Codex CLI, IDE and supported desktop surfaces can share MCP configuration on the same host. A convenient shared config also means a high-privilege server can affect more than one surface.
1. Choose one trusted server
Start with one server tied to a clear job such as docs, browser automation or an issue tracker. Verify the publisher and setup source.
2. Add it with the supported Codex configuration
Use codex mcp or the documented config path. Keep tokens in supported auth or environment mechanisms rather than project files.
3. Inspect tools before delegating
List the current MCP tools and identify which can read, create, edit, send or delete. Note any tool that reaches data outside the repository.
4. Test a narrow read
Retrieve one known object and compare it with the source. This catches wrong accounts, wrong tenants and overly broad search scopes early.
5. Apply least privilege to writes
Only enable or use consequential tools when the task requires them. Keep an approval or explicit confirmation step before mutations.
List the MCP servers and tools available in this Codex session. For [server], categorize each tool as read or write. Use only the read tool to fetch [known object]. Stop before any mutation.
Adding many servers before one workflow works; keeping secrets in a repository config; confusing tool discovery with permission review; allowing a remote server to mutate external data without confirmation.
Finish check
You know which server provides every tool, authentication is stored safely, a read test matches the source, and write actions remain explicitly controlled.