69bf81af48
Codex does not auto-refresh expired OAuth access tokens for MCP servers. When a tool call fails with `Auth required`, users need to manually re-authenticate. Codex itself surfaces the suggestion at startup (`codex mcp login <name>` tip) — mirror that guidance in the README so users hit it before opening a support ticket. Also documents `codex mcp logout` as the nuclear option and plugin uninstall/reinstall as the last-resort fallback (trigger ON_INSTALL auth policy). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
76 lines
3.0 KiB
Markdown
76 lines
3.0 KiB
Markdown
# OCI Deal Accelerator — Codex Plugin
|
|
|
|
Codex plugin that connects to the **OCI Deal Accelerator MCP server** and bundles a companion skill. Distributed internally via [ai-lad.com](https://ai-lad.com).
|
|
|
|
## What you get
|
|
|
|
14 tools surfaced through a remote MCP server (streamable HTTP, OAuth 2.1):
|
|
|
|
- `generate_full_proposal`, `generate_bom`, `generate_bom_appca`, `generate_cost_estimate`
|
|
- `generate_deck`, `generate_diagram`, `generate_business_case`
|
|
- `run_wa_review`, `check_feature_compatibility`, `compare_competitive`
|
|
- `search_reference_architectures`, `search_field_findings`, `report_field_finding`
|
|
- `score_ecal_readiness`
|
|
|
|
Plus a skill (`skills/oci-deal-accelerator/SKILL.md`) that guides Codex on when and how to invoke each tool.
|
|
|
|
## Install
|
|
|
|
Once the plugin is registered in ai-lad.com you will get an `<ID>`. Replace it below.
|
|
|
|
### Windows (PowerShell)
|
|
```powershell
|
|
iwr -UseBasicParsing 'https://ai-lad.com/api/skills/<ID>/install-script?os=windows' | iex
|
|
```
|
|
|
|
### macOS / Linux
|
|
```bash
|
|
curl -fsSL 'https://ai-lad.com/api/skills/<ID>/install-script?os=unix' | bash
|
|
```
|
|
|
|
The installer downloads the plugin ZIP, extracts it to `~/plugins/oci-deal-accelerator/`, merges the `ai-factory` marketplace entry in `~/.agents/plugins/marketplace.json`, and restarts Codex. Policy: `installation: "AVAILABLE"`, `authentication: "ON_INSTALL"`.
|
|
|
|
## First-run authentication
|
|
|
|
On first install Codex kicks off the OAuth 2.1 + PKCE flow against the MCP server (AS proxy → OCI Identity Domain). A browser window opens; sign in with your Oracle SSO.
|
|
|
|
The MCP server implements **Dynamic Client Registration (RFC 7591)**, so Codex's ephemeral `http://localhost:<port>` callback registers itself on the fly — no manual whitelisting in the AS required. Restricted to `@oracle.com` identities.
|
|
|
|
## Re-authentication
|
|
|
|
If a tool call fails with `Auth required`, the OAuth access token has expired and Codex did not refresh it automatically. Re-authenticate without uninstalling:
|
|
|
|
```bash
|
|
codex mcp login oci-deal-accelerator
|
|
```
|
|
|
|
Opens the browser, re-authenticates with Oracle SSO, tools are available again. If that fails, force a clean slate first:
|
|
|
|
```bash
|
|
codex mcp logout oci-deal-accelerator
|
|
codex mcp login oci-deal-accelerator
|
|
```
|
|
|
|
As a last resort, uninstall the plugin from `/plugins` and reinstall — the `authentication: "ON_INSTALL"` policy triggers a fresh OAuth flow on install.
|
|
|
|
## Repo layout
|
|
|
|
```
|
|
oci-deal-accelerator-codex/
|
|
├── .codex-plugin/
|
|
│ └── plugin.json # Codex plugin manifest
|
|
├── .mcp.json # Remote MCP server config
|
|
├── skills/
|
|
│ └── oci-deal-accelerator/
|
|
│ └── SKILL.md # Tool-usage guidance
|
|
├── assets/ # logo.png, icon.png, screenshot-1.png
|
|
├── README.md
|
|
└── .gitignore
|
|
```
|
|
|
|
## References
|
|
|
|
- [Codex Plugins — Build](https://developers.openai.com/codex/plugins/build)
|
|
- [Codex MCP configuration](https://developers.openai.com/codex/mcp)
|
|
- MCP server repo: [github.com/Diegoecab/arch-mcp-oracle](https://github.com/Diegoecab/arch-mcp-oracle)
|