Codex with ChatGPT: Read-only MCP connection for design and review in web ChatGPT

The unofficial community project Codex with ChatGPT, unrelated to OpenAI, has been released. This tool adopts a structure where design and review are handled by a web ChatGPT Plus/Pro subscription, while execution is delegated to the Codex harness, to solve the problem of coding agent usage being exhausted during planning and review stages.

Core Structure and Security

ChatGPT reads only the necessary files directly without uploading the entire repository via an OAuth-protected read-only MCP (Model Context Protocol) connection. Permissions for file modification, command execution, commits, etc., are exclusively held by the local Codex, and such tools do not exist on the server at all, making it impossible to induce dangerous actions through prompt injection or permission misconfiguration.

Separation of Control and Data Planes

The system is separated into a Control Plane and a Data Plane.

• Control Plane: Only short status messages (<1KB) ([C2C]) are exchanged between Codex and ChatGPT, without transmitting change history or execution logs.
• Data Plane: ChatGPT reflects the latest state of the current workspace through 9 read-only tools such as read_file and git_diff. When transmitting execution logs, a sanitizer operates to remove tokens, home paths, private keys, etc.

Installation and Requirements

Implemented in TypeScript, it requires Node.js 20 or higher and git. Public address generation uses cloudflared, and it can be installed without concepts of MCP/OAuth/tunnels via the c2c command-line tool and skills for Codex. However, since the local bridge is exposed externally via a Cloudflare tunnel, it may be unsuitable for organizations with strict internal network security policies.