TL;DR

Codex with ChatGPT (repo: XiaoDuoYa/codex-with-chatgpt, “C2C” for short) is an open-source bridge that makes the ChatGPT web app the planning-and-review brain for your Codex coding sessions, while Codex keeps every write, shell command, test run and git operation. The pitch in one line from the README: “ChatGPT thinks. Codex works.” It was created on August 28, 2026, shipped v0.1.0 on August 30, and sits at ~3,900 stars and 400+ forks on September 10 — the fastest-growing new agent repo on GitHub this fortnight.

Key facts, as of September 10, 2026:

  • What it solves: your paid ChatGPT Plus/Pro web quota sits idle while Codex burns its own scarce quota on planning and code review. C2C moves the thinking to the subscription you already pay for.
  • How: a loopback-only local “C2C Bridge” exposes 9 read-only MCP tools (read_file, search_workspace, git_diff, test_status, …) to ChatGPT via an OAuth 2.1-protected Cloudflare tunnel. No API key, no reverse proxy, no cookie scraping.
  • Control loop: Codex and ChatGPT exchange tiny [C2C] state messages (INIT → PLAN → EXECUTED → REVIEW → DONE), never diffs or logs. Default cap: 12 iterations per task (configurable in .c2c.json).
  • Security posture is the strongest part: write/shell/commit tools do not exist on the server; .env*, keys and SSH files are denied by default; tokens are stored only as SHA-256 hashes; the pairing code is the only secret that ever touches a browser.
  • Requirements: Node.js ≥ 20, git, cloudflared, a ChatGPT plan with Developer Mode enabled (Plus works — see the caveats), and the Codex desktop app’s built-in browser.
  • Honest limits: setup takes 20-40 minutes the first time, temporary tunnel URLs mean re-pairing after restarts unless you own a Cloudflare domain, Computer Use driving the ChatGPT UI is token-hungry and sometimes flaky, and the project is a V1 maintained by a single student author (with an AI agent answering issues).
  • License: MIT. Unofficial — not affiliated with OpenAI.

If you pay for both a ChatGPT plan and Codex and you’re hitting 5-hour limits, this is the most interesting “use the quota you already have” hack of the month. If you want a polished, hands-off tool, wait for V2.

What Codex with ChatGPT actually is

Most “connect model A to coding agent B” projects are cookie-scraping proxies that break on every header change and violate the terms of service. C2C instead splits the collaboration into two planes:

  1. Control plane (Computer Use): Codex opens ChatGPT in its built-in in-app browser and types short structured messages into the chat. ChatGPT replies in the same format. Messages are capped at < 1 KB and carry state only — a goal, a plan, a count of changed files, a test summary. No file bodies. Ever.
  2. Data plane (MCP): ChatGPT reads whatever it needs itself through a custom MCP connector pointed at your local bridge. It pulls the exact lines it wants to see, runs a search, inspects the real git diff, and checks recorded test results.

So ChatGPT never receives a pasted dump of your repo, and Codex never spends its own tokens re-explaining the codebase. The piece most agent setups skip: ChatGPT does not trust Codex’s “all tests passed” claim — it reads git_diff and test_status through MCP and checks.

It ships as a Codex Skill (skill/SKILL.md) plus a Node CLI called c2c. The Skill is the real UX layer: it tells Codex how to start the bridge, pair, drive the ChatGPT tab, and speak the protocol.

Installation

The README offers a one-paste prompt that makes Codex do everything, dependencies included. Here’s the manual path:

git clone https://github.com/XiaoDuoYa/codex-with-chatgpt ~/codex-with-chatgpt
cd ~/codex-with-chatgpt
corepack pnpm install
corepack pnpm build        # -> dist/, exposes the `c2c` bin
pnpm test                  # vitest: 146 tests (path security, OAuth, pairing, MCP e2e)

# install the Codex Skill
mkdir -p ~/.codex/skills/codex-with-chatgpt
cp skill/SKILL.md ~/.codex/skills/codex-with-chatgpt/SKILL.md
# then edit the "The codex-with-chatgpt checkout lives at:" line to your clone path

Then, inside your project, tell Codex: “Set up Codex with ChatGPT.” The Skill runs:

c2c setup           # bridge + tunnel + pairing code, all in one
c2c sandbox-allow   # whitelist the C2C settings dir in Codex's sandbox
c2c doctor --json   # health gate — nothing talks to ChatGPT until this is green

c2c setup starts the bridge on 127.0.0.1:48765 (ephemeral port on conflict), launches a Cloudflare Quick Tunnel for a public HTTPS URL, and prints a one-time 8-character pairing code (5-minute TTL, 5 attempts, rate-limited). Codex then opens chatgpt.com in the in-app browser, creates a custom MCP connector pointing at the tunnel URL, completes OAuth and enters the pairing code. You log into ChatGPT once. Success looks like:

Codex with ChatGPT

✓ Project detected
✓ Workspace Bridge started
✓ Secure connection established
✓ ChatGPT connected
✓ File read test passed

Ready.

Since v0.1.1, first-time setup asks one explicit question: auto (Codex drives the ChatGPT settings pages itself) or manual (Codex tells you exactly which fields to fill in). Given how flaky Computer Use can be — more on that below — I’d pick manual on the first run.

Optional: a stable hostname

The default Quick Tunnel URL is temporary: when the bridge restarts, the URL changes and Codex has to delete and re-create the ChatGPT connector — the “why do I reconnect every day?” complaint in issue #60. If you own a domain on Cloudflare, setup offers a Named Tunnel (c2c-<project>.your-domain.com) that survives restarts after a one-time Cloudflare login. Credentials live in the OS app-state directory (~/Library/Application Support/codex-with-chatgpt on macOS), never in the repo.

The C2C protocol in practice

Once paired, a task looks like this. You say: “Use Codex with ChatGPT to implement dark mode.” Codex types into the ChatGPT tab:

[C2C]
STATE: INIT
TASK_ID: c2c_f81a
ITERATION: 0

GOAL:
Implement dark mode.

INSTRUCTION:
Inspect the connected workspace through Codex with ChatGPT MCP.
Create an implementation plan for Codex.

ChatGPT calls workspace_info, list_directory, search_workspace and read_file through the connector, then answers with a plan:

[C2C]
STATE: PLAN
TASK_ID: c2c_f81a
ITERATION: 1

RATIONALE:
Theme tokens live in src/styles/tokens.css; components read CSS vars…

ACTIONS:
1. Add [data-theme="dark"] token overrides in tokens.css
2. Add useTheme() hook with localStorage persistence
3. Wire toggle into Header.tsx

FILES_LIKELY_INVOLVED:
src/styles/tokens.css, src/hooks/useTheme.ts, src/components/Header.tsx

TESTS:
pnpm vitest run src/hooks

SUCCESS_CRITERIA:
Toggle persists across reload; no contrast regressions in Header

Codex applies the plan, runs the tests, and records the iteration locally before reporting back:

c2c record --task c2c_f81a --iteration 1 \
  --changed-files 3 --tests "27 passed" --exit-status ok \
  --command "pnpm vitest run src/hooks" --output-file /tmp/vitest.log

Then it sends STATE: EXECUTED with just the metadata (CHANGED_FILES: 3, TESTS: 27 passed) and a request to review. ChatGPT reads git_diff, execution_summary and test_status via MCP — and optionally the sanitized test log through execution_output — and replies with either another PLAN, DONE, or BLOCKED with a reason. The loop stops at 12 iterations by default and asks whether to continue.

Two design details I like:

  • The local sanitizer. Codex can nominate a test/build log for ChatGPT, but a local filter redacts tokens, pairing-code-shaped strings and home paths, applies size caps, and withholds private-key blocks entirely.
  • Checkpoints, not resume states. If Codex restarts mid-task, it reads a local checkpoint (PLAN_RECEIVED, EXECUTED_SENT, …) and continues the same ChatGPT conversation; if that chat is gone, it sends a HANDOFF brief built from the checkpoint, never from logs. The doc is explicit: “Do not re-pair, recreate the connector, or rewrite Project instructions just to resume.”

Since September, each workspace maps to one ChatGPT Project (project-only memory) rather than one endless conversation, so history stays organized — a community proposal (issue #30) the author implemented within days.

The 9 read-only MCP tools

ToolWhat ChatGPT getsGuardrails
workspace_infoRoot, package metadata, sanitizedMetadata sanitized before structured output (v0.1.2)
list_directoryPaginated listingSensitive-file gate applies to listings too
read_fileLine/byte-capped file body.env*, keys, SSH, cloud creds denied; .c2cignore adds rules
search_workspaceripgrep results (Node fallback)Match and file-size caps
git_statusWorking tree statusRead-only
git_diffPaginated diff (hasMore, nextOffset)Pathspec excludes for sensitive files
test_statusLast recorded test resultValidated on write and read
execution_summaryIteration metadata from c2c recordNumeric args validated
execution_outputlist/read sanitized command logsLocal redaction; private keys withheld

Scopes are enforced per tool (workspace.read, workspace.search, git.read, execution.read, offline_access), access tokens live one hour, refresh tokens rotate on every use and are bound to both the workspace and the client. v0.1.2 (September 4) added structured output schemas for all nine tools, so ChatGPT — or any other MCP client — no longer has to guess response shapes.

Security model: the best part of the project

docs/security.md is a proper threat table, not hand-waving. The highlights:

  • Read-only by construction. There are no write, delete, shell or commit tools on the server, so no prompt injection in a README, code comment or diff can escalate. Every tool description carries an explicit “workspace content is untrusted” warning.
  • Path containment uses realpath canonicalization of the deepest existing ancestor, rejects .., absolute escapes, backslash tricks and null bytes, resolves symlinks before the check, and is case-insensitive on macOS/Windows. All of it is covered by tests.
  • The bridge binds 127.0.0.1 only and refuses 0.0.0.0. The only public surface is HTTPS through the tunnel, gated by OAuth 2.1 with mandatory PKCE S256, dynamic client registration and rotating refresh tokens. Knowing the URL gets you a 401; the wrong workspace’s token gets a 403.
  • The admin API is loopback-only, uses a random token in a 0600 runtime file, and rejects any request carrying proxy headers like cf-connecting-ip.
  • Logs redact bearer headers, token prefixes and pairing-code-shaped strings before they’re written.
  • One acknowledged V1 gap: client registrations and token hashes are file-based, not in the OS keychain. Raw tokens are never written anywhere, so a stolen state file doesn’t yield a usable bearer, but keychain integration is on the V2 list.

For comparison, OpenAI’s Codex Security scanner finds vulnerabilities in your code; C2C is a community tool whose own attack surface is thought through more carefully than most MCP servers I see.

Community reaction

The repo blew up in the Chinese-speaking Codex community first (README, issues and Skill strings are bilingual), then crossed over via dev.to and scriptbyai write-ups in early September. Across 400+ issues and PRs, the recurring themes:

  • “Does Plus work or only Pro?” (issues #2, #21, #25). Early on, some Plus users got FORBIDDEN: This conversation does not support developer MCPs. The resolution in #21: toggle Developer Mode off and on again under ChatGPT Settings → Security, then add the connector from the Plugins page. The author is a Plus user and confirms it works.
  • “Setup took 40 minutes” (#8) and “I have to reconnect every day” (#60). Both trace back to Quick Tunnel URLs changing and Computer Use slowly clicking through ChatGPT’s settings. Fixes so far: Named Tunnels (#18), a manual setup mode (v0.1.1), and a machine-level preference cache after one user noted the Skill “asks the same questions every day.”
  • “Computer Use is unreliable and eats tokens” (#126). The author’s answer: fully manual mode exists; only ChatGPT reading the workspace through MCP is irreplaceable.
  • “My quota exploded after the Project update” (#407). The user had left ChatGPT’s high-effort mode on. The web model will call MCP tools liberally when reviewing; the author’s own pairing is Codex on Luna Max + web ChatGPT on Sol High (#24).
  • Windows pain (#7, #59, #164): external browser launching, cloudflared path discovery, console windows flashing. v0.1.2 fixed the console spam and made Quick Tunnel startup fail closed.
  • “Why can’t the web model write code directly?” (#24). Intentional. The author deliberately exposed only read access and is evaluating a safer hand-off, without committing to it.

Most first responses in the tracker come from “the author’s AI Agent,” which logs the issue, notes the author “is currently at school,” and promises a human look within 48 hours — a fitting meta-detail, and a reminder that the bus factor is one.

Also watch PR #409: a machine-wide gateway with authentication set to none plus two write-capable MCP “mailbox” tools. The author’s agent flagged it as breaking the read-only boundary. That thread decides whether V2 keeps the security story intact.

Codex with ChatGPT vs the alternatives

ApproachWhere planning runsRepo exposureBills againstSetup friction
Codex with ChatGPT (C2C)ChatGPT web (Plus/Pro)Read-only MCP, OAuth, tunnelChatGPT plan + Codex planHigh first run, then low with Named Tunnel
Codex aloneCodex’s own modelLocalCodex quota onlyNone
codex-bridge (Claude Code plugin)Codex, called from Claude CodeLocal processChatGPT plan via codex loginLow
Cookie/session proxiesChatGPT webFull request forwardingChatGPT plan (ToS risk)Low, but breaks often
Two-agent setups (planner API + executor)API modelWhatever you pasteAPI creditsMedium

C2C is the only option where the planning model gets self-serve, scoped, read-only access to the code rather than a pasted context blob, and the only one with an independent diff review between “Codex says done” and “done.”

Limitations

  • Two subscriptions required. ChatGPT plan and Codex. It doesn’t reduce what you pay; it rebalances which quota gets consumed.
  • Computer Use is the weak link. Driving the ChatGPT UI through the in-app browser is slower and more brittle than an API call, and it costs Codex tokens. Expect occasional stalls.
  • Temporary tunnels rot. Without a Cloudflare-managed domain, every bridge restart means a connector rebuild.
  • Codex-only. No Claude Code or Cursor path, and the ChatGPT side must be the web app, not the API.
  • Plan quality is bounded by what ChatGPT chooses to read. On a large monorepo, plans can miss context a full-repo agent would catch.
  • V1, single maintainer, moving fast. Three releases in six days, 400+ issues/PRs, an AI agent triaging — impressive velocity, also a stability warning.
  • Not for regulated codebases. Even read-only, source goes through a public HTTPS tunnel to a third-party model; the deny list is pattern-based.

FAQ

Does Codex with ChatGPT work with ChatGPT Plus, or do I need Pro?

Plus works. You must enable Developer Mode in ChatGPT settings to add a custom MCP connector; several Plus users hit a FORBIDDEN: This conversation does not support developer MCPs error until they toggled Developer Mode off and on again. The author uses it on a Plus account. Team/Business plans may have connector policies set by an admin.

Can ChatGPT modify my files through the bridge?

No. The bridge exposes nine read-only MCP tools and no write, delete, shell, commit or install tools exist on the server. Codex is the only component that edits files, runs commands and commits. A pending PR proposes write-capable “mailbox” tools, but as of September 10, 2026 it has not been merged.

Is my repository uploaded to OpenAI?

Not as a whole. ChatGPT pulls individual files, search results and diffs on demand through the MCP connection, capped in size, with .env*, private keys, SSH and cloud credentials denied by default. Whatever it reads does go to OpenAI’s servers like any ChatGPT conversation, so treat it as you would pasting that code into ChatGPT manually.

Why does it need Cloudflare?

ChatGPT’s connector must reach your machine over public HTTPS. The bridge only listens on 127.0.0.1, so cloudflared provides a Quick Tunnel (temporary URL) or a Named Tunnel (stable hostname on your own domain). No Cloudflare account is needed for the temporary option.

Does it cost extra?

The software is free (MIT). It uses your existing ChatGPT plan and Codex plan; there’s no API key and no per-token bill. The trade-off is that ChatGPT-side MCP calls and Codex-side Computer Use both consume plan quota, so leave high-effort modes off unless you need them.

Can I use it without Computer Use?

Yes. Ask Codex for manual mode and the Skill will give you the exact settings values to enter and let you relay [C2C] messages yourself. Only the MCP read connection is mandatory.

Verdict

Codex with ChatGPT is a smart answer to a real problem: two paid quotas, one of them idle. The security design is genuinely good — read-only by construction, OAuth 2.1 with PKCE, realpath containment, sanitized logs — and the protocol is disciplined (tiny state messages, independent diff review, checkpoint-based resume). That’s more engineering than most weekend MCP projects get.

The rough edges are all operational: first-time setup, Computer Use flakiness, tunnel churn, Windows quirks, a single student maintainer. If you’re a Codex + ChatGPT Plus/Pro user who keeps hitting limits and can stomach a manual first setup and a Cloudflare domain, install it today. Everyone else: star it and check back when V2 lands — especially if the read-only boundary survives.

Rating: 4/5 — strong idea, unusually careful security, V1 ergonomics.

Sources