How to connect your WordPress site to the Codex CLI
OpenAI's Codex CLI can operate your self-hosted WordPress site from the terminal — publishing posts, running WP-CLI, and reading the error log to explain what broke. Install the free Cowboy MCP plugin, run one codex mcp add command to register your site as a remote MCP server, and click Approve on your own site. One-click sign-in means no API key to export, store, or lose, and no Node proxy. New to MCP? Start with the WordPress MCP server guide.
What can Codex do on your WordPress site once it's connected?
Once connected, the Codex CLI acts on your live site with real tools, not just code it prints back for you to paste. From the terminal it can vibe code a theme tweak, run WP-CLI commands, read the PHP error log to debug a fatal, and make bulk edits across posts or WooCommerce products. Cowboy MCP exposes 203 WordPress tools that Codex calls directly over HTTPS.
How do you connect Codex to WordPress in three steps?
Connecting takes one command and about two minutes. Install the Cowboy MCP plugin, run the codex mcp add command from the Codex panel under Settings → Cowboy MCP, and click Approve on the page Codex opens on your own site — one-click sign-in. There's no key to export or keep in your shell profile, and no setting to switch on first. You decide exactly what Codex may do before it can do anything, and it works the same on a local dev site.
- 1
Install the free plugin
In WordPress, go to Plugins → Add New, search for Cowboy MCP, and click Install then Activate.
- 2
Add the server
Open Settings → Cowboy MCP, pick Codex on the Connections tab, and run its codex mcp add command in your terminal.
- 3
Click Approve
Codex opens a sign-in page on your site. Choose what it may do — everything, read-only, or just the tools you pick — and click Approve. Nothing is allowed until you do.
Then start Codex and run /mcp — your site should be listed with its tools.
Headless or CI? Generate an API key on the Connections tab (it's shown once), export COWBOY_MCP_API_KEY="YOUR_API_KEY" in your shell profile, and add --bearer-token-env-var COWBOY_MCP_API_KEY to the command — Codex reads the variable each time it starts.
Why doesn't Codex need a Node.js proxy to reach WordPress?
Many MCP setups run a local Node.js process that bridges the agent and a remote service. The Codex CLI needs none of that to reach WordPress. Cowboy MCP publishes its MCP endpoint as an ordinary WordPress REST route at /wp-json/cowboy-mcp/v1/endpoint, so Codex connects to your site directly over HTTPS — no Node bridge, no npm proxy, and nothing extra running on your machine. The plugin is itself the MCP server.
Because the endpoint speaks standard Streamable HTTP, the connection lives on your server rather than in a background daemon — it survives reboots and laptop swaps. The same site works for every MCP client, too: Claude Code, the Claude desktop and web apps, Cursor, and Gemini all reach the same tools. Only the setup command changes from one client to the next.
Is it safe to run Codex against your live production site?
Yes, with the same guardrails the plugin applies to every client. Safe mode is on by default, so destructive tools ask before they run. Any write can be previewed as a dry run, every change lands in an undo journal you can roll back, and requests are rate-limited to 120 per minute. You choose Codex's access level when you approve the sign-in, and can revoke it from the Connections tab — it all runs on your own server. More on security →
Questions, answered.
Do I need Node.js to connect WordPress to Codex?
No — the plugin needs no Node.js. Cowboy MCP runs entirely inside WordPress as a REST endpoint, so there's no Node bridge and no proxy to keep running. Installing the Codex CLI itself is OpenAI's requirement, and that step may use npm — but that's Codex's own tooling on your machine, not anything Cowboy MCP adds to your WordPress site.
Do I need an API key to connect Codex?
No — that's the point of one-click sign-in. After codex mcp add, Codex opens a sign-in page on your own site, where you choose full access, read-only, or a custom list of tools and click Approve. There's no secret to export or store, so there's nothing to leak, and Codex is recognised automatically, so there's no setting to switch on first. API keys remain for headless setups and CI: generate one on the Connections tab under Settings → Cowboy MCP (it's shown once and stored only as a hash), export it as COWBOY_MCP_API_KEY in your shell profile, and add --bearer-token-env-var COWBOY_MCP_API_KEY to the command. Every connection and key is listed there with one-click revoke.
Codex CLI or ChatGPT's connector — which should I use for WordPress?
Both reach the same tools on your site, so pick the one you already work in. The Codex CLI connects from the terminal with one command and one-click sign-in. ChatGPT's connector needs no terminal at all — the connect WordPress to ChatGPT guide covers that path.
Is it safe to run Codex on a production site?
Yes, with care. Safe mode asks before destructive actions, any write can be previewed as a dry run, and every change lands in an undo journal you can roll back. Approve Codex read-only or with a custom tool list if it doesn't need everything, take a database checkpoint before big changes, and review the audit log regularly.
Ready to connect Codex to your WordPress site?
Install the free, open-source Cowboy MCP plugin, run one command, and approve the sign-in in your browser — the Codex CLI is managing your site minutes later. It works on any self-hosted WordPress site running version 6.2 or newer on PHP 8.0+. Prefer a different agent? The same site connects to Claude Code and the Claude desktop and web apps too.