Skip to content
Start free

Connect Codex and other clients

Add FounderSync to OpenAI Codex with config.toml or the CLI, or connect any MCP client that supports OAuth.

On this page

OpenAI Codex connects to FounderSync as a Streamable HTTP MCP server and signs in with OAuth. The Codex CLI, the IDE extension and the ChatGPT desktop app share one configuration. Use https://mcp.foundersync.io/mcp for full access, or https://mcp.foundersync.io/mcp/readonly for read-only. See the overview for the difference.

Codex#

Add the server to ~/.codex/config.toml. Each server is a [mcp_servers.<name>] table with a url:

toml
[mcp_servers.foundersync]
url = "https://mcp.foundersync.io/mcp"

A project can also have its own .codex/config.toml, which Codex uses for trusted projects only.

You can add the same server from the CLI instead of editing the file:

bash
codex mcp add foundersync --url https://mcp.foundersync.io/mcp

Sign in#

Run the login command for the server name you chose:

bash
codex mcp login foundersync

Codex opens your browser at FounderSync's consent screen. Sign in to FounderSync if asked, check the agent name and permissions, and click Allow access. On a machine with no browser, such as over SSH, run codex mcp login foundersync --no-browser and paste the full redirect URL back into the terminal when prompted.

Check the result with codex mcp list, or type /mcp inside the Codex terminal UI to see active servers. In the IDE extension, open the gear menu, choose MCP servers, then Add server, enter a name, pick Streamable HTTP, and enter the URL. Save, then choose Restart extension.

Then ask Codex to "call whoami in FounderSync". If you belong to more than one startup, tell it which one to use.

Any other MCP client#

Any client that supports remote MCP servers over Streamable HTTP and OAuth 2.1 can connect. It needs:

  • The server URL: https://mcp.foundersync.io/mcp (or /mcp/readonly).
  • OAuth with dynamic client registration. The server publishes protected-resource metadata at https://mcp.foundersync.io/.well-known/oauth-protected-resource, which points the client at FounderSync's authorization server (Supabase Auth). The client then sends you to the consent screen.
  • A Bearer token on every request, in the Authorization header.

When a request arrives without a valid token, the server answers 401 with a WWW-Authenticate header that carries the metadata URL, which is how clients start discovery.

Two limits to know about:

  • There are no API keys or personal access tokens. The server accepts only access tokens issued to an OAuth client you approved. A token from your normal browser session is rejected, so a leaked web session cannot be replayed against it.
  • If your client only supports static headers and cannot run an OAuth flow, it cannot connect.

To stop an agent's access later, see security and access.