Files

root 69bf81af48 Document MCP re-authentication commands

Codex does not auto-refresh expired OAuth access tokens for MCP servers.
When a tool call fails with `Auth required`, users need to manually
re-authenticate. Codex itself surfaces the suggestion at startup
(`codex mcp login <name>` tip) — mirror that guidance in the README so
users hit it before opening a support ticket.

Also documents `codex mcp logout` as the nuclear option and plugin
uninstall/reinstall as the last-resort fallback (trigger ON_INSTALL
auth policy).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-04-20 13:57:10 -03:00

3.0 KiB

Raw Blame History

OCI Deal Accelerator — Codex Plugin

Codex plugin that connects to the OCI Deal Accelerator MCP server and bundles a companion skill. Distributed internally via ai-lad.com.

What you get

14 tools surfaced through a remote MCP server (streamable HTTP, OAuth 2.1):

generate_full_proposal, generate_bom, generate_bom_appca, generate_cost_estimate
generate_deck, generate_diagram, generate_business_case
run_wa_review, check_feature_compatibility, compare_competitive
search_reference_architectures, search_field_findings, report_field_finding
score_ecal_readiness

Plus a skill (skills/oci-deal-accelerator/SKILL.md) that guides Codex on when and how to invoke each tool.

Install

Once the plugin is registered in ai-lad.com you will get an <ID>. Replace it below.

Windows (PowerShell)

iwr -UseBasicParsing 'https://ai-lad.com/api/skills/<ID>/install-script?os=windows' | iex

macOS / Linux

curl -fsSL 'https://ai-lad.com/api/skills/<ID>/install-script?os=unix' | bash

The installer downloads the plugin ZIP, extracts it to ~/plugins/oci-deal-accelerator/, merges the ai-factory marketplace entry in ~/.agents/plugins/marketplace.json, and restarts Codex. Policy: installation: "AVAILABLE", authentication: "ON_INSTALL".

First-run authentication

On first install Codex kicks off the OAuth 2.1 + PKCE flow against the MCP server (AS proxy → OCI Identity Domain). A browser window opens; sign in with your Oracle SSO.

The MCP server implements Dynamic Client Registration (RFC 7591), so Codex's ephemeral http://localhost:<port> callback registers itself on the fly — no manual whitelisting in the AS required. Restricted to @oracle.com identities.

Re-authentication

If a tool call fails with Auth required, the OAuth access token has expired and Codex did not refresh it automatically. Re-authenticate without uninstalling:

codex mcp login oci-deal-accelerator

Opens the browser, re-authenticates with Oracle SSO, tools are available again. If that fails, force a clean slate first:

codex mcp logout oci-deal-accelerator
codex mcp login oci-deal-accelerator

As a last resort, uninstall the plugin from /plugins and reinstall — the authentication: "ON_INSTALL" policy triggers a fresh OAuth flow on install.

Repo layout

oci-deal-accelerator-codex/
├── .codex-plugin/
│   └── plugin.json          # Codex plugin manifest
├── .mcp.json                # Remote MCP server config
├── skills/
│   └── oci-deal-accelerator/
│       └── SKILL.md         # Tool-usage guidance
├── assets/                  # logo.png, icon.png, screenshot-1.png
├── README.md
└── .gitignore

References

Codex Plugins — Build
Codex MCP configuration
MCP server repo: github.com/Diegoecab/arch-mcp-oracle

3.0 KiB Raw Blame History