Skip to main content
Glama

codex-chatgpt-web-mcp

한국어 | English

Codex owns the workspace. The proxy owns the browser. ChatGPT only sees the conversation.

A local, browser-backed MCP server that lets Codex use your authenticated ChatGPT Web session as a reasoning, coding, and review backend.

Unlike workspace-bridge designs, this project does not connect ChatGPT to your repository. Codex is the MCP client. The MCP server controls an isolated ChatGPT browser session and returns normal assistant responses to Codex.

Architecture

┌──────────────────────────────┐
│            Codex             │
│                              │
│ workspace / shell / git      │
│ context selection / patches  │
│ tests / execution            │
└──────────────┬───────────────┘
               │ MCP over stdio
               ▼
┌──────────────────────────────┐
│    codex-chatgpt-web-mcp     │
│                              │
│ fixed ChatGPT navigation     │
│ persistent browser profile   │
│ model / effort selection     │
│ conversation management      │
│ response extraction          │
└──────────────┬───────────────┘
               │ Playwright
               ▼
┌──────────────────────────────┐
│       ChatGPT Web            │
│                              │
│ sees prompt text only        │
│ no repo / shell / MCP access │
└──────────────────────────────┘

The proxy has no workspace mount, no Git operations, no shell tool, and no generic browser-navigation MCP tool. It only navigates the fixed ChatGPT Web origin.

Related MCP server: MCP-LinkGPT

Security properties

  • Workspace isolation by architecture — ChatGPT never receives repository access through this MCP server. Codex chooses exactly what text to send.

  • No execution capability — ChatGPT responses are untrusted text. The proxy cannot apply patches, run commands, install packages, or modify Git state.

  • Local stdio transport — the MCP server opens no TCP listener.

  • Persistent browser profile is private state — stored outside projects with owner-only permissions where the OS supports them.

  • No credential API — there is no MCP tool to read cookies, tokens, passwords, local storage, or the browser profile.

  • No stealth/evasion code — the implementation uses standard Playwright. It does not attempt to bypass anti-bot, CAPTCHA, login, or service controls.

  • Fixed origin — browser automation is restricted to https://chatgpt.com.

  • Serialized requests — one browser profile is used by one request at a time to prevent cross-conversation races.

  • Bounded I/O — prompt and response sizes are capped locally.

See SECURITY.md for the threat model.

MCP tools

chatgpt_status

Checks whether the persistent browser session is authenticated and whether the ChatGPT composer is usable.

chatgpt_capabilities

Reads the live model/effort picker choices visible to the signed-in account. The web UI is the source of truth; model names are not hard-coded.

chatgpt_chat

Sends a prompt to a new or existing ChatGPT conversation.

Inputs include:

  • prompt

  • optional conversation_id

  • optional exact model label

  • optional exact effort label

  • optional timeout

The returned conversation_id can be reused on the next call.

Quick start

Requirements:

  • Node.js 20+

  • a ChatGPT account you are authorized to use

  • a graphical session for the initial manual login

  • headless Chromium is sufficient after the browser profile is authenticated

git clone https://github.com/jiho-symply/codex-chatgpt-web-mcp.git
cd codex-chatgpt-web-mcp

npm install
npx playwright install chromium
npm run build

# Initial login: this intentionally opens a real browser.
node dist/cli.js login

# Verify the persisted session works headlessly.
node dist/cli.js doctor

On Linux servers you may need:

npx playwright install --with-deps chromium

See docs/headless-linux.md for initial-login options such as SSH X11 forwarding or a temporary VNC/noVNC desktop.

Connect to Codex

Run:

node dist/cli.js codex-config

It prints a TOML block using the current absolute executable path. Add the result to ~/.codex/config.toml.

Equivalent shape:

[mcp_servers.chatgpt_web]
command = "/absolute/path/to/node"
args = ["/absolute/path/to/codex-chatgpt-web-mcp/dist/cli.js", "mcp"]
startup_timeout_sec = 30
tool_timeout_sec = 600

Then Codex can call chatgpt_chat as a subagent without giving ChatGPT direct workspace access.

See docs/codex.md.

Typical coding workflow

Codex remains the orchestrator:

1. Codex searches/reads the repository.
2. Codex selects only the relevant context.
3. Codex calls chatgpt_chat with the task + selected context.
4. ChatGPT returns analysis, code, or a unified diff as ordinary text.
5. Codex treats the response as untrusted.
6. Codex validates any patch locally, runs tests, and decides what to apply.
7. Codex may send the resulting diff/test summary back for review.

ChatGPT does not need to know that Codex is the caller.

Model and effort selection

Use the live account-specific picker:

node dist/cli.js models

Or let Codex call chatgpt_capabilities.

The proxy attempts semantic/test-id based discovery first and fails closed when it cannot identify a requested option. It does not silently substitute another model or effort level.

Because ChatGPT Web changes over time, UI selectors can break. A selector failure returns UI_CHANGED instead of guessing.

Headless operation

The MCP command is headless by default.

The initial login is deliberately manual: this project does not accept account passwords or automate CAPTCHA/2FA. Once authenticated, the persistent profile can be reused by headless Chromium on the same trusted machine.

For servers without a desktop, use one of the documented temporary display methods for the first login, then remove the display service.

Environment variables

Variable

Default

Meaning

CGW_STATE_DIR

OS state directory

Browser profile + local state root

CGW_HEADLESS

true for MCP/doctor

Run browser without a visible window

CGW_BROWSER_CHANNEL

bundled Chromium

Optional Playwright browser channel such as chrome

CGW_TIMEOUT_MS

180000

Default ChatGPT generation timeout

There is intentionally no configurable remote origin.

Docker

A Dockerfile is included for headless operation after a profile has been authenticated. Persist /data as a private volume.

The preferred deployment is still a local MCP process launched directly by Codex because stdio keeps the trust boundary simple.

Limitations

  • This is browser automation, not an official ChatGPT API.

  • ChatGPT Web UI changes can break selectors.

  • An initial interactive login is required.

  • ChatGPT may reject or challenge automated browser sessions; this project does not bypass those controls.

  • Codex is responsible for minimizing sensitive code sent in prompts.

  • ChatGPT responses may contain unsafe or incorrect code and must be reviewed before execution.

  • A website subscription, availability, and usage limits remain governed by the service itself.

Disclaimer

Unofficial community project. Not affiliated with or endorsed by OpenAI.

Users are responsible for complying with applicable service terms and their organization's policies.

License

MIT

Available Tools

3 tools
chatgpt_capabilitiesChatGPT Web capabilitiesA
Read-only

Inspect live model and reasoning/effort choices visible to the signed-in ChatGPT account. The web UI is the source of truth; no model list is hard-coded.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
modelPickerYes
effortPickerYes
flattenedPickerYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already covers safety, and the description adds meaningful behavioral context: the data is live, account-dependent, and sourced from the web UI rather than a hard-coded list. This helps an agent understand that results may change and should not be assumed static.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler. The main action is front-loaded, and the second sentence adds an important caveat about the source of truth without unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only introspection tool with an output schema and readOnly annotation, the description fully covers what the agent needs: purpose, source of truth, and dynamic nature. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parametershare, so there is no parameter burden on the description. Schema coverage is complete, and the description appropriately focuses on what is being inspected rather than input details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (inspect) and resource (live model and reasoning/effort choices for the signed-in ChatGPT account). This clearly differentiates it from sibling tools like chatgpt_status and chatgpt_chat, which are about status and chat operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when an agent needs the live, account-visible model and reasoning/effort capabilities rather than chat or status. It does not explicitly name alternatives or exclusions, but the context is clear enough for an agent to route correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chatgpt_chatChatGPT Web chatB

Send prompt text to ChatGPT Web and return the assistant response. No repository or execution capability is granted to ChatGPT. The caller is responsible for selecting minimal context and validating returned code before use.

ParametersJSON Schema
NameRequiredDescriptionDefault
modelNo
effortNo
promptYes
timeout_msNo
conversation_idNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
responseYes
truncatedYes
responseBytesYes
conversationIdYes
requestedModelYes
requestedEffortYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the sparse annotations, the description adds useful behavioral caveats: ChatGPT cannot access repositories or execute code, and returned code must be validated. It does not cover authentication, rate limits, or conversation persistence, but it does reveal non-obvious constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core action. Each sentence earns its place: the action, the capability boundary, and the caller responsibility.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema presumably covers return values, but the input side is incomplete for a 5-parameter tool: the meaning of effort, model, timeout_ms, and conversation_id is absent. The behavior caveats are helpful, but an agent still lacks enough detail to use optional parameters correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description needed to compensate, but only 'prompt text' clarifies the prompt parameter. 'model', 'effort', 'timeout_ms', and 'conversation_id' are left to be inferred from their names alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the action ('Send prompt text'), the resource ('ChatGPT Web'), and the result ('return the assistant response'), making the tool's function clear. It does not explicitly contrast with chatgpt_status or chatgpt_capabilities, but the distinct action leaves little room for confusion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool should be used whenever a ChatGPT response is needed and warns that repository/execution capabilities are absent, acting as a when-not-to-use boundary. It never names the sibling tools or states conditions for choosing status/capabilities instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chatgpt_statusChatGPT Web statusA
Read-only

Check whether the persistent ChatGPT Web session is authenticated and usable. Does not expose cookies, tokens, profile files, or workspace data.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
uiReadyYes
headlessYes
authenticatedYes
conversationIdYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=true already present, the description adds useful context by guaranteeing that sensitive data is not exposed. It also clarifies that this is a status check rather than a data-access operation, which helps set expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences with no filler. The primary purpose is front-loaded, and the second sentence adds a valuable privacy clarification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple zero-parameter tool with an output schema and a read-only annotation. The description covers what the tool checks and what it does not expose, which is sufficient for an agent to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema provides full coverage trivially. The description appropriately focuses on the tool's behavior rather than parameter details, which are unnecessary here.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource: checking whether the persistent ChatGPT Web session is authenticated and usable. It also explicitly distinguishes itself from data-exposing tools by stating it does not expose cookies, tokens, profile files, or workspace data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is reasonably clear: verify session status before relying on the ChatGPT Web session. However, it does not explicitly name alternatives like chatgpt_capabilities or chatgpt_chat, nor does it state when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 3 tool updatesv0.1.0
    • First observedchatgpt_capabilities
    • First observedchatgpt_chat
    • First observedchatgpt_status

TDQS

A4.1/5.0

Scored across 3 tools

Disambiguation5/5

Each tool serves a distinct purpose: status checks authentication, capabilities inspects model options, and chat sends messages. There is no overlap or ambiguity between them.

Naming Consistency5/5

All tools follow a consistent 'chatgpt_' prefix with clear noun suffixes (status, capabilities, chat), forming a predictable and uniform naming convention.

Tool Count5/5

With only 3 tools, the server is tightly scoped to its purpose of interacting with ChatGPT Web, and each tool is essential for the core workflow. This is well within the typical range.

Completeness5/5

The tool surface covers the essential operations: session validation, capability discovery, and message exchange. No critical gaps are apparent for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers