Skip to main content
Clientell AI MCP / Codex

How do I connect Codex to Salesforce?

To connect Codex to Salesforce, register the hosted Clientell AI MCP (Model Context Protocol) endpoint, https://mcp.clientell.ai/mcp, and put your workspace token in an environment variable called CLIENTELL_MCP_TOKEN. Codex sends that variable as a bearer token. The token is not a Salesforce credential. You connect Salesforce separately, in the Clientell AI web app.

Book a call with an expert Start the 14-day trialFull setup documentation
Before you start

What do you need before you add the server?

Two things come from the Clientell AI side. The first is a workspace token. You get it in the Clientell AI web app after you start the trial, authorize Salesforce and let the first index build. The second is the Clientell AI managed package, installed in the org you are connecting. Installing a package is an admin job, so if that is not you, ask early. Without it, Salesforce answers external_app_not_installed during sign-in, and the fix is on the troubleshooting page.

On the Codex side you need a working Codex CLI. The server is hosted, so nothing is installed for it. The Salesforce sf CLI is not needed to ask questions. You need it signed in only when you approve a deploy, because deploys run through your own sf session.

Install config

How do you add the server to Codex?

Export the token, then register the endpoint. Replace <YOUR_TOKEN> with your own and keep the quotes.

shell
export CLIENTELL_MCP_TOKEN="<YOUR_TOKEN>"
codex mcp add clientell --url https://mcp.clientell.ai/mcp \
  --bearer-token-env-var CLIENTELL_MCP_TOKEN

Or put this in ~/.codex/config.toml:

config.toml
[mcp_servers.clientell]
url = "https://mcp.clientell.ai/mcp"
bearer_token_env_var = "CLIENTELL_MCP_TOKEN"

The value of bearer_token_env_var is the name of the variable, not the token. Set the variable before you start Codex, in the same shell. If you export it in one terminal tab and launch Codex from another, Codex never sees it.

OpenAI’s Codex MCP page documents url and bearer_token_env_var in the file, and shows --url on codex mcp add. It does not show the bearer flag. If your build of Codex rejects the command above, use the file. It does the same thing.

Because the file holds a variable name and no secret, a project-level .codex/config.toml is safe to commit. Codex loads that file only for projects you have marked as trusted.

Check it

How do you know Codex can reach the server?

Check the endpoint first, then ask Codex what it sees.

Terminal
curl -I https://mcp.clientell.ai/mcp

A 401 or 403 means the server is up and wants a valid token, which is the right answer when you send no token. A 404 or 405 also means it is up, because MCP endpoints answer POST and not HEAD. No response at all points to the URL, DNS or your network. On Windows PowerShell use curl.exe.

Then run codex mcp list in a terminal. Inside the Codex terminal UI, type /mcp. Both list the servers Codex has loaded. clientell should be in the list.

First prompt

What should you ask first?

Start with a read-only question about something you are afraid to touch. Example prompt, not a saved run.

Codex prompt
What breaks if I delete Account.Custom_Segment__c? List the Flows,
Process Builder processes, Workflow Rules, Apex triggers, validation rules
and permissions that reference it, and stop before proposing any change.

Codex should call search_salesforce_metadata and list each dependent by name. If the answer says it was truncated, it is incomplete. Narrow the question and ask again. Check the list against the org before you delete anything.

Clientell AI asks before it changes anything in production. The same prompt works in Claude Code and Cursor.

Known issues

Why does Codex show no server, or a 401?

401 when the server starts
What it means

The token is empty, has a stray space or newline, or Codex was started from a shell that never had the variable.

Fix

Re-export the variable from a clean copy of the token, then start Codex from that same shell. Do not paste the token into chat or into a ticket to debug it.

MCP endpoint not found
What it means

The URL does not end in /mcp.

Fix

The full address is https://mcp.clientell.ai/mcp. Check the url line in config.toml.

Codex connects, but Salesforce sign-in fails
What it means

That is the second connection, between Clientell AI and your org. Codex is not involved.

Fix

Match the Salesforce error to a cause on why you cannot connect Claude, Cursor or Codex to Salesforce. The usual ones are a missing package, a sandbox login URL and API access.

FAQ

Questions people ask.

Does Codex work with the Clientell AI MCP server?

Yes. The Clientell AI MCP server works in Claude Code, Claude Cowork, Codex, Cursor and VS Code. In Codex you register the hosted endpoint and pass your workspace token through an environment variable.

Where does the token go in Codex?

Into an environment variable, not into the config file. Codex reads the variable named by bearer_token_env_var and sends its value as an Authorization: Bearer header. The file only holds the variable name.

Does Codex get my Salesforce password or session?

No. The token is a bearer credential for your Clientell AI workspace. It is not a Salesforce credential and cannot be used to reach Salesforce. You authorize Salesforce in the Clientell AI web app.

Can I use the Salesforce DX MCP server in Codex instead?

It reached end of life on 2 November 2026. Salesforce says the npm package stays installable and a pinned 0.30.15 setup keeps working, but nothing more ships. Salesforce points developers to skills at forcedotcom/sf-skills.

Keep going

Related pages.

Sources: OpenAI Codex MCP documentation (checked 4 Nov 2026), Clientell AI MCP documentation, Salesforce DX MCP end-of-life notice (posted 5 Oct 2026). Last reviewed November 2026.