# Connect Pollaris to Codex (/docs/mcp/codex)



Codex CLI, the Codex IDE extension, and the ChatGPT desktop app share MCP configuration for the same local Codex host. Codex supports Streamable HTTP and Bearer tokens supplied through an environment variable. See the [official OpenAI MCP documentation](https://learn.chatgpt.com/docs/extend/mcp).

## Configure the key [#configure-the-key]

Set the key in the environment that starts Codex:

```bash
export POLLARIS_MCP_API_KEY='plr_mcp_v1_REPLACE_ME'
```

## Add the server [#add-the-server]

Edit `~/.codex/config.toml` for a personal connection, or `.codex/config.toml` in a trusted project:

```toml
[mcp_servers.pollaris]
url = "https://mcp.pollaris.cc/mcp"
bearer_token_env_var = "POLLARIS_MCP_API_KEY"
default_tools_approval_mode = "writes"
```

`default_tools_approval_mode = "writes"` allows read-only tools normally and asks before tools that are not marked read-only. Remove it if your Codex version or organization policy controls approvals elsewhere.

Do not put the raw token in `http_headers`. `bearer_token_env_var` keeps it out of the configuration file.

## Verify the connection [#verify-the-connection]

```bash
codex mcp list
```

Restart Codex after changing its environment or configuration. In an interactive session, use `/mcp` to inspect the connection, then ask:

```text
Use Pollaris to list the workspaces this credential can access. Do not make changes.
```

## Optional tool restrictions [#optional-tool-restrictions]

For a review-only workflow, issue a read-only Pollaris key. You can also constrain visible tools in Codex:

```toml
[mcp_servers.pollaris]
url = "https://mcp.pollaris.cc/mcp"
bearer_token_env_var = "POLLARIS_MCP_API_KEY"
enabled_tools = [
  "list_workspaces",
  "list_forms",
  "get_form_draft",
  "compile_form_dsl",
  "validate_form_definition",
]
```

Key scopes are the real server-side authorization boundary; a client-side tool allowlist is an additional convenience, not a replacement.

## Troubleshooting [#troubleshooting]

* **Environment variable missing:** Start Codex from the same environment that contains the key, then restart it.
* **Authentication or initialization failure:** Confirm the full key and URL, including `/mcp`.
* **Project config ignored:** Project-scoped configuration is loaded only for trusted projects; use the user config if appropriate.
* **OAuth prompt:** OAuth requires agent access to be enabled on the Pollaris deployment. Otherwise use `bearer_token_env_var` for an API-key draft connection.