stays with the tab where you opened it. Chats you start in Chrome52The panel stays with the tab where you opened it. Chats you start in side chat

41are available in the ChatGPT app, and you can open recent ChatGPT chats in53are available in the ChatGPT app, and you can open recent ChatGPT chats in

42Chrome, so you can continue work in either place.54the side chat, so you can continue work in either place.

55 

56 

57 

58> Illustration: ChatGPT open beside the current Chrome tab.

59 

43 60 

44<Illustration description="ChatGPT open beside the current Chrome tab.">

45 <ChromeSidePanelIllustration

46 ariaLabel="ChatGPT open beside the current Chrome tab."

47 backgroundImage="/images/codex/codex-wallpaper-1.webp"

48 />

49</Illustration>

50 61 

51## Bring tabs and selected text into a chat62## Bring tabs and selected text into a chat

52 63 

53Mention an open Chrome tab in the side chat when you want ChatGPT to use that64Mention an open browser tab in the desktop app when you want ChatGPT to use

54page as context. You can also highlight text on a page and bring the selection65that page as context. In browsers with side chat, you can also mention tabs

55into your chat to ask about a specific passage without copying the whole page.66there, or highlight text on a page and bring the selection into your chat to

67ask about a specific passage without copying the whole page.

56 68 

57To start from the page instead, right-click it and select **Ask ChatGPT**. The69In browsers with side chat, you can also right-click the page and select

58side chat opens with the relevant page context so you can continue the request70**Ask ChatGPT**. The side chat opens with the relevant page context so you can

59in Chrome.71continue the request in your browser.

60 72 

61### Ask about a YouTube video73### Ask about a YouTube video

62 74 

63Open a YouTube video, then ask a question about it in the Chrome side chat.75Open a YouTube video, then ask a question about it in a supported side chat.

64When captions are available, ChatGPT can use the video's timestamped transcript76When captions are available, ChatGPT can use the video's timestamped transcript

65to explain, summarize, or answer questions about the content.77to explain, summarize, or answer questions about the content.

66 78 


68context. Review the page and any requested permissions before asking ChatGPT to80context. Review the page and any requested permissions before asking ChatGPT to

69use or act on that information.81use or act on that information.

70 82 

71## Set up the Chrome extension83<a id="set-up-the-chrome-extension"></a>

72 84 

73In the ChatGPT desktop app, open the Plugins Directory and install **Chrome**.85## Set up your browser

74Other Chromium-based browsers aren't currently supported. Follow the setup flow

75to:

76 

771. Install the [Chrome

78 extension](https://chromewebstore.google.com/detail/chatgpt/hehggadaopoacecdllhhajmbjkdcmajg).

792. Approve Chrome's permission prompts.

803. Open Chrome and confirm the ChatGPT side chat loads.

81 

82<Illustration description="Computer Use settings showing Google Chrome connected through the Chrome extension.">

83 <ComputerUseSettingsIllustration

84 ariaLabel="Computer Use settings showing Google Chrome connected through the Chrome extension."

85 aspectRatio="3 / 1"

86 controlRows={[

87 {

88 id: "chrome",

89 title: "Google Chrome",

90 description: "Connected to browser extension for additional control",

91 icon: "chrome",

92 enabled: true,

93 connected: true,

94 manageLabel: "Manage",

95 },

96 ]}

97 showAlwaysAllowedApps={false}

98 />

99</Illustration>

100 86 

101## Start a Chrome task from ChatGPT87Install the browser on your computer, then open **Settings > Computer Use** in

88the ChatGPT desktop app. Expand **More browsers** if your browser isn't shown

89in the main list.

102 90 

103After the plugin setup is complete, start a new ChatGPT Work or Codex chat. ChatGPT911. Select your browser and follow any prompt to install the required plugin.

104can use Chrome automatically when a task needs a website and you're already922. Select **Install** beside the browser to open its extension store page.

105signed in to Chrome. You can also invoke it directly in a prompt:93 Install the ChatGPT extension and review the browser's permission prompts.

943. Return to **Computer Use** and confirm that the browser shows **Manage**.

954. Start a ChatGPT Work or Codex chat and select your browser with an

96 `@`-mention. Use the browser profile where you installed the extension.

97 

98The browser's toggle in **Computer Use** controls whether it appears in the

99`@`-mention menu. Select **Manage** to change website permissions instead.

100 

101 

102 

103> Illustration: Computer Use settings showing Google Chrome connected through the Chrome extension.

104 

105 

106 

107<a id="start-a-chrome-task-from-chatgpt"></a>

108 

109## Start a browser task from ChatGPT

110 

111After setup, start a new ChatGPT Work or Codex chat. Select **Chrome**, **Edge**,

112**Brave Browser**, **Opera**, or **Vivaldi** from the `@`-mention menu to choose

113which browser ChatGPT uses. For example:

106 114 

107```text115```text

108@Chrome open Salesforce and update the account from these call notes.116@Edge open Salesforce and update the account from these call notes.

109```117```

110 118 

111If Chrome isn't already open, ChatGPT can open it. Chrome browser tasks run in119You can also mention an open tab to give ChatGPT context from that page.

112Chrome tab groups so the work for a task stays grouped together.120Opera supports these desktop workflows even though it doesn't have side chat.

113 121 

114## Control website access122## Control website access

115 123 


127### Manage allowed and blocked websites135### Manage allowed and blocked websites

128 136 

129In the ChatGPT desktop app, go to **Settings** > **Computer Use**, then select137In the ChatGPT desktop app, go to **Settings** > **Computer Use**, then select

130**Manage** next to **Google Chrome** to manage an allowlist and blocklist for138**Manage** next to your browser to manage an allowlist and blocklist for

131domains. The allowlist contains domains ChatGPT can use without asking again.139domains. The allowlist contains domains ChatGPT can use without asking again.

132The blocklist contains domains ChatGPT shouldn't use.140The blocklist contains domains ChatGPT shouldn't use. The supported browsers

141share these website permissions.

133 142 

134Removing a domain from the allowlist means ChatGPT asks again before using it.143Removing a domain from the allowlist means ChatGPT asks again before using it.

135Removing a domain from the blocklist means ChatGPT can ask again instead of144Removing a domain from the blocklist means ChatGPT can ask again instead of


139 148 

140If you select **Allow for all sites**, ChatGPT no longer asks for confirmation149If you select **Allow for all sites**, ChatGPT no longer asks for confirmation

141before using websites. Only choose this option if you trust ChatGPT to use any150before using websites. Only choose this option if you trust ChatGPT to use any

142website open in Chrome.151website open in the browser.

143 152 

144#### Browser history <ElevatedRiskBadge class="ml-2" />153#### Browser history <ElevatedRiskBadge class="ml-2" />

145 154 

146Browser history can include sensitive telemetry, internal URLs, search terms,155Browser history can include sensitive telemetry, internal URLs, search terms,

147and activity from Chrome sessions on signed-in devices. If you allow ChatGPT to156and activity from browser sessions on signed-in devices. If you allow ChatGPT to

148access browser history, relevant history entries can become part of the context157access browser history, relevant history entries can become part of the context

149ChatGPT uses for the task. Malicious or misleading page content can increase the158ChatGPT uses for the task. Malicious or misleading page content can increase the

150risk that ChatGPT copies this data somewhere unintended.159risk that ChatGPT copies this data somewhere unintended.


154 163 

155## Data and security164## Data and security

156 165 

157### Chrome extension permissions166<a id="chrome-extension-permissions"></a>

167 

168### Browser extension permissions

158 169 

159Chrome asks you to accept extension permissions when you install the extension.170Your browser asks you to accept permissions when you install the extension.

160The permission prompt may include:171For example, Chrome's permission prompt may include:

161 172 

162- Access the page debugger173- Access the page debugger

163- Read and change all your data on all websites174- Read and change all your data on all websites


168- Communicate with cooperating native applications179- Communicate with cooperating native applications

169- View and manage your tab groups180- View and manage your tab groups

170 181 

171These Chrome permissions make the extension capable of operating browser182These extension permissions make it capable of operating browser

172workflows. ChatGPT still uses its own confirmations, settings, allowlists, and183workflows. ChatGPT still uses its own confirmations, settings, allowlists, and

173blocklists before using websites or browser history during a task.184blocklists before using websites or browser history during a task.

174 185 

175### Memories186### Memories

176 187 

177Computer Use follows your Memories setting. If Memories is on, ChatGPT can188Computer Use follows your Memories setting. If Memories is on, ChatGPT can

178use relevant saved memories while working in Chrome. If Memories is off, browser189use relevant saved memories while working in your browser. If Memories is off,

179control doesn't use memories.190browser control doesn't use memories.

180 191 

181### What OpenAI stores from browsing192### What OpenAI stores from browsing

182 193 

183OpenAI doesn't store a separate complete record of your Chrome actions from the194OpenAI doesn't store a separate complete record of your browser actions from the

184extension. OpenAI stores browser activity only when it becomes part of the ChatGPT195extension. OpenAI stores browser activity only when it becomes part of the ChatGPT

185context, such as text ChatGPT reads from a page, screenshots, tool calls,196context, such as text ChatGPT reads from a page, screenshots, tool calls,

186summaries, messages, or other content included in the chat.197summaries, messages, or other content included in the chat.


191 202 

192## Troubleshooting203## Troubleshooting

193 204 

194If ChatGPT can't connect to Chrome, first confirm the website ChatGPT is trying to205If ChatGPT can't connect to your browser, first confirm the website ChatGPT is trying to

195access isn't in the blocklist in Settings. If the website isn't blocked, work206access isn't in the blocklist in Settings. If the website isn't blocked, work

196through these checks:207through these checks:

197 208 

1981. Update the ChatGPT desktop app. If you have more than one ChatGPT or Codex2091. Update the ChatGPT desktop app. If you have more than one ChatGPT or Codex

199 desktop app installed, update each one or remove copies you no longer use.210 desktop app installed, update each one or remove copies you no longer use.

2002. Close the ChatGPT side panel, restart Chrome, then reopen the extension from2112. Restart your browser. In Chrome, Edge, Brave, or Vivaldi, reopen ChatGPT from

201 the Chrome toolbar or **Extensions** menu. Confirm the side chat loads. If212 the toolbar or **Extensions** menu and confirm the side chat loads. Opera

202 it doesn't load or mentions a missing native host, remove and re-add the213 doesn't have side chat; check its connection from the desktop app.

203 Chrome plugin from **Plugins** in the ChatGPT desktop app, then follow the2143. In **Settings > Computer Use**, confirm that your browser appears and shows

204 setup flow again.215 **Manage**. If it still shows **Install**, follow the setup flow again.

2053. In the app, select ChatGPT and turn on Work in the switcher, or select Codex. Open216 Turn on its toggle if the browser is missing from the `@`-mention menu.

206 **Plugins** and confirm that the Chrome plugin is on. If the plugin is off,2174. Make sure you are using the browser profile where the extension is

207 turn it on and try the task again.218 installed. If you use more than one profile, install and enable the

2084. Make sure you are using the same Chrome profile where the extension is

209 installed. If you use more than one Chrome profile, install and enable the

210 extension in the active profile.219 extension in the active profile.

2115. Start a new ChatGPT Work or Codex chat and try the Chrome task again. This can2205. Start a new ChatGPT Work or Codex chat and try the browser task again. This can

212 clear chat-specific connection state.221 clear chat-specific connection state.

2136. Restart the ChatGPT desktop app, then try again. If the extension still2226. Restart the ChatGPT desktop app, then try again. If the extension still

214 doesn't connect, uninstall the Chrome extension, remove and re-add the Chrome223 doesn't connect, reinstall it through **Settings > Computer Use**.

215 plugin from **Plugins**, and follow the setup flow again.2247. If ChatGPT still can't use the browser, run `/feedback`

2167. If the side chat loads but ChatGPT still can't use Chrome, run `/feedback`

217 in the app and include the chat ID when you contact support.225 in the app and include the chat ID when you contact support.

218 226 

219### Upload files227### Upload files

code-review.md +7 −6

Details

125**Code review**, choose **Detached** to start a separate review chat. See125**Code review**, choose **Detached** to start a separate review chat. See

126[developer settings](https://learn.chatgpt.com/docs/developer-settings?surface=app#app-code-review).126[developer settings](https://learn.chatgpt.com/docs/developer-settings?surface=app#app-code-review).

127 127 

128<CodexScreenshot128 

129 alt="Inline code review comments displayed in the review pane"129

130 lightSrc="/images/codex/app/inline-code-review-light.webp"130 

131 darkSrc="/images/codex/app/inline-code-review-dark.webp"131> Illustration: Inline code review comments displayed in the review pane

132 maxHeight="400px"132 

133/>133 

134 

134 135 

135</ContentModeSwitch>136</ContentModeSwitch>

136 137 

codex-sdk.md +6 −4

Details

11- Build Codex into your own internal tools and workflows11- Build Codex into your own internal tools and workflows

12- Integrate Codex within your own application12- Integrate Codex within your own application

13 13 

14Use the Codex SDK for coding-focused Codex threads. If Codex is one specialist inside a broader orchestrated workflow, [run Codex CLI as an MCP server and orchestrate it with the Agents SDK](https://learn.chatgpt.com/docs/mcp-server).14Use the Codex SDK to automate coding tasks, including jobs in CI. Use the [Codex app server](https://learn.chatgpt.com/docs/app-server) to build custom clients that handle authentication, conversation history, approvals, and streamed agent events.

15 

16The `codex mcp-server` command and standalone `codex-mcp-server` binary have been removed. Use the [Codex app server](https://learn.chatgpt.com/docs/app-server) for existing integrations.

15 17 

16If you have beta access and need repository or change scans with structured18If you have beta access and need repository or change scans with structured

17security findings and coverage, use the [Codex Security TypeScript19security findings and coverage, use the [Codex Security TypeScript


80 82 

81Published SDK builds automatically use their pinned runtime. Pass `CodexConfig(codex_bin=...)` only when you intentionally want to run against a specific local Codex executable.83Published SDK builds automatically use their pinned runtime. Pass `CodexConfig(codex_bin=...)` only when you intentionally want to run against a specific local Codex executable.

82 84 

83While the Python SDK is in beta, `pip install openai-codex` selects the latest85The Python SDK is available as a stable release. `pip install openai-codex`

84published beta build. After a stable SDK release exists, use86installs the latest stable release. Use `pip install --pre openai-codex` to opt

85`pip install --pre openai-codex` to opt in to newer prerelease builds.87in to newer prerelease builds.

86 88 

87### Usage89### Usage

88 90 

computer-use.md +26 −13

Details

25select it. Turn on the Computer Use server and skill toggles, then select **Try25select it. Turn on the Computer Use server and skill toggles, then select **Try

26now** to start.26now** to start.

27 27 

28<Illustration description="Computer Use plugin controls with the MCP server and skill enabled.">28 

29 <ComputerUsePluginSetupIllustration ariaLabel="Computer Use plugin controls with the MCP server and skill enabled." />29 

30</Illustration>30> Illustration: Computer Use plugin controls with the MCP server and skill enabled.

31 

32 

31 33 

32Then open **Settings > Computer use** to review app access. Connected browser34Then open **Settings > Computer use** to review app access. Connected browser

33controls show a **Manage** action. Apps you approve for future tasks appear in35controls show a **Manage** action. Apps you approve for future tasks appear in

34the **Always-allowed apps** section.36the **Always-allowed apps** section.

35 37 

36<Illustration description="Computer Use settings showing app controls and Calculator as the only always-allowed app.">38 

37 <ComputerUseSettingsIllustration ariaLabel="Computer Use settings showing app controls and Calculator as the only always-allowed app." />39 

38</Illustration>40> Illustration: Computer Use settings showing app controls and Calculator as the only always-allowed app.

41 

42 

39 43 

40On Windows, keep the target app visible on the active desktop while the task44On Windows, keep the target app visible on the active desktop while the task

41runs. On macOS, grant Screen Recording and Accessibility permissions when45runs. On macOS, grant Screen Recording and Accessibility permissions when


48 52 

49## When to use Computer Use53## When to use Computer Use

50 54 

55For difficult tasks that depend on screenshots or visual judgment, choose

56[GPT-6 Astra](https://learn.chatgpt.com/docs/models#gpt-6-astra) when it is available in your model

57selector. The same plugin setup, operating-system permissions, and app access

58controls apply.

59 

51Choose Computer Use when the task depends on a graphical user interface that's60Choose Computer Use when the task depends on a graphical user interface that's

52hard to verify through files or command output alone.61hard to verify through files or command output alone.

53 62 


100 109 

101## Permissions and approvals110## Permissions and approvals

102 111 

112Workspace administrators can restrict which apps Computer Use can access and

113whether approvals can be saved. See

114[managed browser and Computer Use controls](https://learn.chatgpt.com/docs/enterprise/managed-configuration#control-browser-and-computer-use).

115 

103System permissions for Computer Use are separate from app approvals in ChatGPT.116System permissions for Computer Use are separate from app approvals in ChatGPT.

104On macOS, Screen Recording and Accessibility permissions let ChatGPT see and117On macOS, Screen Recording and Accessibility permissions let ChatGPT see and

105operate apps. App approvals determine which apps you allow ChatGPT to use. File118operate apps. App approvals determine which apps you allow ChatGPT to use. File


112without asking again. You can remove apps from the **Always allow** list in the125without asking again. You can remove apps from the **Always allow** list in the

113**Computer Use** section of the ChatGPT desktop app settings.126**Computer Use** section of the ChatGPT desktop app settings.

114 127 

115<CodexScreenshot128 

116 alt="ChatGPT desktop app asking for permission to use Calculator with Computer Use"129

117 lightSrc="/images/codex/app/computer-use-approval-light.webp"130 

118 darkSrc="/images/codex/app/computer-use-approval-dark.webp"131> Illustration: Computer Use approval dialog requesting access to Calculator

119 maxHeight="420px"132 

120 variant="no-wallpaper"133 

121/>134 

122 135 

123ChatGPT may also ask for permission before taking sensitive or disruptive actions.136ChatGPT may also ask for permission before taking sensitive or disruptive actions.

124 137 

Details

18 18 

19```toml19```toml

20# ~/.codex/deep-review.config.toml20# ~/.codex/deep-review.config.toml

21model = "gpt-5.5"21model = "gpt-5.6-sol"

22model_reasoning_effort = "xhigh"22model_reasoning_effort = "xhigh"

23approval_policy = "on-request"23approval_policy = "on-request"

24model_catalog_json = "/Users/me/.codex/model-catalogs/deep-review.json"24model_catalog_json = "/Users/me/.codex/model-catalogs/deep-review.json"


275 275 

276To change the base URL for the built-in OpenAI provider, use `openai_base_url`; don't create `[model_providers.openai]`, because you can't override built-in provider IDs.276To change the base URL for the built-in OpenAI provider, use `openai_base_url`; don't create `[model_providers.openai]`, because you can't override built-in provider IDs.

277 277 

278## ChatGPT customers using data residency278## API organizations using data residency

279 279 

280Projects created with [data residency](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt) enabled can create a model provider to update the base_url with the [correct prefix](https://platform.openai.com/docs/guides/your-data#which-models-and-features-are-eligible-for-data-residency).280Projects created with [data residency](https://help.openai.com/en/articles/9903489-data-residency-and-inference-residency-for-chatgpt) enabled can create a model provider to update the `base_url` with the [correct prefix](https://developers.openai.com/api/docs/guides/your-data#which-models-and-features-are-eligible-for-data-residency). For ChatGPT workspaces with data residency, a custom provider isn't required; Codex respects workspace residency settings when you sign in with ChatGPT.

281 281 

282```toml282```toml

283model_provider = "openaidr"283model_provider = "openaidr"


303 303 

304For operational details to keep in mind while editing `config.toml`, see [Common sandbox and approval combinations](https://learn.chatgpt.com/docs/agent-approvals-security#common-sandbox-and-approval-combinations), [Protected paths in writable roots](https://learn.chatgpt.com/docs/agent-approvals-security#protected-paths-in-writable-roots), and [Network access](https://learn.chatgpt.com/docs/agent-approvals-security#network-access).304For operational details to keep in mind while editing `config.toml`, see [Common sandbox and approval combinations](https://learn.chatgpt.com/docs/agent-approvals-security#common-sandbox-and-approval-combinations), [Protected paths in writable roots](https://learn.chatgpt.com/docs/agent-approvals-security#protected-paths-in-writable-roots), and [Network access](https://learn.chatgpt.com/docs/agent-approvals-security#network-access).

305 305 

306Codex and ChatGPT Work no longer support `approval_policy = "untrusted"`. See

307[Migrate from the retired `untrusted` approval policy](https://learn.chatgpt.com/docs/agent-approvals-security#migrate-from-the-retired-untrusted-approval-policy)

308for supported settings and stricter project-derived approvals.

309 

306For beta permission profiles that configure filesystem and network access together, see [Permissions](https://learn.chatgpt.com/docs/permissions).310For beta permission profiles that configure filesystem and network access together, see [Permissions](https://learn.chatgpt.com/docs/permissions).

307 311 

308You can also use a granular approval policy (`approval_policy = { granular = { ... } }`) to allow or auto-reject individual prompt categories. This is useful when you want normal interactive approvals for some cases but want others, such as `request_permissions` or skill-script prompts, to fail closed automatically.312You can also use a granular approval policy (`approval_policy = { granular = { ... } }`) to allow or auto-reject individual prompt categories. This is useful when you want normal interactive approvals for some cases but want others, such as `request_permissions` or skill-script prompts, to fail closed automatically.


315`guardian_policy_config` takes precedence.319`guardian_policy_config` takes precedence.

316 320 

317```toml321```toml

318approval_policy = "untrusted" # Other options: on-request, never, or { granular = { ... } }322approval_policy = "on-request" # Other options: never or { granular = { ... } }

319approvals_reviewer = "user" # Or "auto_review" for automatic review323approvals_reviewer = "user" # Or "auto_review" for automatic review

320sandbox_mode = "workspace-write"324sandbox_mode = "workspace-write"

321allow_login_shell = false # Optional hardening: disallow login shells for shell tools325allow_login_shell = false # Optional hardening: disallow login shells for shell tools

Details

242. Project config files: `.codex/config.toml`, ordered from the project root down to your current working directory (closest wins; trusted projects only)242. Project config files: `.codex/config.toml`, ordered from the project root down to your current working directory (closest wins; trusted projects only)

253. [Profile](https://learn.chatgpt.com/docs/config-file/config-advanced#profiles) files selected with `--profile profile-name` (`~/.codex/profile-name.config.toml`)253. [Profile](https://learn.chatgpt.com/docs/config-file/config-advanced#profiles) files selected with `--profile profile-name` (`~/.codex/profile-name.config.toml`)

264. User config: `~/.codex/config.toml`264. User config: `~/.codex/config.toml`

275. System config (if present): `/etc/codex/config.toml` on Unix275. Cloud-managed `config.toml` defaults, when delivered for the signed-in workspace

286. Built-in defaults286. System config (if present): `/etc/codex/config.toml` on Unix

297. Built-in defaults

29 30 

30Use that precedence to set shared defaults in `config.toml` and keep [profile files](https://learn.chatgpt.com/docs/config-file/config-advanced#profiles) focused on the values that differ.31Use that precedence to set shared defaults in `config.toml` and keep [profile files](https://learn.chatgpt.com/docs/config-file/config-advanced#profiles) focused on the values that differ.

31 32 

33Cloud-managed and system configuration can define plugin marketplaces and set

34whether plugins are enabled by default. These are separate from enforced `requirements.toml`

35policies. See [Configure plugin marketplaces and defaults](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-plugin-marketplaces-and-defaults).

36 

32If you mark a project as untrusted, Codex skips project-scoped `.codex/` layers, including project-local config, hooks, and rules. User and system config still load, including user/global hooks and rules.37If you mark a project as untrusted, Codex skips project-scoped `.codex/` layers, including project-local config, hooks, and rules. User and system config still load, including user/global hooks and rules.

33 38 

34For one-off overrides via `-c`/`--config` (including TOML quoting rules), see [Advanced Config](https://learn.chatgpt.com/docs/config-file/config-advanced#one-off-overrides-from-the-cli).39For one-off overrides via `-c`/`--config` (including TOML quoting rules), see [Advanced Config](https://learn.chatgpt.com/docs/config-file/config-advanced#one-off-overrides-from-the-cli).


60approval_policy = "on-request"65approval_policy = "on-request"

61```66```

62 67 

63For behavior differences between `untrusted`, `on-request`, and `never`, see [Run without approval prompts](https://learn.chatgpt.com/docs/agent-approvals-security#run-without-approval-prompts) and [Common sandbox and approval combinations](https://learn.chatgpt.com/docs/agent-approvals-security#common-sandbox-and-approval-combinations).68For behavior differences between `on-request` and `never`, see [Run without approval prompts](https://learn.chatgpt.com/docs/agent-approvals-security#run-without-approval-prompts) and [Common sandbox and approval combinations](https://learn.chatgpt.com/docs/agent-approvals-security#common-sandbox-and-approval-combinations). If an existing configuration uses `approval_policy = "untrusted"`, see [Migrate from the retired `untrusted` approval policy](https://learn.chatgpt.com/docs/agent-approvals-security#migrate-from-the-retired-untrusted-approval-policy).

64 69 

65#### Sandbox level70#### Sandbox level

66 71 

Details

139 139 

140# When to ask for command approval:140# When to ask for command approval:

141 141 

142# - untrusted: only known-safe read-only commands auto-run; others prompt

143 

144# - on-request: model decides when to ask (default)142# - on-request: model decides when to ask (default)

145 143 

146# - never: never prompt (risky)144# - never: never prompt (risky)


225 223 

226mcp_oauth_credentials_store = "auto"224mcp_oauth_credentials_store = "auto"

227 225 

228# Optional fixed port for MCP OAuth callback: 1-65535. Default: unset.226# Shared wait for optional MCP servers before building the initial tool catalog.

227 

228# Default: 1000 ms. Set to 0 to wait for each server's startup_timeout_sec instead.

229 

230# mcp_optional_startup_grace_ms = 1000

231 

232# Optional global fixed port for MCP OAuth callback: 1-65535. Default: unset.

233 

234# A server-specific oauth.callback_port overrides this global listener port.

229 235 

230# mcp_oauth_callback_port = 4321236# mcp_oauth_callback_port = 4321

231 237 

232# Optional redirect URI override for MCP OAuth login (for example, remote devbox ingress).238# Optional callback URL override for MCP OAuth login (for example, remote devbox ingress).

239 

240# Newly added pre-registered clients use this URL unchanged when the authorization server

241 

242# advertises issuer support and provides a metadata issuer. Without issuer support,

233 243 

234# Codex appends a server-specific callback ID before OAuth login.244# Codex appends a server-specific callback ID. Existing clients without a saved

235 245 

236# Register the full derived URI with your provider, not just the base host or unsuffixed path.246# callback keep that suffix.

237 247 

238# Custom callback paths are supported. `mcp_oauth_callback_port` still controls the listener port.248# Without issuer support, any pre-registered MCP server callback must already

249 

250# end in the correct callback ID. Otherwise, Codex ignores that callback and uses

251 

252# this global URL (or its default) with the server-specific callback ID appended.

253 

254# Malformed callback URLs and mismatched authorization response issuers fail.

255 

256# If issuer support is advertised, missing metadata or response issuers also fail.

257 

258# Custom callback paths are supported. Callback URL ports don't select the

259 

260# listener port; configure oauth.callback_port or mcp_oauth_callback_port.

239 261 

240# mcp_oauth_callback_url = "https://devbox.example.internal/callback"262# mcp_oauth_callback_url = "https://devbox.example.internal/callback"

241 263 


359 381 

360################################################################################382################################################################################

361 383 

384# Token budget for the available-skills catalog. Default: 2% of the model context

385 

386# window. Explicit values must be positive and are capped at 10000 tokens.

387 

388# [skills]

389 

390# max_context_tokens = 2000

391 

362# Disable or re-enable a specific skill without deleting it.392# Disable or re-enable a specific skill without deleting it.

363 393 

364[[skills.config]]394[[skills.config]]


441 471 

442# Enable the feature before configuring sandboxed networking rules.472# Enable the feature before configuring sandboxed networking rules.

443 473 

474# A profile's network.enabled allows direct network access; its domain rules

475 

476# apply only when the network proxy feature is enabled.

477 

478# Web search, apps, connectors, and MCP servers use separate controls.

479 

444# [features.network_proxy]480# [features.network_proxy]

445 481 

446# enabled = true482# enabled = true


689 725 

690# personality = true726# personality = true

691 727 

692# network_proxy = false728# network_proxy = true # required to enforce permission-profile domain rules

693 729 

694# fast_mode = true730# fast_mode = true

695 731 


813 849 

814# oauth_resource = "https://docs.example.com/" # optional OAuth resource850# oauth_resource = "https://docs.example.com/" # optional OAuth resource

815 851 

852# [mcp_servers.docs.tools.search]

853 

854# output_token_limit = 30000 # positive token budget, before the 20% serialization allowance

855 

816# --- Example: Streamable HTTP transport ---856# --- Example: Streamable HTTP transport ---

817 857 

818# [mcp_servers.github]858# [mcp_servers.github]


829 869 

830# env_http_headers = { "X-Auth" = "AUTH_ENV" } # optional headers populated from env vars870# env_http_headers = { "X-Auth" = "AUTH_ENV" } # optional headers populated from env vars

831 871 

872# http_headers_helper = "company-auth mcp-headers" # local command that prints a JSON header map

873 

832# startup_timeout_sec = 10.0 # optional874# startup_timeout_sec = 10.0 # optional

833 875 

834# tool_timeout_sec = 60.0 # optional876# tool_timeout_sec = 60.0 # optional


839 881 

840# scopes = ["repo"] # optional OAuth scopes882# scopes = ["repo"] # optional OAuth scopes

841 883 

884# [mcp_servers.github.oauth]

885 

886# client_id = "my-pre-registered-client" # OAuth client registered with the provider

887 

888# callback_url = "http://127.0.0.1/callback" # saved registered callback for this client

889 

890# callback_port = 4321 # server-specific listener port; overrides the global setting

891 

892# For http://127.0.0.1:4321/callback, set callback_port = 4321 as well.

893 

842################################################################################894################################################################################

843 895 

844# Model Providers896# Model Providers

Details

45## Authentication and network45## Authentication and network

46 46 

47| Variable | Used by | Description |47| Variable | Used by | Description |

48| ---------------------- | ----------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |48| ---------------------------------- | ------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------- |

49| `CODEX_API_KEY` | `codex exec` | Provides an API key for a single non-interactive run. This is only supported in `codex exec`; set it inline rather than job-wide when running repository-controlled code. |49| `CODEX_API_KEY` | Exec, review, TypeScript SDK, remote exec-server | Provides an API key to a non-interactive Codex process. Set it inline rather than job-wide when running repository-controlled code. |

50| `CODEX_ACCESS_TOKEN` | CLI, app-server, trusted automation | Provides a ChatGPT or Codex access token for trusted automation. For persisted login, pipe it to `codex login --with-access-token`. |50| `CODEX_ACCESS_TOKEN` | CLI, app-server, trusted automation | Provides a ChatGPT or Codex access token for trusted automation. For persisted login, pipe it to `codex login --with-access-token`. |

51| `CODEX_CA_CERTIFICATE` | HTTPS, login, and WebSocket clients | Points to a PEM CA bundle for environments with corporate TLS interception or private root CAs. Takes precedence over `SSL_CERT_FILE`. |51| `OPENAI_FEDERATION_RULE_ID` | Workload identity | Selects the federation rule configured for the workload. |

52| `OPENAI_IDENTITY_TOKEN_FILE` | Workload identity | Points to the absolute path of the file that contains the current OIDC token or SPIFFE JWT-SVID. |

53| `OPENAI_WORKLOAD_IDENTITY_CONTEXT` | Workload identity | Optionally supplies bounded JSON identifiers for client-reported audit attribution. It does not affect authentication or authorization. |

54| `CODEX_CA_CERTIFICATE` | HTTPS, login, and WebSocket clients | Points to a PEM CA bundle for environments with corporate TLS interception or private root certificates. Takes precedence over `SSL_CERT_FILE`. |

52| `SSL_CERT_FILE` | HTTPS, login, and WebSocket clients | Fallback PEM CA bundle path when `CODEX_CA_CERTIFICATE` is unset. |55| `SSL_CERT_FILE` | HTTPS, login, and WebSocket clients | Fallback PEM CA bundle path when `CODEX_CA_CERTIFICATE` is unset. |

53 56 

54For provider API keys, set57For provider API keys, set


59For automation secret handling, see62For automation secret handling, see

60[Use API key auth](https://learn.chatgpt.com/docs/non-interactive-mode#use-api-key-auth).63[Use API key auth](https://learn.chatgpt.com/docs/non-interactive-mode#use-api-key-auth).

61For access token setup, see [Access tokens](https://learn.chatgpt.com/docs/enterprise/access-tokens).64For access token setup, see [Access tokens](https://learn.chatgpt.com/docs/enterprise/access-tokens).

65For workload identity setup, see

66[Workload identity federation](https://learn.chatgpt.com/docs/enterprise/workload-identity).

62 67 

63## Diagnostics68## Diagnostics

64 69 

Details

50 50 

51<ContentModeSwitch group="codex-surface" id="app">51<ContentModeSwitch group="codex-surface" id="app">

52 52 

53[Chronicle](https://learn.chatgpt.com/docs/customization/chronicle) is a desktop-only feature that helps53[Computer History](https://learn.chatgpt.com/docs/customization/computer-history) is a macOS desktop

54Codex recover recent working context from your screen to build up memory.54feature that turns activity across allowed apps and websites into memories and

55a timeline that ChatGPT and Codex can reference.

55 56 

56</ContentModeSwitch>57</ContentModeSwitch>

57 58 

cyber-safety.md +34 −21

Details

1# Cyber Safety1# Models and Trusted Access

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5[GPT-5.3-Codex](https://openai.com/index/introducing-gpt-5-3-codex/) is the first model we are treating as High cybersecurity capability under our [Preparedness Framework](https://cdn.openai.com/pdf/18a02b5d-6b67-4cec-ab64-68cdfbddebcd/preparedness-framework-v2.pdf), which requires additional safeguards. These safeguards include training the model to refuse clearly malicious requests like stealing credentials.5OpenAI Daybreak helps approved users perform authorized defensive cybersecurity work. Daybreak Blue provides access to flagship models with reduced refusals for authorized defensive workflows. Daybreak Red provides separately approved access to specialist cyber models for more advanced security research.

6 6 

7In addition to safety training, automated classifier-based monitors detect signals of suspicious cyber activity and route high-risk traffic to a less cyber-capable model (GPT-5.2). We expect a very small portion of traffic to be affected by these mitigations, and are working to refine our policies, classifiers, and in-product notifications.7Combine your approved model with a controlled environment, clear limits on approved systems and actions, least-privilege permissions, and automatic review before sensitive actions run. Use the model only with the approved identity, workspace or API organization and project, and product surface.

8 8 

9## Why we’re doing this9## Choose the right model

10 10 

11Over recent months, we’ve seen meaningful gains in model performance on cybersecurity tasks, benefiting both developers and security professionals. As our models improve at cybersecurity-related tasks like vulnerability discovery, we’re taking a precautionary approach: expanding protections and enforcement to support legitimate research while slowing misuse.11Start with **GPT-Daybreak-Blue** for most authorized defensive work. This model provides access to advanced capabilities with reduced refusals for defensive security workflows, including:

12 12 

13Cyber capabilities are inherently dual-use. The same knowledge and techniques that underpin important defensive work — penetration testing, vulnerability research, high-scale scanning, malware analysis, and threat intelligence — can also enable real-world harm.13- Vulnerability discovery and triage.

14- Secure code review and threat modeling.

15- Detection engineering and incident response.

16- Malware analysis in a controlled environment.

17- Remediation and patch validation.

14 18 

15These capabilities and techniques need to be available and easier to use in contexts where they can be used to improve security. Our [Trusted Access for Cyber](https://openai.com/index/trusted-access-for-cyber/) pilot enables individuals and organizations to continue using models for potentially high-risk cybersecurity activity without disruption.19**GPT-Daybreak-Red** is a specialist cyber model for separately approved, explicitly authorized workflows, such as controlled vulnerability reproduction, proof-of-concept or exploit validation, penetration testing, red teaming, and complex system analysis. It isn't the default choice for routine security work, and access isn't available automatically or on every surface.

16 20 

17## How it works21These advanced workflows can resemble malicious activity without clear authorization. Use the approved model and surface only for systems you own or are explicitly authorized to assess, and keep appropriate human oversight in place.

18 22 

19Developers and security professionals doing cybersecurity-related work or similar activity that could be [mistaken](#false-positives) by automated detection systems may have requests rerouted to GPT-5.2 as a fallback. We expect a very small portion of traffic to affected by mitigations, and are actively working to calibrate our policies and classifiers.23For example:

20 24 

21The latest alpha version of the Codex CLI includes in-product messaging for25- **GPT-Daybreak-Blue:** Review the approved lab repository for authentication weaknesses, rank findings by evidence and impact, and propose patches without accessing external systems.

22 when requests are rerouted. This messaging will be supported in all clients in26- **GPT-Daybreak-Red:** Within the approved lab and testing window, reproduce the documented authentication flaw, validate a minimal proof of concept, and stop before credential access, persistence, or production changes.

23 the next few days.

24 27 

25Accounts impacted by mitigations can regain access to GPT-5.3-Codex by joining the [Trusted Access](#trusted-access-for-cyber) program below.28## Trusted Access for Cyber

26 29 

27We recognize that joining Trusted Access may not be a good fit for everyone, so we plan to move from account-level safety checks to request-level checks in most cases as we scale these mitigations and [strengthen](https://openai.com/index/strengthening-cyber-resilience/) cyber resilience.30Request **Daybreak access** through [Trusted Access for Cyber](https://help.openai.com/en/articles/20001258-trusted-access-for-cyber). Access depends on approval and provisioning for your specific identity or service, ChatGPT workspace or API organization and project, authorized offering and model, and allowed product surface.

28 31 

29## Trusted Access for Cyber32- Individuals can request access through the [individual Trusted Access application](https://chatgpt.com/cyber).

33- Organizations can submit the [enterprise Trusted Access request form](https://openai.com/form/enterprise-trusted-access-for-cyber/) and coordinate with their OpenAI representative.

30 34 

31We are piloting "trusted access" which allows developers to retain advanced capabilities while we continue to calibrate policies and classifiers for general availability. Our goal is for very few users to need to join [Trusted Access for Cyber](https://openai.com/index/trusted-access-for-cyber/).35Submitting an application or completing identity verification doesn't guarantee approval.

32 36 

33To use models for potentially high-risk cybersecurity work:37Applying, verifying your identity, or receiving approval for Daybreak Blue

38 doesn't grant access to Daybreak Red or GPT-Daybreak-Red. The specialist

39 offering requires separate approval and provisioning.

34 40 

35- Users can verify their identity at [chatgpt.com/cyber](https://chatgpt.com/cyber)41For enterprise access, use the approved workspace, API organization, or project only for your organization's authorized internal work. Don't extend it to external users, third-party customers, externally offered services, downstream product features, or systems outside the approved work. If the approved identity, workspace, API organization, project, model, or surface is unclear, stop and confirm it with your OpenAI representative.

36- Enterprises can request [trusted access](https://openai.com/form/enterprise-trusted-access-for-cyber/) for their entire team by default through their OpenAI representative

37 42 

38Security researchers and teams who may need access to even more cyber-capable or permissive models to accelerate legitimate defensive work can express interest in our [invite-only program⁠](https://docs.google.com/forms/d/e/1FAIpQLSea_ptovrS3xZeZ9FoZFkKtEJFWGxNrZb1c52GW4BVjB2KVNA/viewform?usp=header). Users with trusted access must still abide by our [Usage Policies⁠](https://openai.com/policies/usage-policies/) and [Terms of Use⁠](https://openai.com/policies/row-terms-of-use/).43Trusted Access doesn't automatically grant [Zero Data Retention](https://developers.openai.com/api/docs/guides/your-data#data-retention-controls-for-abuse-monitoring). Confirm any separately approved retention controls for the exact API organization and applicable endpoint before you begin.

39 44 

40## False positives45## False positives

41 46 

42Legitimate or non-cybersecurity activity may occasionally be flagged. When rerouting occurs, the responding model will be visible in API request logs and in with an in-product notice in the CLI, soon all surfaces. If you're experiencing rerouting that you believe is incorrect, please report via `/feedback` for false positives.47Legitimate cybersecurity or unrelated activity can still trigger a safeguard. If a safeguard blocks, reroutes, or limits a request, inspect the available client notice and request logs. Review [Common Issues and Troubleshooting](https://help.openai.com/en/articles/20001259) for details to collect and next steps. Report suspected Codex false positives through `/feedback` when available. For API access restrictions and appeals, follow the [API cybersecurity checks guidance](https://developers.openai.com/api/docs/guides/safety-checks/cybersecurity#appeals).

48 

49All users remain subject to the [Usage Policies](https://openai.com/policies/usage-policies/) and [Terms of Use](https://openai.com/policies/row-terms-of-use/).

50 

51## Configure your security workflow

52 

53Trusted Access governs approved model access, but it doesn't configure your environment, enforce limits on approved systems and actions, or review proposed actions.

54 

55- [Use the recommended configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration) for isolation, least-privilege permissions, clearly defined boundaries, and guardrails for sensitive actions.

Details

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5In the ChatGPT desktop app, worktrees let Codex run multiple independent chats in the same project without interfering with each other. For Git repositories, [scheduled tasks](https://learn.chatgpt.com/docs/automations) can run on dedicated background worktrees so they don't conflict with your ongoing work. In non-version-controlled projects, scheduled tasks run directly in the project directory. You can also start chats in a worktree manually and use Handoff to move a chat between Local and Worktree.5Worktrees let Codex run multiple independent chats in the same project without interfering with each other. The repository, worktree, and commands remain on the computer or remote development environment that contains the project. You can work directly in the ChatGPT desktop app, or use [Remote](https://learn.chatgpt.com/docs/remote) in the ChatGPT mobile app to start, guide, approve, and review worktree chats on a connected computer.

6 6 

7Worktrees are available only in Codex in the ChatGPT desktop app. Select7For Git repositories, [scheduled tasks](https://learn.chatgpt.com/docs/automations) can run on dedicated background worktrees so they don't conflict with your ongoing work. In non-version-controlled projects, scheduled tasks run directly in the project directory. You can also start chats in a worktree manually and use Handoff to move a chat between Local and Worktree.

8 **Codex** before you start a chat in a worktree.8 

9Worktrees don't run locally on your phone. With Remote, the mobile app

10 controls Codex on your connected computer, where the repository and worktree

11 remain, or in the remote development environment that computer uses. The

12 desktop-specific instructions below apply on the connected computer.

9 13 

10## What's a worktree14## What's a worktree

11 15 


76 80 

77 81 

78 82 

79<CodexScreenshot83 

80 alt="Worktree chat view with branch controls and worktree details"84

81 lightSrc="/images/codex/app/worktree-light.webp"85 

82 darkSrc="/images/codex/app/worktree-dark.webp"86> Illustration: Worktree chat view with branch controls and worktree details

83 maxHeight="400px"87 

84 class="mb-4 lg:mb-0"88 

85/>89 

86 90 

87 91 

88 92 


112 116 

113 117 

114 118 

115<CodexScreenshot119 

116 alt="Handoff dialog moving a chat from a worktree to Local"120

117 lightSrc="/images/codex/app/handoff-light.webp"121 

118 darkSrc="/images/codex/app/handoff-dark.webp"122> Illustration: Handoff dialog moving a chat from a worktree to Local

119 maxHeight="400px"123 

120 class="mb-4 lg:mb-0"124 

121/>125 

122 126 

123 127 

124 128 

Details

41 41 

42 42 

43 43 

44<CodexScreenshot44 

45 alt="Project actions list shown in ChatGPT desktop app settings"45

46 lightSrc="/images/codex/app/actions-light.webp"46 

47 darkSrc="/images/codex/app/actions-dark.webp"47> Illustration: Project actions list shown in ChatGPT desktop app settings

48 maxHeight="400px"48 

49 class="mb-4 lg:mb-0"49 

50/>50 

51 51 

52</section>52</section>

53 53 


82 82 

83 83 

84 84 

85<Illustration description="Codex environment summary panel">85 

86 <EnvironmentPanelIllustration ariaLabel="Codex environment summary panel" />86 

87</Illustration>87> Illustration: Codex environment summary panel

extend/mcp.md +198 −8

Details

25 - Environment variables25 - Environment variables

26- **Streamable HTTP servers**: Servers that you access at an address.26- **Streamable HTTP servers**: Servers that you access at an address.

27 - Bearer token authentication27 - Bearer token authentication

28 - OAuth authentication28 - OAuth authentication, including Client ID Metadata Documents (CIMD) and

29 Dynamic Client Registration (DCR)

29 - ChatGPT session authentication for trusted first-party servers30 - ChatGPT session authentication for trusted first-party servers

30- **Server instructions**: Codex reads the MCP `instructions` field returned during initialization and uses it as server-wide guidance alongside the server's tools.31- **Server instructions**: Codex reads the MCP `instructions` field returned during initialization and uses it as server-wide guidance alongside the server's tools.

31 32 


61 62 

62## Use MCP-backed tools in ChatGPT web63## Use MCP-backed tools in ChatGPT web

63 64 

64In a hosted ChatGPT Work chat, install a [plugin](https://learn.chatgpt.com/docs/plugins) to use65In a hosted ChatGPT Work chat, install a [plugin](https://learn.chatgpt.com/docs/plugins) to use its

65its bundled connectors and remote MCP tools. Workspace administrators can66bundled connectors and remote MCP tools. After installation, Chat and Work can

66control which plugins and tools are available.67use those tools. Workspace administrators can control which plugins and tools

68are available.

67 69 

68ChatGPT web doesn't read local Codex configuration files or expose the local70ChatGPT web doesn't read local Codex configuration files or expose the local

69Codex command menu. Browse and manage available tools through **Plugins** in71Codex command menu. Open the **Plugins** tab to browse and manage available

70ChatGPT Work.72tools.

71 73 

72</ContentModeSwitch>74</ContentModeSwitch>

73 75 


166- `bearer_token_env_var` (optional): Environment variable name for a bearer token to send in `Authorization`.168- `bearer_token_env_var` (optional): Environment variable name for a bearer token to send in `Authorization`.

167- `http_headers` (optional): Map of header names to static values.169- `http_headers` (optional): Map of header names to static values.

168- `env_http_headers` (optional): Map of header names to environment variable names (values pulled from the environment).170- `env_http_headers` (optional): Map of header names to environment variable names (values pulled from the environment).

171- `http_headers_helper` (optional): Local command that prints a JSON object of

172 header names and string values, such as `{"X-Auth": "temporary-token"}`.

173 Supported for HTTP MCP connections made from the local environment; not for

174 stdio servers or connections made through a remote execution environment.

175 

176Codex caches helper headers for the connection. After a same-origin POST

177returns `401` or `403`, it refreshes the headers once and retries only if the

178helper returns changed values. Explicit bearer tokens and OAuth credentials

179take precedence over a helper-provided `Authorization` header.

180An OAuth `403` response that reports insufficient scope doesn't trigger a

181helper refresh.

169 182 

170If no credential source resolves, Codex can connect to the server without183If no credential source resolves, Codex can connect to the server without

171authentication. Run `codex mcp login <server-name>` separately to start an MCP184authentication. Run `codex mcp login <server-name>` separately to start an MCP


183 tools from this server. Supported values are `auto`, `prompt`, `writes`, and196 tools from this server. Supported values are `auto`, `prompt`, `writes`, and

184 `approve`. The `writes` mode prompts for tools that aren't marked read-only.197 `approve`. The `writes` mode prompts for tools that aren't marked read-only.

185- `tools.<tool>.approval_mode` (optional): Per-tool approval behavior override.198- `tools.<tool>.approval_mode` (optional): Per-tool approval behavior override.

199- `tools.<tool>.output_token_limit` (optional): Positive token budget for one

200 tool's output, before the standard 20% serialization allowance. Overrides the

201 model's default output truncation budget for that tool.

186 202 

187If your OAuth provider requires a fixed callback port, set the top-level `mcp_oauth_callback_port` in `config.toml`. If unset, Codex binds to an ephemeral port.203The top-level `mcp_optional_startup_grace_ms` setting controls how long Codex

204waits for optional MCP servers when building the initial tool catalog. It

205defaults to `1000` milliseconds. Set it to `0` to wait for each server's

206`startup_timeout_sec` instead. Required servers still use their startup

207timeouts.

188 208 

189If your MCP OAuth flow must use a specific callback URL (for example, a remote Devbox ingress URL or a custom callback path), set `mcp_oauth_callback_url`. Codex uses this value as the base callback URL, then appends a server-specific callback ID to produce the OAuth `redirect_uri` it sends during login. Register the full derived `redirect_uri` with your OAuth provider, including the appended callback ID and any configured path, query, or port, rather than registering only the base host or path without that suffix. Local callback URLs (for example `localhost`) bind on the local interface; non-local callback URLs bind on `0.0.0.0` so the callback can reach the host.209#### OAuth client registration and callbacks

210 

211When your authorization server requires a pre-registered OAuth client, provide

212its client ID when adding the MCP server:

213 

214```bash

215codex mcp add example --url https://mcp.example.com --oauth-client-id my-client

216```

217 

218Codex displays the complete callback URL to register with your provider:

219 

220```text

221OAuth callback URL: http://127.0.0.1/callback

222```

223 

224Codex saves the callback alongside the client ID in `config.toml` for later

225logins:

226 

227```toml

228[mcp_servers.example]

229url = "https://mcp.example.com"

230 

231[mcp_servers.example.oauth]

232client_id = "my-client"

233callback_url = "http://127.0.0.1/callback"

234```

235 

236Newly added pre-registered clients use a stable callback only when the

237authorization server advertises

238`authorization_response_iss_parameter_supported: true` and provides a metadata

239`issuer`. If issuer support isn't advertised, Codex appends a server-specific

240callback ID, such as `http://127.0.0.1/callback/XuuuHAzzHOni`. Existing clients

241without a saved callback continue using their callback-ID-specific redirect.

242 

243During login, callback selection depends on the OAuth configuration and

244authorization server metadata:

245 

246| OAuth configuration | Issuer support | Callback used |

247| ------------------------------------------------------------------ | ------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------- |

248| `callback_url` without `client_id` | Supported | The configured callback is used for client registration. |

249| `callback_url` without `client_id` | Unsupported | The configured callback is used for client registration with the server-specific callback ID appended. |

250| `client_id` and `callback_url` | Supported | The configured callback is reused; the authorization response must contain the matching `iss`. |

251| `client_id` and a `callback_url` ending in the correct callback ID | Unsupported | The configured callback is reused unchanged. |

252| `client_id` and a `callback_url` missing the correct callback ID | Unsupported | The configured callback is ignored. Codex uses `mcp_oauth_callback_url`, or `http://127.0.0.1/callback` when unset, with the callback ID appended. |

253| `client_id` without a configured `callback_url` | Supported or unsupported | Codex uses the global or default callback with the server-specific callback ID appended. |

254 

255The fallback doesn't modify the stored callback URL. Codex derives the callback

256ID from the MCP server URL, including its path and query string. The same

257selection rules apply to automatic and explicit login.

258 

259Set `mcp_oauth_callback_url` when you need a custom callback path or remote

260Devbox ingress URL. Newly added pre-registered clients use that URL unchanged

261when their provider supports issuer identification. Otherwise, they use the

262configured URL with the server-specific callback ID appended. Always register

263the exact callback displayed by `codex mcp add`.

264 

265For portless `http://127.0.0.1` callbacks, Codex omits the listener port from

266the URL it displays and stores, then inserts the active listener port during

267authorization. This substitution doesn't apply to `localhost`, IPv6 hosts,

268HTTPS URLs, or callbacks that already include a port. Authorization servers

269must accept variable loopback ports under

270[RFC 8252, Section 7.3](https://www.rfc-editor.org/rfc/rfc8252#section-7.3).

271 

272Set `mcp_oauth_callback_port` to choose a fixed global listener port, or set

273`mcp_servers.<server-name>.oauth.callback_port` to override it for one server.

274An explicit port in the callback URL doesn't configure the listener. For a

275direct loopback callback, use portless `http://127.0.0.1` or configure the same

276explicit port for both the callback URL and listener. A proxied callback can

277intentionally use an external URL port that differs from the local listener

278port. Local callback URLs bind to the local interface; non-local callback URLs

279bind to `0.0.0.0`.

280 

281Codex validates any returned `iss` before exchanging the authorization code. A

282mismatched `iss` always rejects the response. When issuer support is advertised,

283a missing `iss` also rejects it. Neither failure exchanges the code or falls

284back to another callback. A malformed callback URL or issuer support advertised

285without a metadata issuer also remains a hard failure. See

286[Authenticate users](https://developers.openai.com/plugins/build/auth).

190 287 

191If the MCP server advertises `scopes_supported`, Codex prefers those288If the MCP server advertises `scopes_supported`, Codex prefers those

192server-advertised scopes during OAuth login. Otherwise, Codex falls back to the289server-advertised scopes during OAuth login. Otherwise, Codex falls back to the

193scopes configured in `config.toml`.290scopes configured in `config.toml`.

194 291 

292#### OAuth client registration

293 

294Codex supports [OAuth Client ID Metadata Documents (CIMD)](https://datatracker.ietf.org/doc/draft-ietf-oauth-client-id-metadata-document/)

295and Dynamic Client Registration (DCR). By default, Codex automatically chooses

296CIMD when the authorization server advertises

297`client_id_metadata_document_supported: true`, includes `none` in

298`token_endpoint_auth_methods_supported`, and the callback uses a supported

299loopback URL. Otherwise, Codex uses DCR when available. A configured OAuth client

300ID always takes precedence and skips client registration.

301 

302For CIMD, Codex uses a ChatGPT-hosted metadata document specific to the MCP

303server:

304 

305```text

306https://chatgpt.com/oauth/codex/<callback_id>/client.json

307```

308 

309Codex derives `<callback_id>` from the MCP server URL and includes it in the

310loopback redirect URI, such as

311`http://127.0.0.1:<port>/callback/<callback_id>`. The metadata document registers

312the matching loopback URI without a port. Authorization servers must accept the

313port selected at login while matching the host and path exactly, as required by

314[RFC 8252](https://www.rfc-editor.org/rfc/rfc8252.html#section-7.3). Custom

315callback hosts, paths, or query parameters require DCR or a configured OAuth

316client ID.

317 

318Support for a stable, shared CIMD document is in development and coming soon:

319 

320```text

321https://chatgpt.com/oauth/codex/client.json

322```

323 

324Codex will use the stable document with the shared `/callback` path when the

325authorization server advertises

326`authorization_response_iss_parameter_supported: true`, provides a valid

327`issuer` in its metadata, and includes a matching `iss` in authorization

328responses. Servers without issuer-bound responses will continue using the

329callback-specific document.

330 

331To choose a registration method for one CLI login, use

332`--oauth-client-registration`:

333 

334```bash

335codex mcp login <server-name> --oauth-client-registration cimd

336codex mcp login <server-name> --oauth-client-registration dcr

337```

338 

339The default is `auto`. Registration choices apply only to the current login and

340aren't stored in `config.toml`.

341 

195#### config.toml examples342#### config.toml examples

196 343 

197```toml344```toml


229 376 

230[mcp_servers.chrome_devtools.tools.open]377[mcp_servers.chrome_devtools.tools.open]

231approval_mode = "approve"378approval_mode = "approve"

379output_token_limit = 30000

232```380```

233 381 

234### Plugin-provided MCP servers382### Plugin-provided MCP servers


248approval_mode = "approve"396approval_mode = "approve"

249```397```

250 398 

399Plugin-provided HTTP MCP servers can also declare OAuth settings in `.mcp.json`.

400Plugin manifests use the camelCase field names `clientId`, `callbackUrl`, and

401`callbackPort`:

402 

403```json

404{

405 "mcpServers": {

406 "sample": {

407 "type": "http",

408 "url": "https://mcp.example.com/mcp",

409 "oauth": {

410 "clientId": "my-pre-registered-client",

411 "callbackUrl": "http://127.0.0.1/callback/registered"

412 }

413 }

414 }

415}

416```

417 

418Plugin-provided MCP servers follow the same callback-selection rules as other

419MCP servers. If a plugin provides a `clientId`, its provider doesn't support

420issuer-bound callbacks, and `callbackUrl` lacks the server-specific callback

421ID, Codex ignores that URL for the login and uses `mcp_oauth_callback_url`, or

422`http://127.0.0.1/callback` when unset, with the callback ID appended. The

423configured `callbackUrl` remains unchanged.

424 

425A plugin's `oauth.callbackPort` overrides the global

426`mcp_oauth_callback_port`; if neither is set, Codex chooses an ephemeral port.

427The port embedded in `callbackUrl` doesn't select the listener port. For a

428direct loopback callback with a fixed port, configure both values to match:

429 

430```json

431{

432 "callbackUrl": "http://127.0.0.1:4321/callback/registered",

433 "callbackPort": 4321

434}

435```

436 

437For remote ingress or another proxy, the callback URL port and local listener

438port can intentionally differ when the proxy forwards to the configured

439listener.

440 

251## Examples of useful MCP servers441## Examples of useful MCP servers

252 442 

253The list of MCP servers keeps growing. Here are a few common ones:443The list of MCP servers keeps growing. Here are a few common ones:

Details

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5Record & Replay is available on macOS. Initial availability excludes the5Record & Replay is available on macOS. Computer Use must also be available and

6 European Economic Area, the United Kingdom, and Switzerland. Computer Use must6 enabled.

7 also be available and enabled.

8 7 

9Record & Replay lets you demonstrate a workflow on your8Record & Replay lets you demonstrate a workflow on your

10Mac and turn it into a reusable skill. Use it when the workflow is repetitive,9Mac and turn it into a reusable skill. Use it when the workflow is repetitive,

features.md +11 −3

Details

26 href: "/codex/projects",26 href: "/codex/projects",

27 icon: "folder",27 icon: "folder",

28 },28 },

29 {

30 title: "Codex Remote",

31 description:

32 "Start tasks, approve actions, and review work from your phone.",

33 href: "/codex/remote",

34 icon: "connect",

35 },

29 {36 {

30 title: "Sites",37 title: "Sites",

31 description:38 description:


61 },68 },

62 {69 {

63 title: "Pets",70 title: "Pets",

64 description: "Choose an animated companion and follow chat activity.",71 description: "Choose a companion, start chats, and follow activity.",

65 href: "/codex/pets",72 href: "/codex/pets",

66 icon: "customize",73 icon: "customize",

67 },74 },


133 icon: "workspace",140 icon: "workspace",

134 },141 },

135 {142 {

136 title: "Chrome extension",143 title: "Browser extension",

137 description: "Share browser context with ChatGPT from Chrome.",144 description:

145 "Use Chrome, Edge, Brave, Opera, or Vivaldi with ChatGPT.",

138 href: "/codex/chrome-extension",146 href: "/codex/chrome-extension",

139 icon: "connect",147 icon: "connect",

140 },148 },

mcp-server.md +17 −404

Details

1# Use Codex with the Agents SDK1# Codex MCP server removal

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5# Running Codex as an MCP server5The `codex mcp-server` command and the standalone `codex-mcp-server` binary have

6been removed. Integrations that launch either command must migrate before

7upgrading Codex. The previous MCP tool reference and Agents SDK examples on this

8page are no longer supported.

6 9 

7You can run Codex as an MCP server and connect it from other MCP clients (for example, an agent built with the [OpenAI Agents SDK MCP integration](https://developers.openai.com/api/docs/guides/agents/integrations-observability#mcp)).10## Use the Codex app server

8 11 

9To start Codex as an MCP server, you can use the following command:12Use the [Codex app server](https://learn.chatgpt.com/docs/app-server) for integrations that need

13authentication, conversation history, approvals, and streamed agent events.

10 14 

11```bash15The app server uses its own [JSON-RPC protocol](https://learn.chatgpt.com/docs/app-server#protocol). It

12codex mcp-server16isn't an MCP server or a drop-in replacement for an MCP client: update your

13```17integration to use the app-server protocol instead of MCP tool calls.

18The app-server command is experimental and isn't supported for production

19workloads.

14 20 

15You can launch a Codex MCP server with the [Model Context Protocol Inspector](https://modelcontextprotocol.io/legacy/tools/inspector):21## Connect Codex to MCP tools

16 22 

17```bash23Codex continues to support [external MCP servers](https://learn.chatgpt.com/docs/extend/mcp).

18npx @modelcontextprotocol/inspector codex mcp-server24Use `codex mcp` to manage those connections. The removal affects hosting Codex

19```25as an MCP server.

20 

21Send a `tools/list` request to see two tools:

22 

23**`codex`**: Run a Codex session with the following prompt and configuration overrides:

24 

25| Property | Type | Description |

26| ------------------------ | -------- | -------------------------------------------------------------------------------------------------------- |

27| **`prompt`** (required) | `string` | The initial user prompt to start the Codex conversation. |

28| `approval-policy` | `string` | Approval policy for shell commands generated by the model: `untrusted`, `on-request`, and `never`. |

29| `base-instructions` | `string` | The set of instructions to use instead of the default ones. |

30| `compact-prompt` | `string` | Prompt used when compacting the conversation. |

31| `config` | `object` | Individual configuration settings that override what's in `$CODEX_HOME/config.toml`. |

32| `cwd` | `string` | Working directory for the session. If relative, resolved against the server process's current directory. |

33| `developer-instructions` | `string` | Developer instructions injected as a developer-role message. |

34| `model` | `string` | Optional override for the model name (for example, `gpt-5.6-terra`). |

35| `sandbox` | `string` | Sandbox mode: `read-only`, `workspace-write`, or `danger-full-access`. |

36 

37**`codex-reply`**: Continue a Codex session by providing the thread ID and prompt. The `codex-reply` tool takes these properties:

38 

39| Property | Type | Description |

40| ----------------------------- | ------ | --------------------------------------------------------- |

41| **`prompt`** (required) | string | The next user prompt to continue the Codex conversation. |

42| **`threadId`** (required) | string | The ID of the thread to continue. |

43| `conversationId` (deprecated) | string | Deprecated alias for `threadId` (kept for compatibility). |

44 

45Use the `threadId` from `structuredContent.threadId` in the `tools/call` response. Approval prompts (exec/patch) also include `threadId` in their `params` payload.

46 

47Example response payload:

48 

49```json

50{

51 "structuredContent": {

52 "threadId": "019bbb20-bff6-7130-83aa-bf45ab33250e",

53 "content": "`ls -lah` (or `ls -alh`) — long listing, includes dotfiles, human-readable sizes."

54 },

55 "content": [

56 {

57 "type": "text",

58 "text": "`ls -lah` (or `ls -alh`) — long listing, includes dotfiles, human-readable sizes."

59 }

60 ]

61}

62```

63 

64Note modern MCP clients generally report only `"structuredContent"` as the result of a tool call, if present, though the Codex MCP server also returns `"content"` for the benefit of older MCP clients.

65 

66# Creating multi-agent workflows

67 

68Codex CLI can do far more than run ad-hoc tasks. By exposing the CLI as a [Model Context Protocol](https://modelcontextprotocol.io/) (MCP) server and orchestrating it with the OpenAI Agents SDK, you can create deterministic, reviewable workflows that scale from a single agent to a complete software delivery pipeline.

69 

70This guide walks through the same workflow showcased in the [OpenAI Cookbook](https://github.com/openai/openai-cookbook/blob/main/examples/codex/codex_mcp_agents_sdk/building_consistent_workflows_codex_cli_agents_sdk.ipynb). You will:

71 

72- launch Codex CLI as a long-running MCP server,

73- build a focused single-agent workflow that produces a playable browser game, and

74- orchestrate a multi-agent team with hand-offs, guardrails, and full traces you can review afterwards.

75 

76Before starting, make sure you have:

77 

78- [Codex CLI](https://learn.chatgpt.com/docs/codex/cli) installed locally so the `codex` command is available.

79- Python 3.10+ with `pip`.

80- Node.js 18+ if you want to run the MCP Inspector example above.

81- An OpenAI API key stored locally. You can create or manage keys in the [OpenAI dashboard](https://platform.openai.com/account/api-keys).

82 

83Create a working directory for the guide and add your API key to a `.env` file:

84 

85```bash

86mkdir codex-workflows

87cd codex-workflows

88printf "OPENAI_API_KEY=sk-..." > .env

89```

90 

91## Install dependencies

92 

93The Agents SDK handles orchestration across Codex, hand-offs, and traces. Install the latest SDK packages:

94 

95```bash

96python -m venv .venv

97source .venv/bin/activate

98pip install --upgrade openai openai-agents python-dotenv

99```

100 

101Activating a virtual environment keeps the SDK dependencies isolated from the

102 rest of your system.

103 

104## Initialize Codex CLI as an MCP server

105 

106Start by turning Codex CLI into an MCP server that the Agents SDK can call. The server exposes two tools (`codex()` to start a conversation and `codex-reply()` to continue one) and keeps Codex alive across multiple agent turns.

107 

108Create a file called `codex_mcp.py` and add the following:

109 

110```python

111import asyncio

112 

113from agents import Agent, Runner

114from agents.mcp import MCPServerStdio

115 

116 

117async def main() -> None:

118 async with MCPServerStdio(

119 name="Codex CLI",

120 params={

121 "command": "codex",

122 "args": ["mcp-server"],

123 },

124 client_session_timeout_seconds=360000,

125 ) as codex_mcp_server:

126 print("Codex MCP server started.")

127 # More logic coming in the next sections.

128 return

129 

130 

131if __name__ == "__main__":

132 asyncio.run(main())

133```

134 

135Run the script once to verify that Codex launches successfully:

136 

137```bash

138python codex_mcp.py

139```

140 

141The script exits after printing `Codex MCP server started.`. In the next sections you will reuse the same MCP server inside richer workflows.

142 

143## Build a single-agent workflow

144 

145Let’s start with a scoped example that uses Codex MCP to ship a small browser game. The workflow relies on two agents:

146 

1471. **Game Designer**: writes a brief for the game.

1482. **Game Developer**: implements the game by calling Codex MCP.

149 

150Update `codex_mcp.py` with the following code. It keeps the MCP server setup from above and adds both agents.

151 

152```python

153import asyncio

154import os

155 

156from dotenv import load_dotenv

157 

158from agents import Agent, Runner, set_default_openai_api

159from agents.mcp import MCPServerStdio

160 

161load_dotenv(override=True)

162set_default_openai_api(os.getenv("OPENAI_API_KEY"))

163 

164 

165async def main() -> None:

166 async with MCPServerStdio(

167 name="Codex CLI",

168 params={

169 "command": "codex",

170 "args": ["mcp-server"],

171 },

172 client_session_timeout_seconds=360000,

173 ) as codex_mcp_server:

174 developer_agent = Agent(

175 name="Game Developer",

176 instructions=(

177 "You are an expert in building simple games using basic html + css + javascript with no dependencies. "

178 "Save your work in a file called index.html in the current directory. "

179 "Always call codex with \"approval-policy\": \"never\" and \"sandbox\": \"workspace-write\"."

180 ),

181 mcp_servers=[codex_mcp_server],

182 )

183 

184 designer_agent = Agent(

185 name="Game Designer",

186 instructions=(

187 "You are an indie game connoisseur. Come up with an idea for a single page html + css + javascript game that a developer could build in about 50 lines of code. "

188 "Format your request as a 3 sentence design brief for a game developer and call the Game Developer coder with your idea."

189 ),

190 model="gpt-5",

191 handoffs=[developer_agent],

192 )

193 

194 await Runner.run(designer_agent, "Implement a fun new game!")

195 

196 

197if __name__ == "__main__":

198 asyncio.run(main())

199```

200 

201Execute the script:

202 

203```bash

204python codex_mcp.py

205```

206 

207Codex will read the designer's brief, create an `index.html` file, and write the full game to disk. Open the generated file in a browser to play the result. Every run produces a different design with unique play-style twists and polish.

208 

209## Expand to a multi-agent workflow

210 

211Now turn the single-agent setup into an orchestrated, traceable workflow. The system adds:

212 

213- **Project Manager**: creates shared requirements, coordinates hand-offs, and enforces guardrails.

214- **Designer**, **Frontend Developer**, **Server Developer**, and **Tester**: each with scoped instructions and output folders.

215 

216Create a new file called `multi_agent_workflow.py`:

217 

218```python

219import asyncio

220import os

221 

222from dotenv import load_dotenv

223 

224from agents import (

225 Agent,

226 ModelSettings,

227 Runner,

228 WebSearchTool,

229 set_default_openai_api,

230)

231from agents.extensions.handoff_prompt import RECOMMENDED_PROMPT_PREFIX

232from agents.mcp import MCPServerStdio

233from openai.types.shared import Reasoning

234 

235load_dotenv(override=True)

236set_default_openai_api(os.getenv("OPENAI_API_KEY"))

237 

238 

239async def main() -> None:

240 async with MCPServerStdio(

241 name="Codex CLI",

242 params={"command": "codex", "args": ["mcp-server"]},

243 client_session_timeout_seconds=360000,

244 ) as codex_mcp_server:

245 designer_agent = Agent(

246 name="Designer",

247 instructions=(

248 f"""{RECOMMENDED_PROMPT_PREFIX}"""

249 "You are the Designer.\n"

250 "Your only source of truth is AGENT_TASKS.md and REQUIREMENTS.md from the Project Manager.\n"

251 "Do not assume anything that is not written there.\n\n"

252 "You may use the internet for additional guidance or research."

253 "Deliverables (write to /design):\n"

254 "- design_spec.md – a single page describing the UI/UX layout, main screens, and key visual notes as requested in AGENT_TASKS.md.\n"

255 "- wireframe.md – a simple text or ASCII wireframe if specified.\n\n"

256 "Keep the output short and implementation-friendly.\n"

257 "When complete, handoff to the Project Manager with transfer_to_project_manager."

258 "When creating files, call Codex MCP with {\"approval-policy\":\"never\",\"sandbox\":\"workspace-write\"}."

259 ),

260 model="gpt-5",

261 tools=[WebSearchTool()],

262 mcp_servers=[codex_mcp_server],

263 )

264 

265 frontend_developer_agent = Agent(

266 name="Frontend Developer",

267 instructions=(

268 f"""{RECOMMENDED_PROMPT_PREFIX}"""

269 "You are the Frontend Developer.\n"

270 "Read AGENT_TASKS.md and design_spec.md. Implement exactly what is described there.\n\n"

271 "Deliverables (write to /frontend):\n"

272 "- index.html – main page structure\n"

273 "- styles.css or inline styles if specified\n"

274 "- main.js or game.js if specified\n\n"

275 "Follow the Designer’s DOM structure and any integration points given by the Project Manager.\n"

276 "Do not add features or branding beyond the provided documents.\n\n"

277 "When complete, handoff to the Project Manager with transfer_to_project_manager_agent."

278 "When creating files, call Codex MCP with {\"approval-policy\":\"never\",\"sandbox\":\"workspace-write\"}."

279 ),

280 model="gpt-5",

281 mcp_servers=[codex_mcp_server],

282 )

283 

284 backend_developer_agent = Agent(

285 name="Backend Developer",

286 instructions=(

287 f"""{RECOMMENDED_PROMPT_PREFIX}"""

288 "You are the Backend Developer.\n"

289 "Read AGENT_TASKS.md and REQUIREMENTS.md. Implement the backend endpoints described there.\n\n"

290 "Deliverables (write to /backend):\n"

291 "- package.json – include a start script if requested\n"

292 "- server.js – implement the API endpoints and logic exactly as specified\n\n"

293 "Keep the code as simple and readable as possible. No external database.\n\n"

294 "When complete, handoff to the Project Manager with transfer_to_project_manager_agent."

295 "When creating files, call Codex MCP with {\"approval-policy\":\"never\",\"sandbox\":\"workspace-write\"}."

296 ),

297 model="gpt-5",

298 mcp_servers=[codex_mcp_server],

299 )

300 

301 tester_agent = Agent(

302 name="Tester",

303 instructions=(

304 f"""{RECOMMENDED_PROMPT_PREFIX}"""

305 "You are the Tester.\n"

306 "Read AGENT_TASKS.md and TEST.md. Verify that the outputs of the other roles meet the acceptance criteria.\n\n"

307 "Deliverables (write to /tests):\n"

308 "- TEST_PLAN.md – bullet list of manual checks or automated steps as requested\n"

309 "- test.sh or a simple automated script if specified\n\n"

310 "Keep it minimal and easy to run.\n\n"

311 "When complete, handoff to the Project Manager with transfer_to_project_manager."

312 "When creating files, call Codex MCP with {\"approval-policy\":\"never\",\"sandbox\":\"workspace-write\"}."

313 ),

314 model="gpt-5",

315 mcp_servers=[codex_mcp_server],

316 )

317 

318 project_manager_agent = Agent(

319 name="Project Manager",

320 instructions=(

321 f"""{RECOMMENDED_PROMPT_PREFIX}"""

322 """

323 You are the Project Manager.

324 

325 Objective:

326 Convert the input task list into three project-root files the team will execute against.

327 

328 Deliverables (write in project root):

329 - REQUIREMENTS.md: concise summary of product goals, target users, key features, and constraints.

330 - TEST.md: tasks with [Owner] tags (Designer, Frontend, Backend, Tester) and clear acceptance criteria.

331 - AGENT_TASKS.md: one section per role containing:

332 - Project name

333 - Required deliverables (exact file names and purpose)

334 - Key technical notes and constraints

335 

336 Process:

337 - Resolve ambiguities with minimal, reasonable assumptions. Be specific so each role can act without guessing.

338 - Create files using Codex MCP with {"approval-policy":"never","sandbox":"workspace-write"}.

339 - Do not create folders. Only create REQUIREMENTS.md, TEST.md, AGENT_TASKS.md.

340 

341 Handoffs (gated by required files):

342 1) After the three files above are created, hand off to the Designer with transfer_to_designer_agent and include REQUIREMENTS.md and AGENT_TASKS.md.

343 2) Wait for the Designer to produce /design/design_spec.md. Verify that file exists before proceeding.

344 3) When design_spec.md exists, hand off in parallel to both:

345 - Frontend Developer with transfer_to_frontend_developer_agent (provide design_spec.md, REQUIREMENTS.md, AGENT_TASKS.md).

346 - Backend Developer with transfer_to_backend_developer_agent (provide REQUIREMENTS.md, AGENT_TASKS.md).

347 4) Wait for Frontend to produce /frontend/index.html and Backend to produce /backend/server.js. Verify both files exist.

348 5) When both exist, hand off to the Tester with transfer_to_tester_agent and provide all prior artifacts and outputs.

349 6) Do not advance to the next handoff until the required files for that step are present. If something is missing, request the owning agent to supply it and re-check.

350 

351 PM Responsibilities:

352 - Coordinate all roles, track file completion, and enforce the above gating checks.

353 - Do NOT respond with status updates. Just handoff to the next agent until the project is complete.

354 """

355 ),

356 model="gpt-5",

357 model_settings=ModelSettings(

358 reasoning=Reasoning(effort="medium"),

359 ),

360 handoffs=[designer_agent, frontend_developer_agent, backend_developer_agent, tester_agent],

361 mcp_servers=[codex_mcp_server],

362 )

363 

364 designer_agent.handoffs = [project_manager_agent]

365 frontend_developer_agent.handoffs = [project_manager_agent]

366 backend_developer_agent.handoffs = [project_manager_agent]

367 tester_agent.handoffs = [project_manager_agent]

368 

369 task_list = """

370Goal: Build a tiny browser game to showcase a multi-agent workflow.

371 

372High-level requirements:

373- Single-screen game called "Bug Busters".

374- Player clicks a moving bug to earn points.

375- Game ends after 20 seconds and shows final score.

376- Optional: submit score to a simple backend and display a top-10 leaderboard.

377 

378Roles:

379- Designer: create a one-page UI/UX spec and basic wireframe.

380- Frontend Developer: implement the page and game logic.

381- Backend Developer: implement a minimal API (GET /health, GET/POST /scores).

382- Tester: write a quick test plan and a simple script to verify core routes.

383 

384Constraints:

385- No external database—memory storage is fine.

386- Keep everything readable for beginners; no frameworks required.

387- All outputs should be small files saved in clearly named folders.

388"""

389 

390 result = await Runner.run(project_manager_agent, task_list, max_turns=30)

391 print(result.final_output)

392 

393 

394if __name__ == "__main__":

395 asyncio.run(main())

396```

397 

398Run the script and watch the generated files:

399 

400```bash

401python multi_agent_workflow.py

402ls -R

403```

404 

405The project manager agent writes `REQUIREMENTS.md`, `TEST.md`, and `AGENT_TASKS.md`, then coordinates hand-offs across the designer, frontend, server, and tester agents. Each agent writes scoped artifacts in its own folder before handing control back to the project manager.

406 

407## Trace the workflow

408 

409Codex automatically records traces that capture every prompt, tool call, and hand-off. After the multi-agent run completes, open the [Traces dashboard](https://platform.openai.com/trace) to inspect the execution timeline.

410 

411The high-level trace highlights how the project manager verifies hand-offs before moving forward. Click into individual steps to see prompts, Codex MCP calls, files written, and execution durations. These details make it straightforward to audit every hand-off and understand how the workflow evolved turn by turn.

412These traces make it straightforward to debug workflow hiccups, audit agent behavior, and measure performance over time without requiring extra instrumentation.

Details

38 38 

39If stdin is piped and you also provide a prompt argument, Codex treats the prompt as the instruction and the piped content as additional context.39If stdin is piped and you also provide a prompt argument, Codex treats the prompt as the instruction and the piped content as additional context.

40 40 

41This makes it easy to generate input with one command and hand it directly to Codex:41This lets you generate input with one command and hand it directly to Codex:

42 42 

43```bash43```bash

44curl -s https://jsonplaceholder.typicode.com/comments \44curl -s https://jsonplaceholder.typicode.com/comments \


130 130 

131`codex exec` reuses saved CLI authentication by default. In CI, it's common to provide credentials explicitly:131`codex exec` reuses saved CLI authentication by default. In CI, it's common to provide credentials explicitly:

132 132 

133If your trusted cloud or CI runtime already receives short-lived workload

134tokens, use

135[workload identity federation](https://learn.chatgpt.com/docs/enterprise/workload-identity)

136instead of storing an OpenAI credential.

137 

133### Use API key auth138### Use API key auth

134 139 

135For GitHub Actions, use the [Codex GitHub Action](https://learn.chatgpt.com/docs/github-action) instead of installing and authenticating the CLI yourself. The action is designed to reduce API key exposure by installing Codex, starting a Responses API proxy, and running Codex with a configurable safety strategy.140For GitHub Actions, use the [Codex GitHub Action](https://learn.chatgpt.com/docs/github-action) instead of installing and authenticating the CLI yourself. The action is designed to reduce API key exposure by installing Codex, starting a Responses API proxy, and running Codex with a configurable safety strategy.

136 141 

137Do not set `OPENAI_API_KEY` or `CODEX_API_KEY` as a job-level environment variable in workflows that check out or run repository-controlled code. Build scripts, tests, dependency lifecycle hooks, or a compromised action in the same job can read those environment variables.142Do not set `OPENAI_API_KEY` or `CODEX_API_KEY` as a job-level environment variable in workflows that check out or run repository-controlled code. Build scripts, tests, dependency lifecycle hooks, or a compromised action in the same job can read those environment variables.

138 143 

139For other automation environments, set `CODEX_API_KEY` only for the single `codex exec` invocation and make sure no untrusted code runs in the same process environment.144For other automation environments, set `CODEX_API_KEY` only for the Codex

145invocation that needs it, and make sure no untrusted code runs in the same

146process environment.

140 147 

141To use a different API key for a single run, set `CODEX_API_KEY` inline:148To use a different API key for a single run, set `CODEX_API_KEY` inline:

142 149 


144CODEX_API_KEY=<api-key> codex exec --json "triage open bug reports"151CODEX_API_KEY=<api-key> codex exec --json "triage open bug reports"

145```152```

146 153 

147`CODEX_API_KEY` is only supported in `codex exec`.154You can use `CODEX_API_KEY` with `codex exec`, `codex review`, the TypeScript

155SDK, and `codex exec-server --remote`.

148 156 

149<ToggleSection title="Use ChatGPT-managed auth in CI/CD (advanced)">157<ToggleSection title="Use ChatGPT-managed auth in CI/CD (advanced)">

150Read this if you need to run CI/CD jobs with a Codex user account instead of an158Read this if you need to run CI/CD jobs with a Codex user account instead of an

prompting.md +11 −11

Details

187 187 

188## Use voice dictation188## Use voice dictation

189 189 

190In the ChatGPT desktop app, hold <kbd>Ctrl</kbd>+<kbd>M</kbd> while the composer is190In the ChatGPT desktop app, press <kbd>Ctrl+Shift+D</kbd> while the composer is

191visible, then start talking. ChatGPT transcribes your speech into the composer so191visible, then start talking. ChatGPT transcribes your speech into the composer

192you can review and edit it before sending the prompt.192so you can review and edit it before sending the prompt.

193 193 

194<CodexScreenshot194 

195 alt="Voice dictation indicator in the composer with a transcribed prompt"195

196 lightSrc="/images/codex/app/voice-dictation-light.webp"196 

197 darkSrc="/images/codex/app/voice-dictation-dark.webp"197> Illustration: Voice dictation indicator in the composer with a transcribed prompt

198 maxHeight="400px"198 

199 class="my-8"199 

200/>200 

201 201 

202<a id="threads"></a>202<a id="threads"></a>

203<a id="chats"></a>203<a id="chats"></a>

sandboxing.md +12 −6

Details

188 188 

189 189 

190 190 

191 <img src="https://developers.openai.com/images/codex/ide/approval_mode.png"191

192 alt="Codex approval mode selector in the IDE extension"192

193 class="block h-auto w-full mx-0!"193 

194 />194> Illustration: Codex approval mode selector in the IDE extension

195 

196 

197

195 198 

196 199 

197 200 


224 227 

225The common approval policies are:228The common approval policies are:

226 229 

227- `untrusted`: The agent asks before running commands that aren't in its trusted

228 set.

229- `on-request`: The agent works inside the sandbox by default and asks when it230- `on-request`: The agent works inside the sandbox by default and asks when it

230 needs to go beyond that boundary.231 needs to go beyond that boundary.

231- `never`: The agent doesn't stop for approval prompts.232- `never`: The agent doesn't stop for approval prompts.

232 233 

234Codex and ChatGPT Work no longer support `untrusted` as a selectable approval

235policy. If an existing configuration uses that value, see [Migrate from the

236retired `untrusted` approval

237policy](https://learn.chatgpt.com/docs/agent-approvals-security#migrate-from-the-retired-untrusted-approval-policy).

238 

233When approvals are interactive, you can also choose who reviews them with239When approvals are interactive, you can also choose who reviews them with

234`approvals_reviewer`:240`approvals_reviewer`:

235 241 

Details

12 still surfaces the relevant prompt category. With `approval_policy = "never"`,12 still surfaces the relevant prompt category. With `approval_policy = "never"`,

13 there is nothing to review.13 there is nothing to review.

14 14 

15In the ChatGPT desktop app, selecting an approved Daybreak model

16automatically switches the permissions control to **Approve for me** when that

17mode is available for your account and allowed by organization policy. This

18also applies when you use the desktop app's `/model` command. If that mode

19isn't available, the current permission mode stays unchanged. Model selection

20never overrides managed organization requirements.

21 

22Before enabling **Full Access** for an approved security model, the

23ChatGPT desktop app shows a model-specific warning about dangerous actions. The

24warning recommends **Approve for me** instead and links to

25[reviewer-policy configuration](#configuration). The warning doesn't restore

26the sandbox boundary or override organization policy.

27 

15## How auto-review works28## How auto-review works

16 29 

17At a high level, the flow is:30At a high level, the flow is:


133To customize the policy, copy the whole default policy wording first, then146To customize the policy, copy the whole default policy wording first, then

134iterate based on your individual risk profile.147iterate based on your individual risk profile.

135 148 

149## Configure an authorized cybersecurity engagement

150 

151For authorized security work, combine automatic review with a written

152engagement scope and a least-privilege [permission profile](https://learn.chatgpt.com/docs/permissions).

153Use an approved lab target, document the actions and engagement window, and

154keep production systems, unrelated hosts, credentials, and persistent changes

155out of scope unless explicitly authorized.

156 

157Both `[auto_review].policy` and `guardian_policy_config` replace your current

158reviewer policy. They don't merge with policies bundled with your model or

159managed by your organization. The built-in review instructions and response

160format still apply. Before using either example, copy the complete current

161policy, keep every existing rule, and add the rules for your approved work.

162Replace the uppercase placeholder with that complete policy. If you can't

163access the current policy, don't override it.

164 

165The following local `config.toml` template enables review and adds scoped

166conditions after the existing reviewer policy:

167 

168```toml

169approval_policy = "on-request"

170approvals_reviewer = "auto_review"

171default_permissions = ":workspace"

172 

173[auto_review]

174policy = """

175PASTE THE COMPLETE ACTIVE REVIEWER POLICY HERE BEFORE USING THIS EXAMPLE.

176 

177## Environment Profile

178- Authorized target: lab.example.com.

179- Approved actions: inspect the target, reproduce authorized vulnerabilities,

180 and validate fixes within the documented engagement window.

181 

182## Tenant Risk Taxonomy and Allow/Deny Rules

183- Allow only actions against the approved target that match the documented

184 engagement scope and approved actions.

185- Deny out-of-scope or unknown hosts, production access, credential theft,

186 persistence, data exfiltration, destructive operations, and policy bypass.

187- Deny ambiguous actions and high-impact changes until a human explicitly

188 approves the exact target, action, and side effects.

189"""

190```

191 

192Replace the example target and allowed actions with the actual approved scope.

193Enforce target restrictions with independent filesystem and network rules;

194reviewer instructions don't replace those boundaries.

195 

196Organizations can enforce the same conditions in managed `requirements.toml`:

197 

198```toml

199allowed_approval_policies = ["on-request"]

200allowed_approvals_reviewers = ["auto_review"]

201allowed_sandbox_modes = ["read-only", "workspace-write"]

202default_permissions = ":workspace"

203 

204guardian_policy_config = """

205PASTE THE COMPLETE ACTIVE REVIEWER POLICY HERE BEFORE USING THIS EXAMPLE.

206 

207## Environment Profile

208- Authorized target: lab.example.com.

209 

210## Tenant Risk Taxonomy and Allow/Deny Rules

211- Allow only approved actions against the documented engagement target.

212- Deny out-of-scope hosts, production access, credential theft, persistence,

213 data exfiltration, destructive operations, and attempts to bypass policy.

214- Deny ambiguous or high-impact actions until a human explicitly approves the

215 exact target, action, and side effects.

216"""

217 

218[allowed_permission_profiles]

219":read-only" = true

220":workspace" = true

221# ":danger-full-access" is omitted, so it is denied.

222```

223 

224`allowed_permission_profiles` controls current permission profiles.

225`allowed_sandbox_modes` also prevents full access in deployments that still use

226legacy `sandbox_mode`.

227 

228Managed `guardian_policy_config` takes precedence over a user's local

229`[auto_review].policy`. Keep `approval_policy = "on-request"` or another

230eligible interactive approval policy and keep an enforceable sandbox boundary.

231With `approval_policy = "never"`, `:danger-full-access`, or `--yolo`, an action

232can avoid creating the boundary-crossing approval request that review requires.

233 

234A network destination on the allowlist doesn't trigger review by itself. Add

235explicit [command rules](https://learn.chatgpt.com/docs/agent-configuration/rules) with

236`decision = "prompt"`, or configure sensitive MCP tools to require approval,

237when actions inside the sandbox must still reach the reviewer.

238 

239See [Models and Trusted Access](https://learn.chatgpt.com/docs/cyber-safety) and [recommended

240configuration](https://learn.chatgpt.com/docs/cyber-safety/recommended-configuration) for model access,

241engagement setup, and custom agent workflows. See [Managed configuration](https://learn.chatgpt.com/docs/enterprise/managed-configuration#configure-automatic-review-policy)

242for enterprise precedence and supported client versions. For custom API or

243Agents SDK harnesses, use [Guardrails and human review](https://developers.openai.com/api/docs/guides/agents/guardrails-approvals#review-cybersecurity-actions-before-execution).

244 

136## Reduce review volume without weakening security245## Reduce review volume without weakening security

137 246 

138Auto-review works best when the sandbox already covers your common safe247Auto-review works best when the sandbox already covers your common safe

Details

1# Codex code review in GitHub1# Review GitHub pull requests with Codex

2 2 

3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.3> For the complete documentation index, see [llms.txt](https://learn.chatgpt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to the page URL.

4 4 

5Use Codex code review to get another high-signal review pass on GitHub pull5Use Codex code review to get another high-signal review pass on GitHub pull

6requests. Codex reviews the pull request diff, follows your repository guidance,6requests. Codex reviews the pull request diff, follows your repository guidance,

7and posts a standard GitHub code review focused on serious issues.7and posts a standard GitHub code review focused on serious issues. Security

8Review, available in research preview, provides a more in-depth review of

9potential security issues in a pull request.

10 

11 

12 

13[Watch: Codex code review walkthrough](https://www.youtube.com/watch?v=HwbSWVg5Ln4)

8 14 

9<YouTubeEmbed

10 title="Codex code review walkthrough"

11 videoId="HwbSWVg5Ln4"

12 class="max-w-md mr-auto"

13/>

14 15 

15 16 

16 17 


24 25 

25## Set up Codex code review26## Set up Codex code review

26 27 

28To configure automatic reviews, you need a connected GitHub repository and

29GitHub push or admin permission for its settings.

30 

271. Set up [Codex cloud](https://learn.chatgpt.com/docs/cloud).311. Set up [Codex cloud](https://learn.chatgpt.com/docs/cloud).

282. Go to [Codex settings](https://chatgpt.com/codex/settings/code-review).322. Go to [Codex settings](https://chatgpt.com/codex/settings/code-review).

293. Turn on **Code review** for your repository.333. Turn on **Code review** for your repository.

30 34 

31 35 

32 36 

33 <img src="https://developers.openai.com/images/codex/code-review/code-review-settings.png"37

34 alt="Codex settings showing the Code review toggle"38

35 class="block h-auto w-full mx-0!"39 

36 />40> Illustration: Codex settings showing the Code review toggle

41 

42 

43

37 44 

38 45 

39 46 


46 53 

47 54 

48 55 

49 <img src="https://developers.openai.com/images/codex/code-review/review-trigger.png"56

50 alt="A pull request comment with @codex review"57

51 class="block h-auto w-full mx-0!"58 

52 />59> Illustration: A pull request comment with @codex review

60 

61 

62

53 63 

54 64 

55 65 


61 71 

62 72 

63 73 

64 <img src="https://developers.openai.com/images/codex/code-review/review-example.png"74

65 alt="Example Codex code review on a pull request"75

66 class="block h-auto w-full mx-0!"76 

67 />77> Illustration: Example Codex code review on a pull request

78 

79 

80

68 81 

69 82 

70 83 


122 135 

123For a one-off focus, add it to your pull request comment:136For a one-off focus, add it to your pull request comment:

124 137 

125`@codex review for security regressions`138`@codex review for issues in the database migration`

139 

140## Security Review

141 

142Security Review is an additional review for customers that want to

143pay particular attention to security issues in pull requests. It goes deeper

144than Code Review on security-specific risks by analyzing the pull request diff,

145supporting repository context, and configured threat models or security

146guidance.

147 

148Code Review can also identify security-related issues as part of its general

149review, so you may see occasional overlap between Code Review and Security

150Review findings.

151 

152### Set up Security Review

153 

154For more detailed setup instructions and configuration options, see [Security

155Review](https://learn.chatgpt.com/docs/security/security-review).

156 

1571. Set up [Codex cloud](https://learn.chatgpt.com/docs/cloud).

1582. Go to [Codex settings](https://chatgpt.com/codex/settings/code-review).

1593. Under **Repository preferences**, choose which pull requests get Security

160 Review and when it runs. Select **Whenever code review runs** to run it

161 alongside Code Review.

162 

163### Request a Security Review

164 

165To request a Security Review manually, add this comment to a pull request:

166 

167`@codex security review`

168 

169Codex reacts while the review is running, then posts security findings directly

170on the pull request. Open the associated Codex task and select the **Security

171Report** tab to view the full report.

126 172 

127## Act on review findings173## Act on review findings

128 174 

Details

24 24 

25 25 

26 26 

27 <img src="https://developers.openai.com/images/codex/integrations/linear-assign-codex-light.webp"27

28 alt="Assigning Codex to a Linear issue (light mode)"28

29 class="block h-auto w-full rounded-lg border border-default my-0 dark:hidden"29 

30 />30> Illustration: Assigning Codex to a Linear issue

31 <img src="https://developers.openai.com/images/codex/integrations/linear-assign-codex-dark.webp"31 

32 alt="Assigning Codex to a Linear issue (dark mode)"32 

33 class="hidden h-auto w-full rounded-lg border border-default my-0 dark:block"33

34 />

35 34 

36 35 

37 36 


41 40 

42 41 

43 42 

44 <img src="https://developers.openai.com/images/codex/integrations/linear-comment-light.webp"43

45 alt="Mentioning Codex in a Linear issue comment (light mode)"44

46 class="block h-auto w-full rounded-lg border border-default my-0 dark:hidden"45 

47 />46> Illustration: Mentioning Codex in a Linear issue comment

48 <img src="https://developers.openai.com/images/codex/integrations/linear-comment-dark.webp"47 

49 alt="Mentioning Codex in a Linear issue comment (dark mode)"48 

50 class="hidden h-auto w-full rounded-lg border border-default my-0 dark:block"49

51 />

52 50 

53 51 

54 52 


82 80 

83 81 

84 82 

85 <img src="https://developers.openai.com/images/codex/integrations/linear-triage-rule-light.webp"83

86 alt='Screenshot of an example triage rule assigning everything to Codex and labeling it in the "Triage" status (light mode)'84

87 class="block h-auto w-full rounded-lg border border-default my-0 dark:hidden"85 

88 />86> Illustration: Linear triage rule automatically assigning issues to Codex

89 <img src="https://developers.openai.com/images/codex/integrations/linear-triage-rule-dark.webp"87 

90 alt='Screenshot of an example triage rule assigning everything to Codex and labeling it in the "Triage" status (dark mode)'88 

91 class="hidden h-auto w-full rounded-lg border border-default my-0 dark:block"89

92 />

93 90 

94 91 

95 92 

Details

6 6 

7 7 

8 8 

9 <img src="https://developers.openai.com/images/codex/integrations/slack-example.png"9

10 alt="Codex Slack integration in action"10

11 class="block h-auto w-full mx-0!"11 

12 />12> Illustration: Codex Slack integration in action

13 

14 

15

13 16 

14 17 

15 18 

Details

13requiring WSL or a virtual machine. This keeps Codex in Windows-native13requiring WSL or a virtual machine. This keeps Codex in Windows-native

14workflows while enforcing bounded filesystem and network permissions.14workflows while enforcing bounded filesystem and network permissions.

15 15 

16<CodexScreenshot16 

17 alt="ChatGPT desktop app Windows sandbox setup prompt above the message composer"17

18 lightSrc="/images/codex/windows/windows-sandbox-setup.webp"18 

19 darkSrc="/images/codex/windows/windows-sandbox-setup.webp"19> Illustration: ChatGPT desktop app Windows sandbox setup prompt above the message composer

20 maxHeight="400px"20 

21 class="my-8"21 

22/>22 

23 23 

24 24 

25 25 


140Windows support issues come from sandbox setup, logon rights, or filesystem140Windows support issues come from sandbox setup, logon rights, or filesystem

141permissions rather than from the editor itself.141permissions rather than from the editor itself.

142 142 

143My native sandbox setup failed143 

144 

145### My native sandbox setup failed

146 

144 147 

145If Codex cannot complete the `elevated` sandbox setup, the most common causes148If Codex cannot complete the `elevated` sandbox setup, the most common causes

146are:149are:


1613. If the default setup still fails, use the `unelevated` sandbox so you can1643. If the default setup still fails, use the `unelevated` sandbox so you can

162 continue working while the issue is investigated.165 continue working while the issue is investigated.

163 166 

164Codex switched me to the unelevated sandbox167 

168 

169 

170 

171 

172 

173### Codex switched me to the unelevated sandbox

174 

165 175 

166This means Codex could not finish the stronger `elevated` sandbox setup on your176This means Codex could not finish the stronger `elevated` sandbox setup on your

167machine.177machine.


176If you are on a managed enterprise laptop, the best long-term fix is usually to186If you are on a managed enterprise laptop, the best long-term fix is usually to

177get the `elevated` sandbox working with help from your IT team.187get the `elevated` sandbox working with help from your IT team.

178 188 

179I see Windows error 1385189 

190 

191 

192 

193 

194 

195### I see Windows error 1385

196 

180 197 

181If sandboxed commands fail with error `1385`, Windows is denying the logon type198If sandboxed commands fail with error `1385`, Windows is denying the logon type

182the sandbox user needs in order to start the command.199the sandbox user needs in order to start the command.


1964. Send `CODEX_HOME/.sandbox/sandbox.log` along with your Windows version and a2134. Send `CODEX_HOME/.sandbox/sandbox.log` along with your Windows version and a

197 short description of the failure.214 short description of the failure.

198 215 

199Codex warns that some folders are writable by Everyone216 

217 

218 

219 

220 

221 

222### Codex warns that some folders are writable by Everyone

223 

200 224 

201Codex may warn that some folders are writable by `Everyone`.225Codex may warn that some folders are writable by `Everyone`.

202 226 


213 237 

214If you are not sure how to change those permissions, ask your IT team for help.238If you are not sure how to change those permissions, ask your IT team for help.

215 239 

216Sandboxed commands cannot reach the network240 

241 

242 

243 

244 

245 

246### Sandboxed commands cannot reach the network

247 

217 248 

218Some Codex chats are intentionally run without outbound network access,249Some Codex chats are intentionally run without outbound network access,

219depending on the permissions mode in use.250depending on the permissions mode in use.


2253. If the issue keeps happening, collect the sandbox log so the team can check2563. If the issue keeps happening, collect the sandbox log so the team can check

226 whether the machine is in a partial or broken sandbox state.257 whether the machine is in a partial or broken sandbox state.

227 258 

228Sandboxing worked before and then stopped259 

260 

261 

262 

263 

264 

265### Sandboxing worked before and then stopped

266 

229 267 

230This can happen after:268This can happen after:

231 269 


242 fallback.280 fallback.

2434. Collect the sandbox log for review.2814. Collect the sandbox log for review.

244 282 

245I need to send diagnostics to OpenAI283 

284 

285 

286 

287 

288 

289### I need to send diagnostics to OpenAI

290 

246 291 

247If you still have problems, send:292If you still have problems, send:

248 293 


260 305 

261- the contents of `CODEX_HOME/.sandbox-secrets/`306- the contents of `CODEX_HOME/.sandbox-secrets/`

262 307 

263The IDE extension is installed but unresponsive308 

309 

310 

311 

312 

313 

314### The IDE extension is installed but unresponsive

315 

316 

264 317 

265Your system may be missing C++ development tools, which some native dependencies require:318Your system may be missing C++ development tools, which some native dependencies require:

266 319