About this project

Codex with ChatGPT is an unofficial community project that connects the ChatGPT web app as a planning and review brain for Codex coding sessions, while Codex retains full ownership of execution. The core idea is to leverage the idle quota of a paid ChatGPT Plus/Pro subscription for reasoning and code review, while Codex handles the actual coding, testing, and fixing work — eliminating the need for API keys or reverse proxies. The architecture uses two planes: a control plane where Codex and ChatGPT exchange tiny structured [C2C] state messages (INIT → PLAN → EXECUTED → REVIEW → DONE) without pasting diffs or logs, and a data plane where ChatGPT pulls exactly what it needs through nine read-only MCP tools including workspace_info, list_directory, read_file, search_workspace, git_status, git_diff, test_status, execution_summary, and execution_output. After Codex executes, ChatGPT independently inspects the actual git diff and test records through MCP rather than blindly trusting claims. Security is a central design concern. The MCP server is read-only by construction — write, delete, shell, and commit tools simply do not exist, so prompt injection cannot enable them. Each token is bound to a single workspace with path containment using canonical realpaths that block symlink, ../, and absolute-path escapes. Sensitive files like .env*, keys, SSH credentials, and similar are denied by default, with .c2cignore for custom rules. The public MCP endpoint requires OAuth 2.1 with PKCE S256, dynamic client registration, and rotating refresh tokens. The only secret that touches a browser is a one-time pairing code with a 5-minute TTL, 5 attempts, rate limiting, and destruction on use. Installation is designed to be accessible to non-technical users: a single paragraph can be pasted to Codex to handle the entire setup automatically, including environment checks, cloning, building, skill installation, and first-time configuration. The project uses Cloudflare Quick Tunnel for public connectivity, with an optional stable hostname feature for users with Cloudflare accounts. The Codex Skill checks GitHub daily for updates and can self-update automatically. The project is built with Node.js (>= 20), uses pnpm for package management, and includes 150 tests covering path security, OAuth, pairing, and MCP end-to-end scenarios. It is licensed under MIT and is not affiliated with or endorsed by OpenAI.