codex-chatgpt-web-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codex-chatgpt-web-mcpAsk ChatGPT to review the selected code for edge cases."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
codex-chatgpt-web-mcp
한국어 | English
Codex owns the workspace. The proxy owns the browser. ChatGPT only sees the conversation.
A local, browser-backed MCP server that lets Codex use your authenticated ChatGPT Web session as a reasoning, coding, and review backend.
Unlike workspace-bridge designs, this project does not connect ChatGPT to your repository. Codex is the MCP client. The MCP server controls an isolated ChatGPT browser session and returns normal assistant responses to Codex.
Architecture
┌──────────────────────────────┐
│ Codex │
│ │
│ workspace / shell / git │
│ context selection / patches │
│ tests / execution │
└──────────────┬───────────────┘
│ MCP over stdio
▼
┌──────────────────────────────┐
│ codex-chatgpt-web-mcp │
│ │
│ fixed ChatGPT navigation │
│ persistent browser profile │
│ model / effort selection │
│ conversation management │
│ response extraction │
└──────────────┬───────────────┘
│ Playwright
▼
┌──────────────────────────────┐
│ ChatGPT Web │
│ │
│ sees prompt text only │
│ no repo / shell / MCP access │
└──────────────────────────────┘The proxy has no workspace mount, no Git operations, no shell tool, and no generic browser-navigation MCP tool. It only navigates the fixed ChatGPT Web origin.
Related MCP server: MCP-LinkGPT
Security properties
Workspace isolation by architecture — ChatGPT never receives repository access through this MCP server. Codex chooses exactly what text to send.
No execution capability — ChatGPT responses are untrusted text. The proxy cannot apply patches, run commands, install packages, or modify Git state.
Local stdio transport — the MCP server opens no TCP listener.
Persistent browser profile is private state — stored outside projects with owner-only permissions where the OS supports them.
No credential API — there is no MCP tool to read cookies, tokens, passwords, local storage, or the browser profile.
No stealth/evasion code — the implementation uses standard Playwright. It does not attempt to bypass anti-bot, CAPTCHA, login, or service controls.
Fixed origin — browser automation is restricted to
https://chatgpt.com.Serialized requests — one browser profile is used by one request at a time to prevent cross-conversation races.
Bounded I/O — prompt and response sizes are capped locally.
See SECURITY.md for the threat model.
MCP tools
chatgpt_status
Checks whether the persistent browser session is authenticated and whether the ChatGPT composer is usable.
chatgpt_capabilities
Reads the live model/effort picker choices visible to the signed-in account. The web UI is the source of truth; model names are not hard-coded.
chatgpt_chat
Sends a prompt to a new or existing ChatGPT conversation.
Inputs include:
promptoptional
conversation_idoptional exact
modellabeloptional exact
effortlabeloptional timeout
The returned conversation_id can be reused on the next call.
Quick start
Requirements:
Node.js 20+
a ChatGPT account you are authorized to use
a graphical session for the initial manual login
headless Chromium is sufficient after the browser profile is authenticated
git clone https://github.com/jiho-symply/codex-chatgpt-web-mcp.git
cd codex-chatgpt-web-mcp
npm install
npx playwright install chromium
npm run build
# Initial login: this intentionally opens a real browser.
node dist/cli.js login
# Verify the persisted session works headlessly.
node dist/cli.js doctorOn Linux servers you may need:
npx playwright install --with-deps chromiumSee docs/headless-linux.md for initial-login options such as SSH X11 forwarding or a temporary VNC/noVNC desktop.
Connect to Codex
Run:
node dist/cli.js codex-configIt prints a TOML block using the current absolute executable path. Add the
result to ~/.codex/config.toml.
Equivalent shape:
[mcp_servers.chatgpt_web]
command = "/absolute/path/to/node"
args = ["/absolute/path/to/codex-chatgpt-web-mcp/dist/cli.js", "mcp"]
startup_timeout_sec = 30
tool_timeout_sec = 600Then Codex can call chatgpt_chat as a subagent without giving ChatGPT direct
workspace access.
See docs/codex.md.
Typical coding workflow
Codex remains the orchestrator:
1. Codex searches/reads the repository.
2. Codex selects only the relevant context.
3. Codex calls chatgpt_chat with the task + selected context.
4. ChatGPT returns analysis, code, or a unified diff as ordinary text.
5. Codex treats the response as untrusted.
6. Codex validates any patch locally, runs tests, and decides what to apply.
7. Codex may send the resulting diff/test summary back for review.ChatGPT does not need to know that Codex is the caller.
Model and effort selection
Use the live account-specific picker:
node dist/cli.js modelsOr let Codex call chatgpt_capabilities.
The proxy attempts semantic/test-id based discovery first and fails closed when it cannot identify a requested option. It does not silently substitute another model or effort level.
Because ChatGPT Web changes over time, UI selectors can break. A selector
failure returns UI_CHANGED instead of guessing.
Headless operation
The MCP command is headless by default.
The initial login is deliberately manual: this project does not accept account passwords or automate CAPTCHA/2FA. Once authenticated, the persistent profile can be reused by headless Chromium on the same trusted machine.
For servers without a desktop, use one of the documented temporary display methods for the first login, then remove the display service.
Environment variables
Variable | Default | Meaning |
| OS state directory | Browser profile + local state root |
|
| Run browser without a visible window |
| bundled Chromium | Optional Playwright browser channel such as |
|
| Default ChatGPT generation timeout |
There is intentionally no configurable remote origin.
Docker
A Dockerfile is included for headless operation after a profile has been
authenticated. Persist /data as a private volume.
The preferred deployment is still a local MCP process launched directly by Codex because stdio keeps the trust boundary simple.
Limitations
This is browser automation, not an official ChatGPT API.
ChatGPT Web UI changes can break selectors.
An initial interactive login is required.
ChatGPT may reject or challenge automated browser sessions; this project does not bypass those controls.
Codex is responsible for minimizing sensitive code sent in prompts.
ChatGPT responses may contain unsafe or incorrect code and must be reviewed before execution.
A website subscription, availability, and usage limits remain governed by the service itself.
Disclaimer
Unofficial community project. Not affiliated with or endorsed by OpenAI.
Users are responsible for complying with applicable service terms and their organization's policies.
License
Available Tools
3 toolschatgpt_capabilitiesChatGPT Web capabilitiesARead-only
Inspect live model and reasoning/effort choices visible to the signed-in ChatGPT account. The web UI is the source of truth; no model list is hard-coded.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| modelPicker | Yes | |
| effortPicker | Yes | |
| flattenedPicker | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The readOnlyHint annotation already covers safety, and the description adds meaningful behavioral context: the data is live, account-dependent, and sourced from the web UI rather than a hard-coded list. This helps an agent understand that results may change and should not be assumed static.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The main action is front-loaded, and the second sentence adds an important caveat about the source of truth without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only introspection tool with an output schema and readOnly annotation, the description fully covers what the agent needs: purpose, source of truth, and dynamic nature. Nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parametershare, so there is no parameter burden on the description. Schema coverage is complete, and the description appropriately focuses on what is being inspected rather than input details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (inspect) and resource (live model and reasoning/effort choices for the signed-in ChatGPT account). This clearly differentiates it from sibling tools like chatgpt_status and chatgpt_chat, which are about status and chat operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when an agent needs the live, account-visible model and reasoning/effort capabilities rather than chat or status. It does not explicitly name alternatives or exclusions, but the context is clear enough for an agent to route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chatgpt_chatChatGPT Web chatB
Send prompt text to ChatGPT Web and return the assistant response. No repository or execution capability is granted to ChatGPT. The caller is responsible for selecting minimal context and validating returned code before use.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | ||
| effort | No | ||
| prompt | Yes | ||
| timeout_ms | No | ||
| conversation_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| response | Yes | |
| truncated | Yes | |
| responseBytes | Yes | |
| conversationId | Yes | |
| requestedModel | Yes | |
| requestedEffort | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the sparse annotations, the description adds useful behavioral caveats: ChatGPT cannot access repositories or execute code, and returned code must be validated. It does not cover authentication, rate limits, or conversation persistence, but it does reveal non-obvious constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the core action. Each sentence earns its place: the action, the capability boundary, and the caller responsibility.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema presumably covers return values, but the input side is incomplete for a 5-parameter tool: the meaning of effort, model, timeout_ms, and conversation_id is absent. The behavior caveats are helpful, but an agent still lacks enough detail to use optional parameters correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description needed to compensate, but only 'prompt text' clarifies the prompt parameter. 'model', 'effort', 'timeout_ms', and 'conversation_id' are left to be inferred from their names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the action ('Send prompt text'), the resource ('ChatGPT Web'), and the result ('return the assistant response'), making the tool's function clear. It does not explicitly contrast with chatgpt_status or chatgpt_capabilities, but the distinct action leaves little room for confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used whenever a ChatGPT response is needed and warns that repository/execution capabilities are absent, acting as a when-not-to-use boundary. It never names the sibling tools or states conditions for choosing status/capabilities instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chatgpt_statusChatGPT Web statusARead-only
Check whether the persistent ChatGPT Web session is authenticated and usable. Does not expose cookies, tokens, profile files, or workspace data.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| uiReady | Yes | |
| headless | Yes | |
| authenticated | Yes | |
| conversationId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With readOnlyHint=true already present, the description adds useful context by guaranteeing that sensitive data is not exposed. It also clarifies that this is a status check rather than a data-access operation, which helps set expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no filler. The primary purpose is front-loaded, and the second sentence adds a valuable privacy clarification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple zero-parameter tool with an output schema and a read-only annotation. The description covers what the tool checks and what it does not expose, which is sufficient for an agent to select and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema provides full coverage trivially. The description appropriately focuses on the tool's behavior rather than parameter details, which are unnecessary here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource: checking whether the persistent ChatGPT Web session is authenticated and usable. It also explicitly distinguishes itself from data-exposing tools by stating it does not expose cookies, tokens, profile files, or workspace data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is reasonably clear: verify session status before relying on the ChatGPT Web session. However, it does not explicitly name alternatives like chatgpt_capabilities or chatgpt_chat, nor does it state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.1.0- First observed
chatgpt_capabilities - First observed
chatgpt_chat - First observed
chatgpt_status
TDQS
Scored across 3 tools
Each tool serves a distinct purpose: status checks authentication, capabilities inspects model options, and chat sends messages. There is no overlap or ambiguity between them.
All tools follow a consistent 'chatgpt_' prefix with clear noun suffixes (status, capabilities, chat), forming a predictable and uniform naming convention.
With only 3 tools, the server is tightly scoped to its purpose of interacting with ChatGPT Web, and each tool is essential for the core workflow. This is well within the typical range.
The tool surface covers the essential operations: session validation, capability discovery, and message exchange. No critical gaps are apparent for the stated purpose.
Maintenance
Related MCP Connectors
Undetectable cloud browser sessions for AI agents and scrapers. Navigate, extract, click, captcha.
Persistent memory and cross-session learning for AI coding assistants (hosted remote MCP).
Persistent cross-session memory shared by Codex, Claude Code, ChatGPT, and other AI agents.
Browser MCP for logged-in tasks. Uses your Chrome — credentials stay local. Zero-token replay.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables Codex to interact with Gemini Web through browser automation, allowing it to ask scoped questions and analyze public URLs or YouTube videos without a Gemini API key.3MIT
- FlicenseNot gradedqualityBmaintenanceEnables Codex to consult ChatGPT Web through a dedicated Chrome profile as a read-only reviewer and senior advisor, providing second opinions on code, tests, designs, and proposed fixes.11-
- AlicenseNot gradedqualityCmaintenanceEnables Codex to consult ChatGPT Web through a dedicated Chrome session, acting as a read-only reviewer and senior advisor for code, tests, and designs.MIT
- AlicenseBqualityBmaintenanceEnables MCP clients like Codex to operate chatgpt.com through a dedicated persistent browser profile, allowing chat creation, project management, prompt submission, file uploads, and response reading without using the ChatGPT API.33MIT