Codex MCP servers: which to add first and the team rules to set

Codex CLI reads MCP servers from config.toml, supports per-tool approval modes, and can allowlist or block individual tools. This page lists the servers worth adding first, the ones to hold back, and the team rules that keep every MCP call reviewable.

Book a call

Explore team training

What MCP does in Codex

Codex CLI reads MCP servers from config.toml in two places: .codex/config.toml inside a trusted project, then ~/.codex/config.toml in the home directory. The same configuration is shared by the CLI, the IDE extension and the desktop app. Servers are added with codex mcp add for stdio commands or a URL for Streamable HTTP servers, listed with codex mcp list, and authenticated with codex mcp login where a server uses OAuth. Per server, the config accepts enabled_tools as an allowlist and disabled_tools as a blocklist applied after it, plus a default approval mode of auto, prompt, writes or approve that can be overridden per tool. The writes mode is the one most teams want: reads run, writes prompt. Tool calls still run inside the Codex sandbox and approval policy the repository sets. The surrounding CLI loop, task brief, and reviewable diff live on CLI workflows.

MCP servers worth adding first

As of September 2026, these are the servers we see engineering teams use with Codex most. Each exists as an official vendor server with a documented way to limit what it can do, and the first is published by OpenAI itself.

1. OpenAI Docs MCP
Searches the OpenAI developer documentation, including the Codex docs, from inside a run. First-party server from OpenAI, listed in the Codex MCP docs. Team rule: read-only by nature, so it can go on the default list for any team building against the OpenAI API.
2. GitHub MCP server
Lets the agent read repositories, issues, pull requests, Actions runs and code scanning results without leaving the editor. Official server from GitHub, available hosted or self-run. Team rule: start with the --read-only flag and the repos, issues and pull_requests toolsets; enable write tools only for a named workflow.
3. Playwright MCP
Drives a real browser through accessibility snapshots so the agent can reproduce a bug or check a page after a change. Official server from Microsoft. Team rule: run it in isolated mode against local or staging origins, and treat any step that logs in or submits a form as an approval point.
4. Context7
Pulls current, version-specific library documentation into the run so the agent stops guessing at APIs. Published by Upstash, hosted at mcp.context7.com. Team rule: it only returns documentation, so it can sit on the default allowlist; keep the API key out of the shared config file.
5. Sentry MCP
Searches errors and performance data and reads issue context for the code the agent is fixing. Official server from Sentry, hosted at mcp.sentry.dev with OAuth. Team rule: scope the connection to one project, and keep the write scopes off until the team decides which triage actions the agent may take.
6. Linear MCP
Reads issues, projects and comments so the agent can work from the ticket instead of a pasted summary. Official server from Linear. Team rule: connect the readonly endpoint or the read OAuth scope first; issue creation and status changes stay with a person until reviewers ask for more.
7. Atlassian Rovo MCP
Searches Jira and Confluence and can create or update work items. Official remote server from Atlassian; it acts with the connected user's own permissions. Team rule: connect it under an account with read access only, since the docs say it can act across every connected product with your permissions.

Servers to keep off the default list

These are not bad servers. They are the ones teams add in week one and regret in week three, because they carry secrets, write to shared systems, or nobody can say who maintains them.

1. Slack MCP
The official Slack server can search and send messages as the connected user, and Slack requires workspace admins to approve every MCP client. That is a decision for the team and an admin, not a line in a repo config.
2. Figma MCP with canvas writes
The Figma server is useful for reading design context, but its write-to-canvas tools change design files other people own. Keep it on read tasks until designers agree on what the agent may touch.
3. Filesystem with broad roots
The reference filesystem server from the Model Context Protocol project restricts operations to allowed directories, but only if someone sets them narrowly. A home directory root turns every run into a full-disk agent.
4. Unmaintained database servers
The reference Postgres, SQLite and Redis servers were moved to an archived repository, and many community forks carry a connection string in plain text. Prefer a vendor server with a read-only flag, or none at all.

Team rules that make MCP reviewable

The point of these rules is that a reviewer can tell what Codex did, which server did it, and whether that was inside what the team agreed. None of them slow a run down once they are written.

1. One allowlist per repository
Write the approved servers into the shared config the team already version controls, and treat a new server like a new dependency: a pull request, a named owner, and a reason.
2. Read-only by default
Where the server offers a read-only flag, endpoint or scope, that is the starting point. Write access is a separate decision with a named workflow attached.
3. Approval for writes
Anything that creates a ticket, posts a message, changes a design file or writes to a database goes through a prompt or an explicit allow rule that a reviewer can see in the config.
4. Record which server produced which change
Ask the agent to name the tools it called in the pull request description, and keep the transcript or log attached, so a reviewer can trace a change back to a server call.
5. Review the diff before merge
The transcript shows what the agent thought it did. The diff, the test output and the tool log show what happened. Reviewers sign off on the second set.

Where training fits

A list like this only holds if the whole team applies it the same way. In the two-day workshop we set the allowlist up in the team's own repository with Codex, run real tasks against it, and write the rules above into the config and the review checklist. Delegate, Review, Own is the model we use to decide which MCP calls an agent may make on its own, which need a prompt, and which stay with an engineer, so the standard survives after the trainers leave.

Official references

Current product documentation we use when shaping this training topic.

Selected research

Representative field notes connected to this topic.

May 13, 2026

Have you tried these?

Run the change on one branch. The methodology puts that in Review: an engineer still owns the merge. Training is the team version of that step.

Bring this into your team

We tailor the training to your codebase, adoption stage, and review standards.

Book a call

Prefer to measure first? Take the free team check.

Codex MCP servers: which to add first and the team rules to set

What MCP does in Codex

MCP servers worth adding first

Servers to keep off the default list

Team rules that make MCP reviewable

Where training fits

Official references

Selected research

Fast mode is not the default: when fast models earn it

Codex CLI Goal Mode, Appshots, and the Real Workflow

Codex mobile CLI: runs that survive review

Codex mobile CLI docs your team can read anywhere

Codex workflows: governance that lives in the repo

Is Codex CLI Giving MCP Too Much Reach?

Related training topics

Have you tried these?

Bring this into your team