# Codex CLI and desktop

Source: <https://devshiftteam.github.io/my-whatsapp-mcp/clients/codex.html>

**Preview setup**

These instructions have been reviewed, but the setup has not yet been tested from start to finish. [See compatibility.](https://devshiftteam.github.io/my-whatsapp-mcp/compatibility.html)


Create a separate connection for Codex in **AI connections**. Choose its chats, date range, and expiry, then copy the configuration generated by My WhatsApp. New connections are read-only.

## Local stdio

Keep My WhatsApp running on the same computer. Copy the generated stanza into the configuration used by your Codex CLI or desktop app:

```toml
[mcp_servers.wa_indexer]
command = "/absolute/path/to/wa-indexer"
args = ["mcp", "stdio", "--config", "/absolute/private/path/native-client.json"]
```

Use the exact generated executable and credential-file paths, including any spaces or Hebrew characters. Both paths must be absolute. The example filenames above are placeholders.

My WhatsApp manages the private credential file. Copy its path, not its contents. You do not need a port or token environment variable. The adapter connects to the running archive.

## Docker stdio

For a [Docker installation](https://devshiftteam.github.io/my-whatsapp-mcp/install/docker-compose.html), create a local Codex connection and copy its generated configuration:

```toml
[mcp_servers.wa_indexer]
command = "docker"
args = ["exec", "-i", "wa-indexer", "/usr/local/bin/wa-indexer", "mcp", "stdio", "--config", "/var/lib/wa-indexer/data/clients/native-client.json"]
```

Use your generated file path and container name. Keep `-i`; do not add `-t`. The container must already be running, and the Codex process must have access to Docker. The credentials stay inside the private data volume.

## Remote bearer

Set up [remote access](https://devshiftteam.github.io/my-whatsapp-mcp/remote/index.html), then create a remote Codex credential. Use the saved HTTPS endpoint ending in `/mcp`:

```toml
[mcp_servers.wa_indexer]
url = "https://bearer.example.com/mcp"
bearer_token_env_var = "WA_INDEXER_CLIENT_TOKEN"
```

Provide the raw My WhatsApp token in `WA_INDEXER_CLIENT_TOKEN` in the environment of the Codex process. Codex adds the `Bearer` prefix. Keep the token out of URLs, configuration text, and command arguments.

For Codex CLI, you can register the endpoint with:

```sh
codex mcp add wa_indexer --url 'https://bearer.example.com/mcp' --bearer-token-env-var 'WA_INDEXER_CLIENT_TOKEN'
```

That command changes the CLI's MCP configuration. For desktop, use the app's configuration and make sure its process receives the token variable; exporting it in an unrelated terminal does not set it for the desktop app. Local stdio avoids this extra step.

The managed remote setup does not provide OAuth. Use bearer authentication for this route.

## Check access and revoke it

Ask Codex to find a harmless phrase in a permitted chat and show the surrounding messages. Check that an excluded chat cannot be read. If you change the connection's permissions, repeat the query to confirm the change.

Revoke the connection in My WhatsApp when finished. Removing its Codex configuration alone does not revoke access. See [MCP tools](https://devshiftteam.github.io/my-whatsapp-mcp/mcp.html) and [sending permissions](https://devshiftteam.github.io/my-whatsapp-mcp/clients/outbound-messaging.html).

Successful calls in the actual Codex CLI and desktop app have not yet been confirmed. Check [compatibility](https://devshiftteam.github.io/my-whatsapp-mcp/compatibility.html) before depending on this setup. For Codex configuration details, see the [official MCP guide](https://developers.openai.com/codex/mcp).