Codex on Ownkube

OpenAI · Terminal

TerminalMCPOAuth

Codex is OpenAI's coding agent for the terminal. It reads MCP servers from its config file. Bridge it to Ownkube with mcp-remote and Codex can deploy your app, tail logs, and manage databases from your shell.

Connect Codex Codex MCP docs

// quick_start

Connect in four steps

Install Codex

Get Codex on your machine if you do not have it yet.

terminal

npm install -g @openai/codex

Add the Ownkube MCP server

This uses mcp-remote, a small bridge that connects a local (stdio) MCP client to the remote endpoint and runs the browser sign in for you. It needs Node and npx on your machine.

~/.codex/config.toml

[mcp_servers.ownkube]
command = "npx"
args = ["-y", "mcp-remote", "https://app.ownkube.io/api/mcp"]

Authorize in your browser

The first time Codex starts the ownkube server, mcp-remote opens a browser tab for you to sign in and choose an organization. After that it reuses the saved token.

Deploy your first app

Open your project and ask in plain language. The agent picks a region, deploys on Ownkube Compute, and hands you back a live URL.

prompt

Deploy this project to Ownkube Compute and give me the live URL.

Setup menus and config paths can shift as each tool updates. The endpoint and the browser sign in never change. When in doubt, open the Codex MCP docs.

// mcp_configuration

One endpoint, one sign in

endpoint https://app.ownkube.io/api/mcp

auth

OAuth 2.1 with a browser sign in and an organization picker. There is no API key to paste. You approve access once and can revoke it any time.

transport

Streamable HTTP. The server reports itself as "ownkube" and exposes about 77 tools.

// example_prompts

Ask Codex to

›Deploy this repo to Ownkube Compute and give me the live URL.

›Add a managed Postgres database and wire the connection string into my app.

›Tail the logs for my api service and tell me why it keeps restarting.

›Set a CPU and memory limit on my web service, then show the projected monthly cost.

›Roll back my last deploy to the previous healthy revision.

›Spin up a Valkey cache and connect it to my app.

›Create an alert that fires when my worker restarts more than three times in ten minutes.

›Add a scheduled job that runs my cleanup script every night at 2am UTC.

›Check my wallet balance and top it up if it is under five dollars.

›Set up a staging environment that mirrors production.

// available_tools

What the agent can reach

The agent loads tools on demand. It does not need the whole catalog in context to start, it searches for the tool it needs and calls it.

Deployments create_deployment, list_deployments, get_deployment_status, restart_deployment, rollback_deployment

Logs and metrics get_deployment_logs, get_deployment_telemetry, get_deployment_observability, get_build_logs

Databases and caches create_deployment (postgres or valkey), get_database_telemetry, get_cache_telemetry

Clusters and cloud list_clusters, create_cluster, connect_aws_account, list_regions

Alerts create_alert_rule, list_alert_rules, list_alert_firings

Custom domains link_custom_domain, verify_custom_domain, list_custom_domains

Billing and wallet get_wallet, top_up_wallet, get_current_usage, get_projected_month_cost

Reading live database or cache credentials, resetting a database password, and point-in-time database recovery stay in the okctl command-line client by design, not the agent.

// common_workflows

Common workflows

Deploy a new app

01 Ask the agent to deploy the repo you are in.
02 It picks an Ownkube Compute region, no cloud account needed.
03 It creates the deployment and returns the live URL.
04 Ask it to set environment variables and it applies them in place.

Add a Postgres database

01 Ask for a managed Postgres database next to your app.
02 The agent creates the database on the same region.
03 It reads back the host and port and sets the connection string as an env var.
04 Credentials that are secret stay in okctl by design.

Debug a failing deploy

01 Ask why a service is unhealthy.
02 The agent pulls recent logs and the deploy status.
03 It explains the failure in plain language.
04 Ask it to roll back and it returns you to the last healthy revision.

Right-size and cap spend

01 Ask what the app is costing this month.
02 The agent reads current usage and the projected month cost.
03 It sets CPU and memory limits, or switches to a flat-price reserved box.
04 Ask it to top up the wallet so nothing pauses.

// tips

Tips for a smooth setup

Sign in once in the browser. The access token is scoped to the organization you pick, and you can switch per request.
Say "use Ownkube Compute" to deploy with no cloud account and no cluster to provision.
Ask the agent to confirm its plan before it creates, scales, or destroys anything.
Every read tool returns structured data, so the agent can chain results without guessing.
Sensitive actions (database passwords, live connection secrets, point-in-time recovery) stay in okctl, not the agent.

// faq

Questions

How do I give my agent access to Ownkube?

Add the Ownkube MCP server at https://app.ownkube.io/api/mcp, then sign in through your browser and pick an organization. There is no API key to paste. Your agent talks to the same platform the dashboard does.

Is it safe to let an agent operate my account?

Access uses OAuth 2.1 with PKCE and an org-scoped consent screen that you approve in the browser. You can revoke a connection at any time. A handful of destructive actions, like reading live database credentials or resetting a password, are deliberately kept out of the agent surface.

Do I need a cluster or a cloud account first?

No. Ownkube Compute runs the compute for you, so the agent just picks a region and deploys. You can connect your own AWS account later if you want to run the same app there.

What can the agent actually do?

About 77 tools today: deploy web apps, workers, scheduled jobs, Postgres databases, and Valkey caches, read logs and metrics, manage custom domains and alerts, and check billing. It cannot read secret connection credentials or run destructive database recovery.

Which organization does it act on?

The one you choose on the consent screen. If you belong to several, you can pass an organization explicitly per request, and the agent falls back to your consented org otherwise.

// troubleshooting

Troubleshooting

The agent cannot reach the server.

Confirm the URL is exactly https://app.ownkube.io/api/mcp with https and no trailing slash. The transport is Streamable HTTP.

The browser sign in never opened.

The first connection opens a browser tab to authorize. If nothing opened, trigger the connection again and allow the tab. Terminal clients use a local loopback callback, so let it bind a localhost port.

You see a "no organization" error.

Re-run the consent step and pick an organization, or pass the organization id explicitly in your request. Consent binds the connection to one org until you change it.

Calls started failing after a while.

The access token expired. Reconnect and the client re-runs the browser sign in to mint a fresh token.

// related_agents

Ship your first app in the next five minutes.

Push a repo, get a live URL on Ownkube Compute. No cloud account, no config, no card. Move to your own AWS the day you need to.

Deploy your first app Talk to us

No cloud account needed. Live in 5 minutes from your browser.