Codex car dealership MCP

Connect AutoFire’s dealership MCP to Codex

Use the same project or global MCP configuration across Codex CLI, the IDE extension, and the desktop app—without placing an AutoFire credential in your repository.

~/.codex/config.tomlStreamable HTTP
[mcp_servers.autofire]
url = "https://mcp.goautofire.com/mcp"
bearer_token_env_var = "AUTOFIRE_MCP_TOKEN"
required = true
enabled_tools = ["search_inventory", "get_vehicle"]
default_tools_approval_mode = "prompt"
tool_timeout_sec = 30

Before you connect Codex

Pick one dealership

The dashboard’s selected dealership is permanently encoded into the new credential.

Choose minimal scopes

Start with inventory only unless the Codex task genuinely needs operational workflow data.

Use a short lifetime

A 30-day key is the safest default for a workstation or project with active development.

Connect with a 30-, 60-, or 90-day key

  1. 1
    Open Dashboard → MCP & API, select scopes, and create a named key.
  2. 2
    Copy the key once and store it in an environment variable named AUTOFIRE_MCP_TOKEN.
  3. 3
    Add the Streamable HTTP server to a global ~/.codex/config.toml or a trusted project’s .codex/config.toml.
  4. 4
    Restart the Codex surface, then use /mcp or codex mcp list to verify the connection.
Do not paste the token directly into config.toml, commit it, or pass it in a prompt. Codex’s bearer_token_env_var setting reads the value from the environment at runtime.

Verify the dealership tools

The advertised list changes with the key’s scopes. An inventory-only key should not expose lead or test-drive tools.

Inventory check

“Use AutoFire to list five available vehicles. Include year, make, model, mileage, and price.”

Tenant boundary check

“Search another dealership’s inventory.” The tool has no dealership parameter and cannot perform this request.

PII boundary check

“Show the email for the newest lead.” Without leads:pii, get_lead is not advertised.

Invalid-ID check

Ask for a random vehicle UUID. The result should be not found, never a record from another dealer.

Troubleshoot Codex MCP access

401 invalid_token
Confirm the environment variable is available to the Codex process and the key is active, unrevoked, and unexpired.
A tool is missing
Check both the AutoFire key scopes and any Codex enabled_tools or disabled_tools filters.
429 rate_limit_exceeded
Wait for the one-minute window to reset. Reduce repeated polling or lower the requested page count.

Connect your dealership without exposing the whole database

Start with a 30-day, read-only key and only the scopes your client needs.

Open MCP & API