| 1 | # OpenAI Codex CLI |
| 2 | |
| 3 | Configure OpenAI's Codex CLI to access your Netdata infrastructure through MCP for AI-powered DevOps operations. |
| 4 | |
| 5 | ## Transport Support |
| 6 | |
| 7 | Codex CLI supports both stdio launchers and direct Streamable HTTP when the RMCP client is enabled (https://github.com/openai/codex/blob/main/docs/config.md#mcp-servers). |
| 8 | |
| 9 | | Transport | Support | Netdata Version | Notes | |
| 10 | |-----------|---------|-----------------|-------| |
| 11 | | **stdio** (via `nd-mcp`) | ✅ Supported | v2.6.0+ | Default transport | |
| 12 | | **stdio** (via `npx mcp-remote`) | ✅ Supported | v2.7.2+ | Wraps Netdata HTTP/SSE in stdio | |
| 13 | | **Streamable HTTP** | ✅ Supported | v2.7.2+ | Requires `experimental_use_rmcp_client = true` | |
| 14 | | **SSE** | ❌ Not Supported | - | Use streamable HTTP or stdio bridge | |
| 15 | | **WebSocket** | ❌ Not Supported | - | Use stdio bridge | |
| 16 | |
| 17 | ## Prerequisites |
| 18 | |
| 19 | 1. **OpenAI Codex CLI installed** - Available via npm, Homebrew, or direct download from [GitHub](https://github.com/openai/codex) |
| 20 | 2. **Netdata v2.6.0 or later** with MCP support - Prefer a Netdata Parent to get infrastructure level visibility. Your AI Client (running on your desktop or laptop) needs to have direct network access to the Netdata IP and port (usually 19999). |
| 21 | - **v2.6.0 - v2.7.1**: Only WebSocket transport available, requires `nd-mcp` bridge |
| 22 | - **v2.7.2+**: Can use `npx mcp-remote` bridge for HTTP/SSE support |
| 23 | 3. **Launcher** – Run Netdata through `nd-mcp` (always) or `npx mcp-remote` (useful when you want a single stdio launcher for multiple MCP clients). Direct HTTP is also available for v2.7.2+ when you enable the RMCP client. |
| 24 | 4. **Optionally, the Netdata MCP API key** that unlocks full access to sensitive observability data (protected functions, full access to logs) on your Netdata. Each Netdata Agent or Parent has its own unique API key for MCP - [Find your Netdata MCP API key](/docs/netdata-ai/mcp/README.md#finding-your-api-key) |
| 25 | |
| 26 | ## Installation |
| 27 | |
| 28 | Install Codex CLI using one of these methods: |
| 29 | |
| 30 | ```bash |
| 31 | # Using npm (recommended) |
| 32 | npm install -g @openai/codex |
| 33 | |
| 34 | # Using Homebrew (macOS) |
| 35 | brew install codex |
| 36 | |
| 37 | # Or download directly from GitHub releases |
| 38 | # https://github.com/openai/codex/releases |
| 39 | ``` |
| 40 | |
| 41 | ## Configuration Methods |
| 42 | |
| 43 | Codex CLI uses a TOML configuration file at `~/.codex/config.toml` for MCP server settings. |
| 44 | |
| 45 | ### Netdata Cloud MCP |
| 46 | |
| 47 | Connect to your entire Netdata Cloud infrastructure |
| 48 | through a single endpoint — no local setup, bridges, |
| 49 | or firewall changes needed. |
| 50 | |
| 51 | **Prerequisites:** |
| 52 | |
| 53 | - Netdata Cloud account with a Paid plan |
| 54 | - Nodes claimed to Netdata Cloud |
| 55 | - API token with `scope:mcp` |
| 56 | ([create one](/docs/netdata-cloud/authentication-and-authorization/api-tokens.md)) |
| 57 | |
| 58 | ```toml |
| 59 | # ~/.codex/config.toml |
| 60 | |
| 61 | [mcp_servers.netdata-cloud] |
| 62 | url = "https://app.netdata.cloud/api/v1/mcp" |
| 63 | bearer_token_env_var = "NETDATA_CLOUD_API_TOKEN" |
| 64 | startup_timeout_sec = 20 |
| 65 | tool_timeout_sec = 120 |
| 66 | ``` |
| 67 | |
| 68 | Set the environment variable before starting Codex CLI: |
| 69 | |
| 70 | ```bash |
| 71 | export NETDATA_CLOUD_API_TOKEN="your-netdata-cloud-api-token" |
| 72 | ``` |
| 73 | |
| 74 | The token must have `scope:mcp`. For more details, see [Netdata Cloud MCP](/docs/netdata-ai/mcp/README.md#netdata-cloud-mcp). |
| 75 | |
| 76 | ### Local Agent or Parent |
| 77 | |
| 78 | The following methods connect directly to a Netdata Agent or Parent on your network. |
| 79 | |
| 80 | #### Method 1: Native Streamable HTTP (Recommended for v2.7.2+) |
| 81 | |
| 82 | Enable the RMCP client and point Codex directly at Netdata’s HTTP endpoint: |
| 83 | |
| 84 | ```toml |
| 85 | # ~/.codex/config.toml |
| 86 | |
| 87 | experimental_use_rmcp_client = true |
| 88 | |
| 89 | [mcp_servers.netdata] |
| 90 | url = "https://YOUR_NETDATA_IP:19999/mcp" |
| 91 | bearer_token = "${NETDATA_MCP_API_KEY}" |
| 92 | startup_timeout_sec = 20 |
| 93 | tool_timeout_sec = 120 |
| 94 | ``` |
| 95 | |
| 96 | > `bearer_token` is sent as `Authorization: Bearer <token>`. Consider sourcing it from an environment variable to avoid plain-text secrets. |
| 97 | |
| 98 | #### Method 2: Using `npx mcp-remote` (Works for HTTP or SSE) |
| 99 | |
| 100 | This launcher wraps Netdata’s remote transports in stdio for clients that cannot speak HTTP directly or when you prefer a consistent launcher across tools. For detailed options, see [Using MCP Remote Client](/docs/netdata-ai/mcp/README.md#using-mcp-remote-client). |
| 101 | |
| 102 | ```toml |
| 103 | # ~/.codex/config.toml |
| 104 | |
| 105 | [mcp_servers.netdata] |
| 106 | command = "npx" |
| 107 | args = [ |
| 108 | "mcp-remote@latest", |
| 109 | "--http", |
| 110 | "--allow-http", |
| 111 | "http://YOUR_NETDATA_IP:19999/mcp", |
| 112 | "--header", |
| 113 | "Authorization: Bearer NETDATA_MCP_API_KEY" |
| 114 | ] |
| 115 | startup_timeout_sec = 20 # Optional: increase for remote connections |
| 116 | tool_timeout_sec = 120 # Optional: increase for complex queries |
| 117 | ``` |
| 118 | |
| 119 | For SSE transport instead of HTTP: |
| 120 | |
| 121 | ```toml |
| 122 | [mcp_servers.netdata] |
| 123 | command = "npx" |
| 124 | args = [ |
| 125 | "mcp-remote@latest", |
| 126 | "--sse", |
| 127 | "http://YOUR_NETDATA_IP:19999/mcp", |
| 128 | "--allow-http", |
| 129 | "--header", |
| 130 | "Authorization: Bearer NETDATA_MCP_API_KEY", |
| 131 | ] |
| 132 | ``` |
| 133 | |
| 134 | #### Method 3: Using nd-mcp Bridge (WebSocket only) |
| 135 | |
| 136 | For environments where nd-mcp is available and preferred: |
| 137 | |
| 138 | ```toml |
| 139 | # ~/.codex/config.toml |
| 140 | |
| 141 | [mcp_servers.netdata] |
| 142 | command = "/usr/sbin/nd-mcp" |
| 143 | args = ["ws://YOUR_NETDATA_IP:19999/mcp"] |
| 144 | env = { "ND_MCP_BEARER_TOKEN" = "YOUR_API_KEY_HERE" } |
| 145 | startup_timeout_sec = 15 |
| 146 | tool_timeout_sec = 60 |
| 147 | |
| 148 | [mcp_servers.netdata_prod] |
| 149 | command = "/usr/sbin/nd-mcp" |
| 150 | args = ["ws://prod-parent:19999/mcp"] |
| 151 | env = { "ND_MCP_BEARER_TOKEN" = "${NETDATA_PROD_API_KEY}" } |
| 152 | ``` |
| 153 | |
| 154 | Export `ND_MCP_BEARER_TOKEN` before starting Codex CLI (or define it in your shell profile) so the bridge authenticates without exposing the key in command-line arguments. |
| 155 | |
| 156 | When Codex CLI starts the bridge it will inject the environment variable, so `nd-mcp` authenticates without exposing the token in the connection arguments. |
| 157 | |
| 158 | ## CLI Management (Experimental) |
| 159 | |
| 160 | Codex CLI provides experimental commands for managing MCP servers: |
| 161 | |
| 162 | ```bash |
| 163 | # Add a new MCP server |
| 164 | codex mcp add netdata -- npx mcp-remote@latest --http http://YOUR_NETDATA_IP:19999/mcp \ |
| 165 | --allow-http \ |
| 166 | --header "Authorization: Bearer NETDATA_MCP_API_KEY" |
| 167 | |
| 168 | # List configured MCP servers |
| 169 | codex mcp list |
| 170 | |
| 171 | # Remove an MCP server |
| 172 | codex mcp remove netdata |
| 173 | ``` |
| 174 | |
| 175 | ## Verify Configuration |
| 176 | |
| 177 | After configuring, verify that Netdata MCP is available: |
| 178 | |
| 179 | 1. Start Codex CLI: |
| 180 | ```bash |
| 181 | codex |
| 182 | ``` |
| 183 | |
| 184 | 2. Check available tools (if MCP is properly configured, Netdata tools should be available) |
| 185 | |
| 186 | Replace in all examples: |
| 187 | - `YOUR_NETDATA_IP` - IP address or hostname of your Netdata Agent/Parent |
| 188 | - `NETDATA_MCP_API_KEY` - Your [Netdata MCP API key](/docs/netdata-ai/mcp/README.md#finding-your-api-key) |
| 189 | - `/usr/sbin/nd-mcp` - With your [actual nd-mcp path](/docs/netdata-ai/mcp/README.md#finding-the-nd-mcp-bridge) (nd-mcp method only) |
| 190 | |
| 191 | ## How to Use |
| 192 | |
| 193 | Once configured, Codex CLI can leverage Netdata's observability data for infrastructure analysis: |
| 194 | |
| 195 | ``` |
| 196 | # Start Codex CLI |
| 197 | codex |
| 198 | |
| 199 | # Ask infrastructure questions |
| 200 | What's the current CPU usage across all servers? |
| 201 | Show me any performance anomalies in the last hour |
| 202 | Which services are consuming the most resources? |
| 203 | ``` |
| 204 | |
| 205 | ## Example Workflows |
| 206 | |
| 207 | **Performance Investigation:** |
| 208 | ``` |
| 209 | Investigate why our application response times increased this afternoon |
| 210 | ``` |
| 211 | |
| 212 | **Resource Optimization:** |
| 213 | ``` |
| 214 | Analyze memory usage patterns and suggest optimization strategies |
| 215 | ``` |
| 216 | |
| 217 | **Alert Analysis:** |
| 218 | ``` |
| 219 | Explain the current active alerts and their potential impact |
| 220 | ``` |
| 221 | |
| 222 | > **💡 Advanced Usage:** Codex CLI can combine observability data with code generation capabilities for powerful DevOps workflows. Learn about the opportunities and security considerations in [AI DevOps Copilot](/docs/netdata-ai/mcp/mcp-clients/ai-devops-copilot.md). |
| 223 | |
| 224 | ## Troubleshooting |
| 225 | |
| 226 | ### MCP Server Not Starting |
| 227 | |
| 228 | - Check the command path exists and is executable |
| 229 | - Increase `startup_timeout_sec` for slow-starting servers |
| 230 | - Verify network connectivity to Netdata |
| 231 | |
| 232 | ### Connection Timeouts |
| 233 | |
| 234 | - Ensure Netdata is accessible: `curl http://YOUR_NETDATA_IP:19999/api/v3/info` |
| 235 | - Increase timeout values in configuration |
| 236 | - Check firewall rules between Codex CLI and Netdata |
| 237 | |
| 238 | ### Limited Data Access |
| 239 | |
| 240 | - Verify the Authorization header is set to `Bearer <your key>` |
| 241 | - Ensure the Netdata agent is properly configured for MCP |
| 242 | - Check that MCP is enabled in your Netdata build |
| 243 | |
| 244 | ### Windows Issues |
| 245 | |
| 246 | - MCP servers may have issues on Windows |
| 247 | - Consider using WSL (Windows Subsystem for Linux) |
| 248 | - Check GitHub issues for Windows-specific workarounds |
| 249 | |
| 250 | ## Advanced Configuration |
| 251 | |
| 252 | ### Multiple Environments |
| 253 | |
| 254 | Configure different Netdata instances for different purposes: |
| 255 | |
| 256 | ```toml |
| 257 | # Production environment |
| 258 | [mcp_servers.netdata_prod] |
| 259 | command = "/usr/sbin/nd-mcp" |
| 260 | args = ["ws://prod-parent.company.com:19999/mcp"] |
| 261 | env = { "ND_MCP_BEARER_TOKEN" = "${PROD_API_KEY}" } |
| 262 | startup_timeout_sec = 30 |
| 263 | tool_timeout_sec = 120 |
| 264 | |
| 265 | [mcp_servers.netdata_staging] |
| 266 | command = "/usr/sbin/nd-mcp" |
| 267 | args = ["ws://staging-parent.company.com:19999/mcp"] |
| 268 | env = { "ND_MCP_BEARER_TOKEN" = "${STAGING_API_KEY}" } |
| 269 | |
| 270 | [mcp_servers.netdata_local] |
| 271 | command = "/usr/sbin/nd-mcp" |
| 272 | args = ["ws://localhost:19999/mcp"] |
| 273 | env = { "ND_MCP_BEARER_TOKEN" = "${LOCAL_API_KEY}" } |
| 274 | ``` |
| 275 | |
| 276 | ### Timeout Configuration |
| 277 | |
| 278 | Adjust timeouts based on your network and query complexity: |
| 279 | |
| 280 | ```toml |
| 281 | [mcp_servers.netdata] |
| 282 | command = "npx" |
| 283 | args = [ |
| 284 | "mcp-remote@latest", |
| 285 | "--http", |
| 286 | "http://remote-netdata:19999/mcp", |
| 287 | "--allow-http", |
| 288 | "--header", |
| 289 | "Authorization: Bearer NETDATA_MCP_API_KEY" |
| 290 | ] |
| 291 | startup_timeout_sec = 30 # Time to wait for MCP server to start |
| 292 | tool_timeout_sec = 180 # Time limit for individual tool calls |
| 293 | ``` |
| 294 | |
| 295 | ## Documentation Links |
| 296 | |
| 297 | - [OpenAI Codex CLI GitHub Repository](https://github.com/openai/codex) |
| 298 | - [Codex CLI Configuration Documentation](https://github.com/openai/codex/blob/main/docs/config.md) |
| 299 | - [Codex CLI Installation Guide](https://github.com/openai/codex#installation) |
| 300 | - [Netdata MCP Setup](/docs/netdata-ai/mcp/README.md) |
| 301 | - [AI DevOps Best Practices](/docs/netdata-ai/mcp/mcp-clients/ai-devops-copilot.md) |