How to Connect Codex to WordPress to Build and Run Your Site
Codex is OpenAI’s coding agent. With Fabrement it does more than write code on your computer: it builds and runs your WordPress site. It creates custom Gutenberg blocks, turns Figma frames into WordPress pages, sets up SEO and translates the site with WPML, and keeps managing all of it after launch, without opening wp-admin. To get there, you connect Codex to the site over MCP.
Codex runs in three places: the Codex app in the ChatGPT desktop app, the Codex CLI in a terminal, and the Codex extension for VS Code or Cursor. All three read the same settings, so you connect your site once. Codex on the web cannot connect to your own MCP server.
This guide shows the four ways to add your site to Codex, first with OAuth and then with an application password. All eight are in the video, each tested with a real change on a live site.
Key takeaways
- Four ways in, two ways to sign in. Add your site in the Codex app, in a terminal, in config.toml, or let Codex set it up from instructions you paste. Each works with OAuth or with an application password.
- Connect once, use it everywhere. The Codex app, the CLI and the IDE extension share one settings file,
~/.codex/config.toml. - Your password stays on your site. With OAuth you approve access on your own WordPress site, and Codex receives a token that only works through the Fabrement MCP server.
- Local sites work. Codex connects from your computer, so it reaches a local site with a trusted HTTPS certificate over OAuth, and any local site with an application password.
- Not on the web. Codex on the web cannot connect to your own MCP server. Use the app, the CLI or the extension.
Hand this to your AI first: fabrement.com/AGENTS.md. One link, and your agent knows what Fabrement can do on your site and how to connect to it.
Which way should you use?
| What you do | Best for | |
|---|---|---|
| Codex app Recommended | Add the server in Settings, then sign in | Most people: nothing to type |
| Terminal | Run two commands: one adds the site, one signs in | People who already use the Codex CLI |
| config.toml | Paste a short block into the Codex settings file | Developers who keep their Codex settings by hand |
| Let Codex set it up | Paste instructions into a Codex chat | Anyone who would rather not touch settings at all |
Use OAuth whenever you can: there is no password to copy, and you approve access on your own site. Use an application password when OAuth is not an option.
Before you start
- WordPress 6.9 or newer, PHP 8.0 or newer, and an administrator account.
- Fabrement installed and the site signed in to the Fabrement service: block code is checked and stored there, so nothing can be saved until the site is signed in.
- Codex in the ChatGPT desktop app, the Codex CLI, or the Codex extension for VS Code or Cursor, signed in to your account.
- For OAuth, a site on HTTPS with a trusted certificate. For a local site on plain
http://, use an application password.
Every connection detail below comes from Fabrement → MCP Connection in wp-admin, on the Codex card. Copy it from there rather than typing it: the server name and address are specific to your site.
1. Connect in the Codex app
Step 1: Copy the server name and URL
In Fabrement → MCP Connection, pick Codex and stay on the Recommended tab. It shows the Server name and the MCP server URL for your site, each with a copy button.
Step 2: Add the server in Codex
In Codex, open Settings → Plugins, click Add and choose Add MCP server. Paste the server name into Name, switch Type to Streamable HTTP, paste the MCP server URL into URL and click Save. Leave the token and header fields empty: OAuth needs none of them. In the IDE extension, MCP servers are under the gear icon.
Step 3: Sign in and approve access on your site
The server now shows on the MCPs tab under Servers. If it shows Authenticate, press it. Your WordPress site opens an authorization page that says exactly what Codex gets: full access through the Fabrement MCP server, with your administrator permissions. The token cannot sign in to wp-admin or call other REST API routes or other MCP servers, and your WordPress password is not shared. Press Allow access.
Step 4: Check the connection
Start a new chat and ask: Check if you have an MCP connection to your-site.com. Codex reads the site’s settings to prove the connection works, and changes nothing on the site.
Fabrement: the workplace for your AI agent
A free plugin for WordPress 6.9 or newer. Once your AI is connected, your agent can do all of this on your site.
2. Connect in a terminal
In Fabrement → MCP Connection, pick Codex, open the Advanced tab and expand Codex (OAuth). It offers three ways to add the site without the app form. Whichever you pick, the app, the CLI and the IDE extension all use it.
Under In a terminal, run both commands one by one. The first adds the site to Codex, the second opens your browser on the same approval page as in step 3 above. They have this shape, with your own name and address filled in:
codex mcp add fabrement-your-site --url "https://your-site.com/wp-json/fabrement/v1/mcp"
codex mcp login fabrement-your-siteKeep the terminal open until sign-in finishes: the approval returns to a temporary address on your own computer, which the CLI is listening on.
3. Connect with the config.toml file
Codex keeps its settings in config.toml, in the .codex folder in your home folder: ~/.codex/config.toml on macOS and Linux, C:\Users\you\.codex\config.toml on Windows. Add the block from ~/.codex/config.toml on the Advanced tab next to the servers already there; do not replace the file. It has this shape:
[mcp_servers.fabrement-your-site]
url = "https://your-site.com/wp-json/fabrement/v1/mcp"Then sign in with codex mcp login fabrement-your-site, or press Authenticate next to the server in the Codex app. This block holds no password, so the file stays safe to keep as it is.
4. Let Codex set it up
Under Let Codex set it up, copy the AI instructions and paste them into a new Codex chat. Codex adds the server itself: it keeps your other MCP servers, asks before replacing one with the same name, and only checks the connection, so it changes nothing on the site.
Codex may ask for permission to edit its settings file and to reach the network to test the connection. Approve both, sign in when it asks, then start a new chat to use the site.
5. Without OAuth: an application password
Use an application password when OAuth is not an option: the site has no HTTPS (for example a local http:// site), OAuth is turned off, or Codex runs where no browser can open to approve access, such as a server. In Fabrement → MCP Connection, pick Codex, open the Advanced tab, then Application password, and generate one. The same four ways then appear, with the password already filled in.
In the Codex app
Add a Streamable HTTP server with the name and URL, as in section 1. Then add a Headers row: paste Authorization into the key field and the Header value into the value field. Leave Bearer token env var empty.
In a terminal
The screen gives one set of commands for Windows PowerShell and one for Linux and macOS. They store the password in an environment variable and add the site to Codex. Start Codex from that same terminal afterwards: terminals and apps that were already running do not see the new variable, and on Linux and macOS it lasts only for that terminal session. For the desktop app, or a setup that lasts, use the Codex app or config.toml instead.
In config.toml
The block for config.toml now carries the password in an Authorization header. The app, the CLI and the IDE extension all read it. Because the file now holds the password, do not commit it to Git and do not share it.
Let Codex set it up
The AI instructions now include the password and tell Codex not to use OAuth. Paste them only into your own Codex, never into a shared chat.
The password is shown on this screen only, and it works until you revoke it. Treat it like an administrator password: keep it out of screenshots, recordings, chats and shared documents, and disconnect it in the Connection access card when the work is done.
Connected. What to build first
Once Codex answers with your site’s details, give it real work. Three requests to start with, in plain language:
- A section from a screenshot. Ask: “Build a team section from this screenshot and add it to the About page.” Codex writes it as a native block with editable fields, on your design system. See how it works: Gutenberg blocks built by your AI agent.
- A page from a design. Give Codex a link to a Figma frame and ask it to build the page. The steps are in turning a Figma frame into Gutenberg blocks.
- The frame of the site. Ask: “Build the header and the footer from this design and use them on every page.” More on that in building headers, footers and templates with AI.
When it does not work
| What you see | What it is |
|---|---|
| Codex on the web cannot find the site | Codex on the web cannot connect to your own MCP server. Use the Codex app, the CLI or the IDE extension. |
| The server is added, but Codex sees no tools | The chat started before you connected, or the server is switched off. Check its switch on the MCPs tab, then start a new chat. |
| The sign-in page did not open | Run codex mcp login with your server name, or press Authenticate next to the server in the app. |
| Sign-in starts, then fails | The terminal was closed before the approval came back. Run the login command again and keep the terminal open until it finishes. |
| 401, or «incorrect password» | With an application password: the Bearer token field is filled in, the header key is not exactly Authorization, the value was cut off when copied, or the password was revoked. Generate a fresh one. |
| Works in one terminal, not in another | The password was set as an environment variable in the first terminal only. Start Codex from that terminal, or move the connection to config.toml. |
| The server name is already taken | Another site or an older connection uses the same name. Pick a different name, or replace that connection on purpose. |
Revoking access
OAuth access and application passwords both stay active until you revoke them. The Connection access card on Fabrement → MCP Connection lists every connection to the site, whichever client set it up, with when it was created and last used. Press Disconnect next to one to revoke it, then remove the server in Codex too: on the MCPs tab in the app, or by deleting its block from config.toml. Revoking disconnects the agent immediately.
Frequently asked questions
Can Codex on the web connect to my WordPress site?
No. Codex on the web cannot connect to your own MCP server. Use the Codex app in the ChatGPT desktop app, the Codex CLI in a terminal, or the Codex extension for VS Code or Cursor. They run on your computer, so they can also reach a local site that has a trusted HTTPS certificate.
Do I have to connect the Codex app, the CLI and the IDE extension separately?
No. The Codex app, the Codex CLI and the IDE extension share one settings file, ~/.codex/config.toml, so a server you add in one of them shows up in the others. The one exception is an application password set as an environment variable in a terminal: only Codex started from that same terminal can see it. For a connection every Codex surface uses, add it in the app or in config.toml.
Does connecting ChatGPT also connect Codex?
No. Codex now runs inside the ChatGPT desktop app, but Fabrement treats ChatGPT and Codex as separate clients: each one has its own card in Fabrement → MCP Connection and its own approval. Connect the one you use, or both, and each appears on its own line in the Connection access card.
Why must the Bearer token field stay empty when I use an application password?
The application password is sent as a Basic Authorization header. Codex’s Bearer token field sends the key in a different format, which WordPress rejects with a 401 error. Put the Authorization header in the header field and leave the Bearer token field empty. With OAuth there is nothing to paste at all.
Can I connect Codex and Claude Code to the same site?
Yes. Connect each one separately, with OAuth or its own application password. Each connection gets its own line in the Connection access card on Fabrement → MCP Connection, so you can see which one was used last and disconnect one without cutting off the other.
Is it safe to give an AI agent access to my site?
Treat the connection like an administrator: whether it uses OAuth or an application password, the agent acts as your administrator user, with write and delete access to content. Connect only clients you trust, work on staging when the change is significant, keep versions so a change can be rolled back, disconnect the agent in the Connection access card when the work is done, and review anything that touches payments, authentication or personal data yourself.
Using another client? See how to connect Claude to WordPress, ChatGPT or Cursor.
Sources
- Model Context Protocol in Codex, OpenAI documentation (config.toml, Streamable HTTP servers,
codex mcp login, which Codex surfaces share the settings) - Fabrement AGENTS.md (what an agent can do on the site and how it connects)
Checked on 15 October 2026, with Fabrement 1.4.0. If a step has changed, tell us and we will correct it.
Related articles
How to Connect ChatGPT to WordPress to Build and Run Your Site
Connect ChatGPT and Codex to a WordPress site over MCP: Developer mode and OAuth in ChatGPT, Codex in the desktop app, the…
How to Connect Claude to WordPress to Build and Run Your Site
Connect Claude to a WordPress site in the browser, the desktop app or Claude Code: one-click OAuth, the terminal commands or a…
Running WordPress From Your Coding Agent: What MCP Actually Changes
The Model Context Protocol lets a coding agent operate WordPress directly instead of writing code you copy and paste. Here is what…