# Codex MCP: OG images and screenshots from OpenAI Codex

> Add the image API to OpenAI Codex as a remote MCP server: config.toml or codex mcp add, a bearer token from an env variable or OAuth.

Published 2026-11-06 · https://shareglint.com/en/mcp/codex

OpenAI Codex can render Open Graph images, take website screenshots and wire `og:image` tags into your code once Shareglint is one of its MCP servers. Add one table to `~/.codex/config.toml` — `url = "https://shareglint.com/mcp"` and `bearer_token_env_var = "OG_API_KEY"` — or run `codex mcp add` with the same values. The tools — `render_image`, `get_image`, `list_templates`, `get_template`, `create_signed_url`, `get_usage`, `generate_template`, `take_screenshot`, `auto_og_url`, `create_batch`, `get_batch` — run on your account and quota, 100 renders a month on the Free plan. Everything below is from OpenAI's Codex documentation, read on 2026-11-06.

For what an MCP server is, see [what is an MCP server](https://shareglint.com/en/guides/what-is-an-mcp-server); for the other apps, the [MCP server](https://shareglint.com/en/mcp-server) page.

## Set it up in config.toml

Codex "stores MCP configuration in config.toml … By default this is ~/.codex/config.toml, but you can also scope MCP servers to a project with .codex/config.toml (trusted projects only)", one `[mcp_servers.<server-name>]` table per server ([Codex MCP docs](https://learn.chatgpt.com/docs/extend/mcp?surface=cli)). For a remote Streamable HTTP server the keys are `url` and, for a token, `bearer_token_env_var` — the name of an environment variable whose value is sent in the `Authorization` header:

```toml
[mcp_servers.shareglint]
url = "https://shareglint.com/mcp"
bearer_token_env_var = "OG_API_KEY"
# Renders take seconds; GIF/MP4 and full-page screenshots can take longer.
tool_timeout_sec = 120
```

Create an API key in the Shareglint dashboard — a separate one for Codex, so you can revoke it alone — and export it where Codex starts:

```bash
# ~/.zshrc or ~/.bashrc
export OG_API_KEY="sk_live_…"
```

The file then holds no secret, so a project's `.codex/config.toml` can be committed and each developer sets their own `OG_API_KEY`.

## Or with the CLI

The same server, from the terminal ([Codex CLI reference](https://learn.chatgpt.com/docs/developer-commands?surface=cli)):

```bash
codex mcp add shareglint --url https://shareglint.com/mcp --bearer-token-env-var OG_API_KEY
codex mcp list
```

`codex mcp add` with `--url` registers a Streamable HTTP server; `--bearer-token-env-var` names the variable. `codex mcp list` shows configured servers, and `codex mcp remove` deletes one.

## Or sign in with OAuth

Codex's `auth` setting defaults to OAuth for remote servers, and our server supports it. Add the server without a bearer token, then:

```bash
codex mcp add shareglint --url https://shareglint.com/mcp
codex mcp login shareglint
```

A browser opens on the Shareglint login and a consent screen; approve, and Codex stores the credentials. No key sits in your environment, and you can disconnect Codex later from your account settings. An API key is simpler for scripts and CI; OAuth is tidier on a laptop.

## User or project config?

`~/.codex/config.toml` applies everywhere you run Codex; `.codex/config.toml` in a repository applies to that project, and only if you have marked the project as trusted. For a team, the project file is the convenient one: it contains the server's URL and the *name* of the token variable, nothing secret, so it can be committed, and each developer exports their own `OG_API_KEY` — or signs in with OAuth instead. For your own experiments across many repositories, the user file is simpler.

## Check that it works

- In the Codex terminal UI, `/mcp` lists the active MCP servers; the Shareglint entry should show its tools.
- In the IDE extension, the gear menu → **MCP servers** shows which servers are enabled and which need OAuth (**Authenticate**).
- The CLI, the IDE extension and the ChatGPT desktop app "share this configuration", so a server added once appears in all three.

Codex gives a server 10 seconds to start (`startup_timeout_sec`) and a tool 60 seconds to run (`tool_timeout_sec`) by default. A still image renders in seconds; an animated GIF or MP4 or a full-page screenshot of a slow site can take longer, which is why the example above sets 120.

## What Codex can do with it

A coding agent can act on the results:

- **Wire og:image into a project.** "Add per-page og:image tags to the blog using signed URLs; call create_signed_url once and write a test that our signing helper produces the same URL." The agent learns the algorithm from a real URL and checks its own code against it. The [signed URLs guide](https://shareglint.com/en/guides/signed-image-urls) has the reference implementations.
- **Check a design before committing.** "Render the blog-og card for the three newest posts and show me the URLs."
- **Backfill images.** "For every post in content/ without an image, render one and add its URL to the front matter" — `create_batch` with rows built from your files, then `get_batch`.
- **Screenshot a deployed page** for docs or a README with `take_screenshot` (a `selector` for one element, a `device` for a phone layout).

Prompt rule worth keeping: "never put the API key in application code". Pages should use signed URLs, which need the account id and signing secret, not the API key.

## Troubleshooting

**No tools, or an auth error.** `OG_API_KEY` was not set in the environment Codex started from; open a new terminal after editing your profile. Test the key outside Codex:

```bash
curl -s https://shareglint.com/mcp -H "Authorization: Bearer $OG_API_KEY" \
  -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

**A tool call times out.** Raise `tool_timeout_sec` for this server, or ask for a still image first.

**`take_screenshot` fails on localhost.** Our screenshot browser only reaches public addresses; use a preview deployment's URL.

**`quota_exceeded`.** `get_usage` shows what is left; calls fail at the limit and are never billed as overage ([pricing](https://shareglint.com/en/pricing)).

## Cost

Tool calls cost what API calls cost: one render per image and size, repeats free, `create_signed_url` free until the image is first fetched. The Free plan's 100 renders a month carry a watermark; Starter is $9 a month for 2,000 renders. Your Codex or ChatGPT plan is separate.

## FAQ

### Where does Codex keep its MCP servers?

In config.toml: ~/.codex/config.toml for your user, or .codex/config.toml in a trusted project. Each server is a [mcp_servers.<name>] table. The Codex CLI, the IDE extension and the ChatGPT desktop app share this configuration.

### How do I pass the API key without writing it into config.toml?

Set bearer_token_env_var to the name of an environment variable, for example OG_API_KEY. Codex reads the variable when it connects and sends its value as a Bearer token.

### Can I sign in with OAuth instead of an API key?

Yes. Leave out the bearer token, run codex mcp login with the server's name, and sign in to your account in the browser. OAuth is Codex's default for remote servers.

### Why does a long render time out?

Codex gives a tool 60 seconds by default (tool_timeout_sec). Still images take seconds, but an animated GIF or MP4 or a full-page screenshot of a heavy site can take longer; raise tool_timeout_sec for this server.