> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Codex

> Add the hosted MCP server for Semgrep AppSec Platform to Codex with OAuth or an API token.

Add the hosted MCP server to Codex. For help choosing an authentication method, see [Authentication and access](https://docs.semgrep.dev/mcp/authentication.md).

## Prerequisites

* The [prerequisites for the hosted MCP server](https://docs.semgrep.dev/mcp/overview.md#prerequisites).

> [!NOTE]
>
> **Single-tenant URL**
>
> The steps on this page use `https://semgrep.dev/api/mcp`. On a single-tenant deployment, replace that URL with `https://YOUR_TENANT.semgrep.dev/api/mcp`. Use your subdomain for `YOUR_TENANT`. To connect to the read-only URL instead, see [Read-only URL](https://docs.semgrep.dev/mcp/authentication.md#read-only-url).

## Connect with OAuth

**Step 1**

Add this entry to `~/.codex/config.toml`, or update the existing `semgrep` entry:

```toml theme={null}
[mcp_servers.semgrep]
url = "https://semgrep.dev/api/mcp"
```

**Step 2**

Start the browser sign-in:

```bash theme={null}
codex mcp login semgrep
```

**Step 3**

Sign in and select an organization in your browser.

**Step 4**

Start a new Codex session, or reload the MCP servers in the Codex app. Run `/mcp` and confirm that `semgrep` is connected.

## Connect with an API token

**Step 1**

Add this entry to `~/.codex/config.toml` instead of the OAuth entry:

```toml theme={null}
[mcp_servers.semgrep]
url = "https://semgrep.dev/api/mcp"
bearer_token_env_var = "SEMGREP_APP_TOKEN"
```

Codex sends the value of `SEMGREP_APP_TOKEN` as a bearer token. Export `SEMGREP_APP_TOKEN`, set to a **Web API** or **Read-only** [API token](https://docs.semgrep.dev/mcp/authentication.md#token-scopes), in the environment where you start Codex.

**Step 2**

Start a new Codex session, or reload the MCP servers in the Codex app. Run `/mcp` and confirm that `semgrep` is connected. You don't need to sign in through your browser.

For more information, see [OpenAI MCP documentation](https://learn.chatgpt.com/docs/extend/mcp?surface=cli).