ChatGPT as a Planning Brain for Codex
Here's a problem that'll land for anyone who uses both ChatGPT and Codex: your $20/month ChatGPT Plus web subscription sits idle while your coding agent burns through API/Codex tokens on planning and review. You're paying twice for the same thinking.
codex-with-chatgpt — a community project that hit 183★ on GitHub today — is the most pragmatic fix I've seen. It turns your ChatGPT web session into the planning and review brain for Codex, while Codex keeps full execution control. The clever part: ChatGPT reads your workspace through a secure, read-only MCP bridge. No API keys, no reverse proxy, no uploading your repo to a third party.
The Architecture
The design is surprisingly clean. Here's the flow:
graph TD
subgraph "ChatGPT Web"
CW[ChatGPT Web UI]
RPR[Reason / Plan / Review]
end
subgraph "C2C Bridge (local)"
BR[Bridge Server]
MCP[MCP Server
8 read-only tools]
OA[OAuth 2.1 PKCE]
PT[Pairing Token
5-min TTL]
TUN[Cloudflare Tunnel]
end
subgraph "Codex Environment"
CX[Codex Harness]
WS[Local Workspace]
end
CW -->|Control Plane
Computer Use| BR
CW -->|Data Plane
MCP Streamable HTTP| MCP
MCP -->|read-only| WS
RPR -->|"[C2C] state messages"| CX
CX -->|edit / shell / git| WS
BR --> OA
OA --> PT
BR --> TUN
The architecture separates control from data cleanly:
- Control plane (Computer Use): ChatGPT and Codex exchange tiny
[C2C]state messages —INIT → PLAN → EXECUTED → REVIEW → DONE. No diffs, no logs, no file bodies are ever pasted into chat. The overhead is under 1KB per message. - Data plane (MCP): ChatGPT pulls what it needs through 8 read-only tools:
workspace_info,list_directory,read_file,search_workspace,git_status,git_diff,test_status,execution_summary. - Independent review: After Codex executes changes, ChatGPT inspects the actual git diff and test records through MCP — it never trusts "all tests passed" claims blindly. This is a genuine second opinion, not rubber-stamping.
The Security Model
The project's threat model is well thought out, and it's what sold me on the approach:
- Read-only by construction. Write, delete, shell, and commit tools simply don't exist on the server. No prompt injection can enable them — they're not there to invoke.
- One workspace per boundary. Every OAuth token is bound to a single workspace. Path containment uses canonical realpaths — symlink,
../, and absolute-path escapes are all blocked and tested (76 unit/integration tests). - Sensitive files never leave.
.env*, keys, SSH credentials are denied by default..c2cignorelets you add more. - Knowing the URL grants nothing. The public MCP endpoint requires OAuth 2.1 with PKCE S256, dynamic client registration, and rotating refresh tokens. No token = 401. Wrong workspace = 403.
- The model never sees long-lived credentials. The only secret that ever touches a browser is a one-time pairing code — 5-minute TTL, 5 attempts, rate-limited, destroyed on use.
What This Actually Means
If you're already paying for ChatGPT Plus/Pro and using Codex, this project lets you get value from both without double-spending. The web subscription handles the expensive cognitive work (planning, architecture decisions, code review) while Codex executes — shell commands, edits, git commits, test runs. Both models play to their strengths.
The "one-paste install" for non-technical users is a nice touch too. You literally copy a paragraph to Codex and it handles Node.js installation, cloning, building, Cloudflare tunnel setup, and the OAuth pairing flow. The Skill auto-updates daily from GitHub.
That said, there are caveats. This is an unofficial community project — not affiliated with OpenAI. The Cloudflare Quick Tunnel dependency means you need cloudflared installed. And the ChatGPT -> Codex control plane relies on Computer Use, which means ChatGPT needs to be able to interact with a browser interface. If OpenAI changes how Computer Use works or what ChatGPT web exposes, this could break.
But for a v1? The architecture is sound. The separation of concerns — planning in the expensive web UI, execution in the harness — mirrors how humans actually work with these tools. It's a pattern I expect to see more of.
The Bottom Line
Codex with ChatGPT is the first project I've seen that treats ChatGPT as a genuine cognitive coprocessor rather than just another API endpoint. The read-only MCP bridge with OAuth 2.1 is a well-designed security boundary, and the architecture is clean enough to learn from even if you don't use the tool. It's worth a look — not just as a utility, but as a pattern for how multi-agent coding systems should be structured.