{"_id":"@akeyless-community/codex-mcp","_rev":"2-896e22da5ec7483e0036402254ac2088","name":"@akeyless-community/codex-mcp","dist-tags":{"latest":"1.0.0"},"versions":{"0.2.0":{"name":"@akeyless-community/codex-mcp","version":"0.2.0","keywords":["akeyless","codex","openai","mcp","secrets","trusted-access","runtime"],"author":{"name":"Akeyless Community"},"license":"Apache-2.0","_id":"@akeyless-community/codex-mcp@0.2.0","maintainers":[{"name":"barak-akeyless","email":"barak.a@akeyless.io"}],"homepage":"https://github.com/akeyless-community/codex-akeyless-mcp#readme","bugs":{"url":"https://github.com/akeyless-community/codex-akeyless-mcp/issues"},"bin":{"akeyless-codex-mcp":"dist/index.js"},"dist":{"shasum":"8ee52b0c6954c9d790e4ab0cbd93f8eaa0ba9ba4","tarball":"https://registry.npmjs.org/@akeyless-community/codex-mcp/-/codex-mcp-0.2.0.tgz","fileCount":43,"integrity":"sha512-L4soNIHYElQ3wr/ALZfijjdKfQxpUs+lMKi9npIfq6XdQBvgg+DqaQA2elbifCnQvDXGhzL2wrKafoV0hjenrg==","signatures":[{"sig":"MEYCIQC+3zclDYKDb1Y/0bpU4Gml6sxzU54eFOOyfcR+y84l4AIhAJrUrmCqnwDPbBOxkKCL3iVGdJMK/nanUcASf4/jny7U","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":126681},"main":"./dist/index.js","types":"./dist/index.d.ts","engines":{"node":">=18"},"gitHead":"7c2c8e82b1bf9adc32299e14cab1e810bd9c8625","scripts":{"dev":"tsc -p tsconfig.json --watch","test":"jest","build":"tsc -p tsconfig.json","start":"node dist/index.js","prepublishOnly":"npm run build && npm test"},"_npmUser":{"name":"barak-akeyless","email":"barak.a@akeyless.io"},"repository":{"url":"git+https://github.com/akeyless-community/codex-akeyless-mcp.git","type":"git"},"_npmVersion":"10.8.2","description":"Akeyless Trusted Access Layer MCP server for OpenAI Codex — secrets injected at runtime, never exposed to the model","directories":{},"_nodeVersion":"20.20.2","dependencies":{"zod":"^3.23.8","akeyless":"^5.0.25","akeyless-cloud-id":"^1.0.0","@modelcontextprotocol/sdk":"^1.29.0"},"publishConfig":{"access":"public"},"_hasShrinkwrap":false,"devDependencies":{"jest":"^29.7.0","ts-jest":"^29.2.5","typescript":"^5.7.2","@types/jest":"^29.5.14","@types/node":"^20.17.0"},"_npmOperationalInternal":{"tmp":"tmp/codex-mcp_0.2.0_1782970946519_0.15995945992978866","host":"s3://npm-registry-packages-npm-production"}},"1.0.0":{"name":"@akeyless-community/codex-mcp","version":"1.0.0","description":"Akeyless Agentic Runtime Authority (ARA) MCP server for OpenAI Codex — secretless database and cloud access, no CLI required","license":"Apache-2.0","author":{"name":"Akeyless Community"},"repository":{"type":"git","url":"git+https://github.com/akeyless-community/codex-akeyless-mcp.git"},"homepage":"https://github.com/akeyless-community/codex-akeyless-mcp#readme","keywords":["akeyless","codex","openai","mcp","secrets","agentic-runtime-authority","runtime-authority","ara"],"engines":{"node":">=18"},"bin":{"akeyless-codex-mcp":"dist/index.js"},"main":"./dist/index.js","types":"./dist/index.d.ts","scripts":{"build":"tsc -p tsconfig.json","start":"node dist/index.js","dev":"tsc -p tsconfig.json --watch","test":"jest","prepublishOnly":"npm run build && npm test"},"publishConfig":{"access":"public"},"dependencies":{"@modelcontextprotocol/sdk":"^1.29.0","akeyless":"^5.0.25","akeyless-cloud-id":"^1.0.0","zod":"^3.23.8"},"devDependencies":{"@types/jest":"^29.5.14","@types/node":"^20.17.0","jest":"^29.7.0","ts-jest":"^29.2.5","typescript":"^5.7.2"},"_id":"@akeyless-community/codex-mcp@1.0.0","gitHead":"69aefb1ca73d4e42701222146b56c6f0193ea865","bugs":{"url":"https://github.com/akeyless-community/codex-akeyless-mcp/issues"},"_nodeVersion":"20.20.2","_npmVersion":"10.8.2","dist":{"integrity":"sha512-HptukWCC0ynsDmRW7fMyYzIQvamRJkJ6nAyQL4cj1pioVDEJpnPWvG3SDJuVjgtrCuO0LdotrmsJ+0XogfT0VA==","shasum":"27f3c2da1fccc5a6fbf1637f0201adab887fd68a","tarball":"https://registry.npmjs.org/@akeyless-community/codex-mcp/-/codex-mcp-1.0.0.tgz","fileCount":35,"unpackedSize":109200,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEYCIQCY2TKcyrFjebkKt3SCbKcw6Nc2FNRHS4jkngzbdkKxfAIhAJiZ9xz+u3r8niTqaPR+/TiMdCYK36pKdu9gHKSXJ0Mq"}]},"_npmUser":{"name":"barak-akeyless","email":"barak.a@akeyless.io"},"directories":{},"maintainers":[{"name":"barak-akeyless","email":"barak.a@akeyless.io"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/codex-mcp_1.0.0_1783930764633_0.44661190350909696"},"_hasShrinkwrap":false}},"time":{"created":"2026-07-02T05:42:26.341Z","modified":"2026-07-13T08:19:24.884Z","0.2.0":"2026-07-02T05:42:26.678Z","1.0.0":"2026-07-13T08:19:24.776Z"},"bugs":{"url":"https://github.com/akeyless-community/codex-akeyless-mcp/issues"},"author":{"name":"Akeyless Community"},"license":"Apache-2.0","homepage":"https://github.com/akeyless-community/codex-akeyless-mcp#readme","keywords":["akeyless","codex","openai","mcp","secrets","agentic-runtime-authority","runtime-authority","ara"],"repository":{"type":"git","url":"git+https://github.com/akeyless-community/codex-akeyless-mcp.git"},"description":"Akeyless Agentic Runtime Authority (ARA) MCP server for OpenAI Codex — secretless database and cloud access, no CLI required","maintainers":[{"name":"barak-akeyless","email":"barak.a@akeyless.io"}],"readme":"# Akeyless ARA MCP for OpenAI Codex\n\nSDK-based MCP server that brings [Akeyless Agentic Runtime Authority (ARA)](https://docs.akeyless.io/docs/agentic-runtime-authority) to [OpenAI Codex](https://developers.openai.com/codex/) — without installing the Akeyless CLI.\n\nThis package exposes **only** the ARA MCP tools (`list-secrets`, `query-db`, `service-execute`, `list-sub-tools`), matching `akeyless mcp-runtime-authority`. It does **not** include static-secret or environment-variable tools.\n\nCodex orchestrates. Akeyless holds the credentials. **Secret values never enter the model context.**\n\n## Install\n\n```bash\nnpm install -g @akeyless-community/codex-mcp\n```\n\nOr run without installing:\n\n```bash\nnpx -y @akeyless-community/codex-mcp\n```\n\n## Quick start\n\n### 1. Configure auth\n\nSet credentials in the MCP server process environment (not in Codex prompts):\n\n```bash\nexport AKEYLESS_ACCESS_ID=\"p-xxxxx\"\nexport AKEYLESS_ACCESS_KEY=\"your-access-key\"\nexport AKEYLESS_GATEWAY_URL=\"https://your-gateway.example.com:8000\"\nexport AKEYLESS_AGENT_ID=\"codex-agent\"\n```\n\n`AKEYLESS_GATEWAY_URL` is the only gateway setting required. The SDK API base (`/api/v2`) and ARA execution base are derived automatically — same pattern as the [Claude connector](https://github.com/akeyless-community/claude-akeyless-connector).\n\nSee [`.env.example`](.env.example) for JWT, Universal Identity, cloud IAM, and token auth.\n\n### 2. Connect Codex\n\nAdd to `~/.codex/config.toml`:\n\n```toml\n[mcp_servers.akeyless-ara]\ncommand = \"npx\"\nargs = [\"-y\", \"@akeyless-community/codex-mcp\"]\nenabled = true\ndefault_tools_approval_mode = \"prompt\"\nstartup_timeout_sec = 20\ntool_timeout_sec = 120\n\n[mcp_servers.akeyless-ara.env]\nAKEYLESS_ACCESS_ID = \"p-xxxxx\"\nAKEYLESS_ACCESS_KEY = \"your-access-key\"\nAKEYLESS_GATEWAY_URL = \"https://your-gateway.example.com:8000\"\nAKEYLESS_AGENT_ID = \"codex-agent\"\n\n[mcp_servers.akeyless-ara.tools.query-db]\napproval_mode = \"prompt\"\n\n[mcp_servers.akeyless-ara.tools.service-execute]\napproval_mode = \"prompt\"\n\n[mcp_servers.akeyless-ara.tools.list-secrets]\napproval_mode = \"auto\"\n```\n\nOr use the CLI:\n\n```bash\ncodex mcp add akeyless-ara \\\n  --env AKEYLESS_ACCESS_ID=p-xxxxx \\\n  --env AKEYLESS_ACCESS_KEY=your-key \\\n  --env AKEYLESS_GATEWAY_URL=https://your-gateway.example.com:8000 \\\n  -- npx -y @akeyless-community/codex-mcp\n```\n\nProject-scoped config: copy [`examples/.codex/config.toml`](examples/.codex/config.toml).\n\n### 3. Ask Codex\n\n> \"List my Akeyless ARA secrets.\"\n\n> \"Run `SELECT count(*) FROM users` against `/prod/db/postgres-readonly`.\"\n\n> \"Use service-execute on `/prod/aws/devops` to list S3 buckets.\"\n\n## MCP tools (ARA only)\n\n| Tool | Purpose |\n|---|---|\n| `list-secrets` | List dynamic, rotated, and custom-MCP secrets with `ara_allow_access` |\n| `query-db` | Run database queries (MySQL, PostgreSQL, MSSQL, Oracle, Snowflake, etc.) |\n| `service-execute` | Run AWS, GCP, Azure, Kubernetes, GitHub, or custom-MCP actions |\n| `list-sub-tools` | (Optional) Discover sub-tools on a service secret before `service-execute` |\n\n## Architecture\n\n```mermaid\nsequenceDiagram\n    participant Codex as OpenAI Codex\n    participant MCP as akeyless-codex-ara\n    participant API as Akeyless API\n    participant GW as Akeyless Gateway\n    participant Target as Database / Cloud\n\n    Codex->>MCP: list-secrets\n    MCP->>API: list-items (ara-only: true)\n    API-->>MCP: secret paths + target types\n    MCP-->>Codex: metadata only\n    Codex->>MCP: query-db / service-execute\n    MCP->>GW: /config/target_query\n    GW->>Target: action with JIT credentials\n    Target-->>GW: results\n    GW-->>MCP: JSON results\n    MCP-->>Codex: results (no credentials)\n```\n\n## Requirements\n\n- [Akeyless Gateway](https://docs.akeyless.io/docs/about-akeyless-gateway) with Runtime Authority and AI Insights configured\n- ARA role rules with **Allow Access** on secret paths\n- Dynamic secrets with **Agentic Runtime Authority** enabled in the Console\n\nWhen `list-secrets` returns zero results, check the `diagnostics.troubleshooting` hints in the response.\n\n## Install as a Codex plugin\n\n```bash\ncodex plugin marketplace add akeyless-community/codex-akeyless-mcp\n```\n\nThen in Codex: `/plugins` → **Akeyless Community** → install **Akeyless ARA**.\n\nSee [Marketplace guide](docs/MARKETPLACE.md).\n\n## Security model\n\n- **Secretless by design** — list tools return metadata only; execute tools use credentials server-side via the Gateway\n- **Codex approval** — set `prompt` or `approve` for `query-db` and `service-execute`\n- **Least privilege** — scope RBAC to ARA-enabled secret paths only\n- **Single gateway URL** — point `AKEYLESS_GATEWAY_URL` at your organization's gateway\n\nSee [SECURITY.md](SECURITY.md).\n\n## Development\n\n```bash\ncd codex-akeyless-integration\nnpm install\nnpm test\nnpm run build\nnpm start\n```\n\n## Related projects\n\n- [claude-akeyless-connector](https://github.com/akeyless-community/claude-akeyless-connector) — same ARA surface for Claude Desktop\n- [Akeyless ARA docs](https://docs.akeyless.io/docs/agentic-runtime-authority)\n\n## License\n\nApache-2.0\n","readmeFilename":"README.md"}