Skip to main content

Connect Codex

Connect CIN MCP to OpenAI Codex: the CLI, the IDE extension and the Codex desktop app.

note

This page is general guidance. OpenAI changes its products often; refer to the official OpenAI documentation for the most up-to-date instructions.

Prerequisites​

ItemValue
Server URLhttps://cin-mcp.ai.app.hyland.com/mcp
Client IDFrom Hyland
Client secretFrom Hyland, sent with the client ID
Redirect URI (already registered)http://127.0.0.1:1455/callback
Callback port1455
Hyland accessSee Subscription & Roles

The CLI, the IDE extension and the desktop app share one configuration file, ~/.codex/config.toml (on Windows %USERPROFILE%\.codex\config.toml), so setting it up once covers all three.

Tutorial Overview​

  1. Managed setup (administrator), or individual setup.
  2. Sign in.
  3. Try it.

Part 1: Managed setup (administrator)​

  1. Allow the server in Codex's managed requirements, so users can't point Codex at other MCP servers. In requirements.toml (Windows %ProgramData%\OpenAI\Codex\requirements.toml, Linux and macOS /etc/codex/requirements.toml, macOS MDM domain com.openai.codex, or the ChatGPT Admin Console under Agent Security):

    [mcp_servers.hyland-cin-mcp]
    identity = { url = "https://cin-mcp.ai.app.hyland.com/mcp" }

  2. Distribute the server definition (see The configuration below) with your device-management tooling. Distribute the client secret through a secure method; don't put it in a shared file users can read.

  3. Each user signs in (Part 3).

Part 2: Individual setup​

  1. Add the server. --oauth-client-secret prompts for the secret:

    codex mcp add hyland-cin-mcp --url https://cin-mcp.ai.app.hyland.com/mcp --oauth-client-id [your-client-id] --oauth-client-secret

  2. Set the callback port. Hyland IAM accepts only the registered redirect, so add this to ~/.codex/config.toml:

    [mcp_servers.hyland-cin-mcp.oauth]
    callback_port = 1455

    Or set mcp_oauth_callback_port = 1455 at the top of the file for all servers.

The configuration​

[mcp_servers.hyland-cin-mcp]
url = "https://cin-mcp.ai.app.hyland.com/mcp"

[mcp_servers.hyland-cin-mcp.oauth]
client_id = "[your-client-id]"
callback_port = 1455

Part 3: Sign in​

codex mcp login hyland-cin-mcp

Complete the Hyland sign-in in the browser. Then restart the IDE extension (MCP servers → Restart extension) or the desktop app so they pick up the server.

Part 4: Try it​

In a Codex session, ask:

  • "List my Agent Builder agents."
  • "Find Content Lake documents whose name contains 'invoice'."

Best Practices​

  • If client_secret is written into config.toml, it's in plain text. Keep the file private and never commit a project .codex/config.toml that contains it. Store tokens in the OS keyring with mcp_oauth_credentials_store = "keyring".
  • Codex requests the scopes the server advertises, so no scope configuration is needed.
  • In the desktop app and IDE extension, the server can also be added from Settings → MCP servers → Add server → Streamable HTTP.

Summary​

Codex reads CIN MCP from config.toml, with your client ID and callback port 1455. Administrators can allowlist and distribute it; each user signs in with codex mcp login.