Connect Codex and other clients

Workflow

Install and initialize SecretBridge first. The 0.3.1 native package exports a Codex plugin with secretbridge client-plugin codex <new-absolute-directory>. Install secretbridge@secretbridge-local according to your Codex CLI’s marketplace rules, then verify the client version, export layout and plugin list. Current CLI versions have a manifest-location compatibility issue; a visible plugin entry alone does not prove its MCP tools are connected.

Boundary and checks

Alternatively, run secretbridge client-config codex and merge the generated TOML fragment into your existing config.toml without replacing other services. In a new chat, actually discover read-only capabilities and the catalog to confirm callable MCP tools. MCP connectivity does not authorize business operations.

Shared connection prerequisites

Install, start and initialize the local broker first. Local AI clients share one broker. MCP configuration contains the active installed binary’s absolute path and the same data directory, never the PIN, recovery key, pairing link or credentials. A client must be able to launch a local stdio process on the broker’s computer; a cloud-only client cannot use that entry point directly.

Codex plugin or plain MCP

• Plugin: run secretbridge client-plugin codex <new-absolute-directory> with the active binary to export the bundled plugin. Add its marketplace and secretbridge@secretbridge-local under current Codex CLI rules, then start a new chat. Check existing marketplaces before changing them.
• MCP configuration: run secretbridge client-config codex and merge the printed TOML fragment into the existing client configuration, preserving other MCP servers. A current marketplace compatibility issue means a visible plugin entry alone is not proof of working tools.
• Other clients: client-config supports Claude Code, Cursor, GitHub Copilot CLI, OpenCode, WorkBuddy, DeepSeek Harness and a generic stdio format. WorkBuddy and DeepSeek Harness also have dedicated exports. Follow the product integration guide and the client’s current configuration format.

Prove the connection

1. Run secretbridge status; confirm running and the active binary path.
2. Reload the AI client and discover secretbridge_* tools in a new conversation.
3. Call read-only secretbridge_terminal_capabilities. A capability response demonstrates that the stdio bridge reached the broker. Each business operation still requires its own authorization.

An operations Skill guides tool selection and recovery but grants no extra rights; installing only the Skill does not connect MCP. Recheck the client path and read-only call after upgrade or rollback.