Codex MCP for Marketing: Put Codex in Writes Approval Mode and Give It Your Campaigns

Codex stopped being a developer-only tool some time this year. OpenAI said in June 2026 that non-developers make up roughly a fifth of Codex’s weekly users and are its fastest-growing group, as covered by Pulse 2.0. A lot of those people are founders who would rather draft next week’s launch email in the terminal they already have open than open a marketing tool.

The thing that makes Codex unusually well suited to that job is a small, specific feature: an approval mode that lets read-only tools run freely and prompts only when a tool wants to write. That is exactly the contract a marketing connector should have. Read the brand, the calendar and the campaigns without friction; stop and ask before creating anything. This post covers the mode, the config, the dependency on the server that most people miss, where the setup does and does not apply, and one full loop from “what is scheduled” to a campaign draft waiting for approval.

Codex’s approval modes, and the one built for this

Codex has always had a dial for how much it asks before acting. In July 2026, version 0.144.0 added a mode aimed squarely at MCP tools: prompt on writes, run reads. The release is written up in a community changelog for that version, which also notes that OAuth for MCP servers reached general availability in the same release, and a follow-up post treats writes mode as a least-privilege primitive.

Why it matters for marketing rather than code: a marketing session is mostly reads. What is the offer, what is on the calendar, which automation is live, what did the June email say. Prompting on each of those is exhausting, and the tenth prompt gets clicked without reading. Writes are rare and consequential. A mode that is silent on the first kind and asks on the second kind matches the shape of the work.

The dependency nobody mentions

Writes mode has a quiet precondition. Codex cannot know on its own whether a tool reads or writes; it relies on the server telling it. MCP servers annotate their tools, and a tool marked read-only is the one Codex lets through without asking. A server that does not annotate its reads will trigger a prompt on every call, which makes writes mode indistinguishable from prompting on everything. Worse, a server that mislabels a write as read-only will run it silently.

So before you rely on the mode, check the server. Most marketing MCP servers, as of September 2026, either do not annotate at all or annotate inconsistently. Marqeable’s server marks all ten read tools as read-only and its six write tools as writes, so writes mode behaves as intended: reads flow, the six draft tools prompt.

Those six are also the whole write surface. They create campaign drafts, content drafts, anchored suggestions on existing copy, brief updates and automation drafts. There is no send, launch, publish or delete tool. That is a stronger guarantee than any approval mode, and the reasoning behind it is in the draft-only rule.

The setup

Marqeable’s MCP server is at https://app.marqeable.com/mcp, a remote server over HTTP with OAuth 2.1. You sign in with your normal Marqeable login in a browser window; Codex sees exactly what your account can see, and no API key is stored anywhere.

As of September 2026, per OpenAI’s MCP documentation for Codex, the CLI setup is two commands:

codex mcp add marqeable --url https://app.marqeable.com/mcp
codex mcp login marqeable

The first writes an entry to ~/.codex/config.toml; the second opens the browser sign-in. The resulting config, with writes mode added, looks like this:

[mcp_servers.marqeable]
url = "https://app.marqeable.com/mcp"
default_tools_approval_mode = "writes"

Connecting by URL needs a recent Codex release. If codex mcp login is not recognized, update Codex and check codex mcp --help. In the desktop app the equivalent path is Settings > MCP servers > Add server, choose the streamable HTTP transport, paste the address and authenticate.

Two honest notes on the OAuth flow. It went GA in July, and there are still open issues in the Codex repository around remote OAuth servers, such as a request for an explicit OAuth flag on add (issue 23846) and a report of authenticated tools not importing correctly in the desktop app (issue 20009). If a login succeeds but tools do not appear, restart Codex before assuming the server is at fault.

Where the config works, and where it does not

The config.toml file is read by the Codex CLI and the desktop app on your machine. That covers the terminal loop this post is about.

It does not cover Codex inside the ChatGPT web app, which does not read your local file; there, a remote MCP server is added through ChatGPT’s own connector settings under Developer mode, and write actions may prompt per conversation on some plans. For hosted Codex surfaces, check OpenAI’s current documentation for whether your local server list is picked up. The practical rule: if you did the setup in a terminal, expect it to work in a terminal, and add the connector separately on any web surface you also use. The same server works from Claude Code and Cursor too, which matters for founders who switch tools; the Claude Code version of this setup is in Claude Code for marketing.

One full loop

Here is Monday, in the terminal, with the server connected and writes mode on. Reads run silently; the two draft writes stop for a yes.

You: Run whoami, then get_business_context, then tell me what is on the calendar for the next three weeks.

Codex: Signed in as the founder on the Northwind account. Current offer: 30-day pilot. ICP: first controller at a 50 to 200 person company. Voice: direct, specific. Calendar: nurture email on the 4th, webinar invite on the 10th, reminder on the 16th, LinkedIn case study on the 18th. Market dates: quarter close on the 30th.

You: We ship the approvals feature Thursday. Plan a launch campaign around it, three pieces, and check the automations first.

Codex: The automation overview shows the pilot-offer follow-up is live with a day-7 check-in; a launch email on the 11th would land the same day for 14 contacts, so I moved it. Plan: launch email on the 12th, LinkedIn post on the 15th, closing email on the 24th ahead of quarter close. Creating a campaign draft requires a write. Proceed? [y/N]

You: y

Codex: Created campaign draft “Approvals launch”, type launch, starting the 12th, light volume, three pieces attached on days 0, 3 and 12, copy only. Now creating the three content drafts, which is a write. Proceed? [y/N]

You: y

Codex: Three content drafts created and attached, copy only, no images generated. Nothing is scheduled to send. Review the campaign here: [link to the draft in Marqeable].

Five tool calls were reads and produced no prompts. Two were writes and produced two prompts, each describing exactly what would be created. That is the whole interaction model: the friction lands only where something is created, and what is created is always a draft.

Even auto mode cannot send

Codex also has an auto mode that approves everything. With most connectors that is a decision to trust the model with whatever the tools can do. With a draft-only connector it is a decision about convenience, because the worst outcome of any call is a draft in the review queue. The approval mode decides how often you are asked. The tool list decides what is possible. Choose the connector for its tool list, and then choose the mode for your patience.

That ordering also answers the question a technical founder asks first: what happens when a web page Codex just read tells it to email the customer list. With a send tool in reach, that is an incident. With a draft-only connector, it is a strange draft you delete on Monday. The examples that make this concrete are in the security post linked above, and the buying checklist for every other tool in the stack is in does it have an MCP server?. If you already use Codex Sites to ship a landing page, the companion post on what happens to the signups after the page is live picks up from here.

Frequently asked questions

How do I add a remote MCP server to Codex?

As of September 2026, run codex mcp add marqeable --url https://app.marqeable.com/mcp, then codex mcp login marqeable to sign in through the browser. The entry lands in ~/.codex/config.toml under [mcp_servers.marqeable]. In the desktop app, use Settings > MCP servers > Add server with the same address and authenticate.

What does the writes approval mode in Codex do?

It tells Codex to run read-only tools without asking and to prompt you only when a tool is not marked read-only. It only works when the MCP server annotates its tools honestly; a server that leaves reads unannotated will prompt on everything, and a server that mislabels a write as read-only will run it silently.

Does my Codex config work in ChatGPT or Codex Cloud?

The config.toml file is read by the Codex CLI and desktop app on your machine. Codex inside the ChatGPT web app does not read it; there you add a remote MCP server through ChatGPT’s own connector settings. Check OpenAI’s current documentation for which hosted surfaces pick up your local server list.

Can Codex send a campaign if I set approval to auto?

Not through Marqeable’s connector, in any mode. The connector has read tools and draft-only write tools and no send, launch, publish or delete tool. The approval mode decides how often you are asked; the tool list decides what is possible, and sending is not on it.

The bottom line

Codex’s writes approval mode is the first host-side primitive that matches how marketing work is shaped: constant reads, rare writes. It only delivers on that when the server annotates its tools honestly, and it only makes you safe when the server’s writes are drafts. Two commands and three lines of config give a founder a terminal that can read the whole marketing picture and hand back campaign drafts for approval, without ever being able to send.

See what the drafts become: Marqeable’s agents build and run your campaigns, run behavior-triggered automations across text and email, answer and qualify every visitor with AI website chat, and tie revenue to the exact message with attribution.

Marqeable runs your campaigns, answers every visitor, text, and email in seconds, and turns them into booked jobs and meetings - even at 9pm on a Saturday. We’re in private beta with a small early cohort. Get early access