Codex CLI

Codex CLI signs in to Sallyport by itself and keeps its MCP servers in ~/.codex/config.toml.

Connect it

• Run codex mcp add sallyport --url https://mcp.sallyport.cloud/mcp.
• Run codex mcp login sallyport. Your browser opens Sallyport.
• Sign in or create an account, then press “Allow” on the consent screen.
• Add tool_timeout_sec = 300 to the entry, as below.

[mcp_servers.sallyport]
url = "https://mcp.sallyport.cloud/mcp"
tool_timeout_sec = 300

Pressing “Allow” creates an agent named after the client. An owner’s or admin’s agent starts with every connection of the workspace. A member’s agent starts with none, and an admin adds them under “Access”. Signing in again later takes one “Reconnect” click.

Connect with a token

On a machine where nobody signs in, Codex takes a bearer token from an environment variable, so the file holds no secret.

• In the console, open Agents, press “New agent”, type a name and press “Create agent”.
• On the agent’s page, under “Tokens”, press “New token” and copy it. It is shown once.
• Put the token in SP_AGENT_TOKEN in the environment that starts Codex, and add the entry below to ~/.codex/config.toml.

[mcp_servers.sallyport]
url = "https://mcp.sallyport.cloud/mcp"
bearer_token_env_var = "SP_AGENT_TOKEN"
tool_timeout_sec = 300

bearer_token_env_var holds the name of the variable, never the token. codex mcp add sallyport --url https://mcp.sallyport.cloud/mcp --bearer-token-env-var SP_AGENT_TOKEN writes the first three lines for you.

Why tool_timeout_sec is 300

Codex stops waiting for a tool after 60 seconds by default. Sallyport holds a call that waits for a person for at most 4 minutes. With 300, Codex waits longer than Sallyport ever holds the call.

When a call waits for a person

A push, a release or a deploy runs straight through by default. It waits if you turned on “Ask every call”, set a class to “Approval required” or set a budget for that connection. A waiting call comes back with approve_url and call_id.

Answer the card, then tell Codex to continue. It repeats the call with the same call_id, so the service is called once. For a long session, the card can approve that kind of call for a set time and number of calls.