Use Rail Cove from Codex
Add Rail Cove's Streamable HTTP MCP server to Codex with an environment-backed personal key or the OAuth login flow.
Follow the steps
For a personal-key connection, create a Rail Cove key with only the MCP scopes you intend to expose and set RAIL_COVE_API_KEY in the environment visible to the local Codex process.
Add the server with codex mcp add rail-cove --url https://YOUR_DEPLOYED_API_ORIGIN/mcp, then inspect it with codex mcp list.
Bind the key without putting it in the URL by adding a server entry with url = https://YOUR_DEPLOYED_API_ORIGIN/mcp, bearer_token_env_var = RAIL_COVE_API_KEY, enabled_tools = [list_canvases, read_canvas, search_library], and default_tools_approval_mode = prompt.
For OAuth, run codex mcp add rail-cove --url https://YOUR_DEPLOYED_API_ORIGIN/mcp followed by codex mcp login rail-cove, then complete the Rail Cove browser consent with the minimum scopes.
For local development only, use http://localhost:4100/mcp when Codex and the API are on the same machine. A remote hosted client cannot reach that address.
Choose only the access you need
Personal keys always expire: the default is 90 days and the maximum is 365 days. Choose a non-empty subset of the available scopes and revoke the key when the connection is finished.
| Scope | What it allows | MCP tools |
|---|---|---|
boards:write | Capture selected web content to editable canvases. Also requires library:write. | REST capture endpoint; no additional MCP tool |
boards:read | List and read canvases the account can view. | list_canvases, read_canvas |
library:read | List and search the account’s own library. | search_library |
library:write | Create, update and delete library items through REST. | capture_note |
Code examples
Replace placeholders in your own protected environment. Never paste a real key into a public page, browser bundle, prompt, screenshot, issue or repository.
codex mcp add rail-cove --url https://YOUR_DEPLOYED_API_ORIGIN/mcp
codex mcp login rail-cove
codex mcp list[mcp_servers.rail-cove]
url = "https://YOUR_DEPLOYED_API_ORIGIN/mcp"
bearer_token_env_var = "RAIL_COVE_API_KEY"
enabled_tools = ["list_canvases", "read_canvas", "search_library"]Connect external tools safely
A narrated walkthrough with English captions and a full transcript.
Read the transcript
Rail Cove has three different kinds of connection. Server provider keys stay in the private environment, personal keys call approved API scopes, and MCP apps connect through OAuth.
When a direct API client needs access, create a named personal key with only the scopes it needs. Copy it once, store it in a secret manager, and never place it in browser code.
For MCP, let the client open Rail Cove's consent screen. Check the application name and requested scopes before you allow access.
Return to Settings and Connections to review access. Revoke the key or MCP application when you no longer use it; the connection stops without changing your ordinary sign-in session.
What to know
- Keep capture_note out of enabled_tools unless the user intentionally wants Codex to create inbox notes.
- The personal-key setup and OAuth setup are separate. OAuth uses Rail Cove's discovery, PKCE, exact resource binding, and grant revocation path.
- Codex approval settings are a client control. They do not expand the Rail Cove scopes granted to the key or OAuth connection.
Troubleshooting
- If Codex cannot connect, confirm the URL ends in /mcp and that the deployed origin is reachable over HTTPS.
- If the server connects but a tool is missing, inspect enabled_tools and the Rail Cove credential scopes.
- If OAuth login fails, remove a stale server entry and repeat codex mcp add and codex mcp login with the exact endpoint.
- If a local URL works only on one machine, that is expected. Use a public deployed origin for a remote Codex process.
Official references
External client details were checked against these first-party sources.
- developers.openai.comChecked 2026-09-12
- developers.openai.comChecked 2026-09-12