CYBO Attest in OpenAI Codex

Before you start

Connecting CYBO Attest to Codex takes about a minute. You need:

• An Attest account. Create one at attest.ulapcybo.app first; your free trial starts at registration.
• The Codex CLI installed and signed in with your ChatGPT account or an OpenAI API key. The Codex IDE extension reads the same configuration, so one setup covers both.

The connection details, in case you are asked for them:

Item	Value
Server type	Remote MCP server, HTTP transport
Server URL	https://attest.ulapcybo.app/mcp
Suggested name	cybo_attest
Sign in	OAuth, with your Attest account
Config file	~/.codex/config.toml, shared by the CLI and the IDE extension

Add the server

From your shell, not inside a Codex session:

codex mcp add cybo_attest --url https://attest.ulapcybo.app/mcp

That writes the entry below to ~/.codex/config.toml, if you prefer to add it by hand:

[mcp_servers.cybo_attest]
url = "https://attest.ulapcybo.app/mcp"

Sign in and try it

1. Sign in from your shell, naming the six Attest scopes:

   codex mcp login cybo_attest --scopes "applications:read applications:write scans:read scans:write justifications:write evidence:read"
   

   Your browser opens to the Attest sign in page. Log in with your Attest account, approve the consent screen, and return to the terminal. codex mcp list shows cybo_attest as authenticated.

2. Start a session with codex, or open the Codex panel in your IDE, and type: Who am I in CYBO Attest? It answers with your name and organization, which confirms the sign in.

3. Ask: What is the security posture of my applications?

Codex asks before tool calls that change something (starting a scan, submitting a justification). Keep that on; the read tools run without a prompt.

Useful next prompts, from inside a project directory:

• Explain the first finding and tell me which file in this repo it applies to
• Get the Attest fix plan for this app and work through it, one commit per fix
• I pushed the fix. Scan the latest code of [app], follow it, and tell me which findings are gone and which remain
• Draft a justification for finding [id]; we do not ship that component

Good to know

The rescan is how a fix gets proven. Once the fix is on the default branch, ask the agent to scan the latest code. Attest pulls the newest commits, rebuilds the container, and runs the scans; the agent follows the build and then lists the findings on the new scan, so you see what closed and what is left. Asking to start a scan without new code re runs the scans on the build Attest already has, which is for when a justification or configuration changed, not the code.

The scopes flag is temporary. Codex asks the server for the scopes it should request, and until a small server side change lands, the sign in needs them listed on the command. Once that change is live, codex mcp login cybo_attest alone will do, and this page will say so.

One sign in covers the CLI and the IDE. Both read ~/.codex/config.toml and share the cached token, so after signing in from the terminal the IDE extension is signed in too.

Writes carry your name. Every change the agent makes is logged in Attest as you, with the client that made it. The agent cannot approve or reject a build; that stays in the Attest console with a named person.

If something goes wrong

Symptom	Fix
codex mcp list does not show cybo_attest	The add command did not write the file. Check ~/.codex/config.toml has the block above, then run codex mcp list again
Login fails with an invalid scopes or unknown client message	Make sure the --scopes value is exactly the six scopes above, in quotes. If it repeats, run codex mcp remove cybo_attest, add it again, and log in; send the exact text to Ulap support if it still fails
Browser opens but the terminal never updates	Keep the tab open until the terminal confirms; if it never does, run the login command again
Tools return 401 or 403	Your session expired or your Attest role lacks access to that application. Run codex mcp logout cybo_attest, log in again, and check your role in Attest
The IDE extension does not see Attest	Restart the IDE after adding the server; it reads ~/.codex/config.toml at start
The agent uses another tool instead of Attest	Say "use Attest" in the prompt

Still stuck? Contact Ulap support with the exact error text and a screenshot.