CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

30.8 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 1 flagged

Securityscore 88 · 1 finding

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · AGENTS.md

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptAGENTS.md· markdown

3This repository is connected to codex-gptpro.

4Use `.ai/tasks`, `.ai/results`, and `.ai/reviews` for ChatGPT/Codex handoff.

5When asked to use `codex_gptpro`, first call `register_project` for this repository with `se

… (65 chars elided on L5)

6Do not modify unrelated files.

Occurrences

1 occurrence · at L5

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha25612211d7a427c799a…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md9.2 KB · Markdown

codex-gptpro: call ChatGPT Pro from Codex

日本語 | English

codex-gptpro is a local MCP server that lets Codex ask ChatGPT Web Pro for planning, review, and long-running reasoning, then receive the result back inside Codex.

It is designed for a local, Codex-led workflow. ChatGPT Web does not directly call Codex, and this MCP does not expose arbitrary shell execution, patch application, git commits, git pushes, file deletion, or a remote Codex runner.

Canonical names:

GitHub repo: codex-gptpro
package name: codex-gptpro
MCP server name: codex_gptpro
Chrome profile: codex-gptpro

日本語

これは何か

codex-gptpro は、Codex から ChatGPT Web の Pro 拡張へpromptを送り、回答をCodexへ返すためのローカルMCPサーバーです。

主な用途は、Codexが実装中にChatGPT Proへ重い計画、設計レビュー、調査、長時間の推論を依頼し、その出力をローカルの .ai/pro-outputs に保存して作業に戻すことです。

アーキテクチャ

Codex
  -> MCP server: codex_gptpro
  -> http://127.0.0.1:8788/mcp-codex
  -> run_pro_prompt
  -> Google Chrome profile: codex-gptpro
  -> ChatGPT Web Pro
  <- Pro output saved under .ai/pro-outputs

任意で /mcp もありますが、通常の主経路では使いません。CodexからChatGPT Proを呼び出すだけなら、外部公開やCloudflare Tunnelは不要です。

必要条件

Node.js 20+
pnpm
Google Chrome
Codex CLI または Codex IDE

Chromiumや専用Chromeアプリのインストールは不要です。既存のGoogle Chromeアプリに、MCP用profile codex-gptpro を作って使います。

セットアップ

git clone https://github.com/tomato-ga/codex-gptpro.git
cd codex-gptpro
pnpm install
pnpm build
pnpm run codex:configure

開発起動:

pnpm dev

本番寄りのローカル起動:

pnpm start

デフォルトURL:

http://127.0.0.1:8788

Codex設定

pnpm run codex:configure は ~/.codex/config.toml に次のMCP設定を追加します。

[mcp_servers.codex_gptpro]
url = "http://127.0.0.1:8788/mcp-codex"
startup_timeout_sec = 20
tool_timeout_sec = 1200
enabled = true
default_tools_approval_mode = "prompt"

MCP_CODEX_TOKEN を設定している場合だけ、次の行も追加されます。

bearer_token_env_var = "MCP_CODEX_TOKEN"

古い [mcp_servers.webgpt] がある場合は、codex:configure が新しい codex_gptpro 設定へ置き換えます。

使い方

Codexでこう依頼します。

Use codex_gptpro MCP.
Register the current repository automatically if needed.
Ask ChatGPT Pro to create an implementation plan for the current task.
Save the output and summarize the next steps.

初回だけChrome profileのログインが必要な場合があります。

Use codex_gptpro MCP.
Call prepare_pro_browser with keepBrowserOpen: true.

開いたChrome profile codex-gptpro でChatGPTにログインしてください。その後、run_pro_prompt が使えます。

主なtool

register_project: 現在のrepoをMCPへ登録
list_projects: 登録済みrepoを一覧
repo_tree: repo構造を安全に取得
read_file: 許可されたtext fileを読む
grep_repo: repo内検索
git_diff: bounded diffを取得
pro_browser_status: Chrome/Pro連携状態を確認
prepare_pro_browser: ChatGPTログイン用にChrome profileを開く
run_pro_prompt: ChatGPT Proへpromptを送り、回答を返す
list_tasks, read_task, claim_task, write_result, read_result: .ai task handoff
run_check: typecheck, lint, test, build のallowlisted scriptだけ実行

Chrome profile

デフォルト:

MCP_PRO_CHROME_AUTOMATION_USER_DATA_DIR=~/.codex-gptpro/chrome-user-data
MCP_PRO_CHROME_PROFILE_DIRECTORY=codex-gptpro

これは既存のGoogle Chromeアプリを使います。Chrome 136+では通常のChrome data directoryに対するremote debuggingが制限されるため、MCP専用のuser data dirを使います。

任意の環境変数

.env は必須ではありません。必要な場合だけ作成します。

cp .env.example .env
chmod 600 .env

よく使う値:

MCP_PORT=8788
MCP_CODEX_TOKEN=<long-random-token>
MCP_PUBLIC_PIN=<short-lived-pin>
MCP_PRO_MODEL_LABEL=Pro 拡張
MCP_PRO_CHROME_PROFILE_DIRECTORY=codex-gptpro

セキュリティ

public repoへ入れてはいけないものは .gitignore で除外しています。

.env, .env.*
projects.local.json
.ai/
.codex/
node_modules/, dist/, coverage/
local launchd plist
Chrome profile data
local memory files

MCP toolsも意図的に制限しています。

arbitrary shell executionなし
patch applicationなし
file deletionなし
git commit/pushなし
direct Codex invocationなし

検証

pnpm build
pnpm test
pnpm lint
pnpm run healthcheck

macOSで常駐化する場合:

pnpm run launchd:install
launchctl print "gui/$(id -u)/local.codex-gptpro"

English

What It Does

codex-gptpro is a local MCP server that lets Codex send prompts to ChatGPT Web Pro and receive the answer back in Codex.

The main use case is letting Codex delegate heavyweight planning, design review, research, and long-running reasoning to ChatGPT Pro while keeping implementation and verification local.

Architecture

Codex
  -> MCP server: codex_gptpro
  -> http://127.0.0.1:8788/mcp-codex
  -> run_pro_prompt
  -> Google Chrome profile: codex-gptpro
  -> ChatGPT Web Pro
  <- Pro output saved under .ai/pro-outputs

The optional /mcp endpoint exists for safe planner/reviewer tools, but it is not required for the primary workflow. If all you want is Codex calling ChatGPT Pro, you do not need to expose any endpoint publicly.

Requirements

Node.js 20+
pnpm
Google Chrome
Codex CLI or Codex IDE

You do not need Chromium or a separate Chrome app. The server uses your existing Google Chrome app with a dedicated Chrome profile named codex-gptpro.

Setup

git clone https://github.com/tomato-ga/codex-gptpro.git
cd codex-gptpro
pnpm install
pnpm build
pnpm run codex:configure

Development server:

pnpm dev

Production-like local server:

pnpm start

Default URL:

http://127.0.0.1:8788

Codex Config

pnpm run codex:configure writes this MCP server block to ~/.codex/config.toml.

[mcp_servers.codex_gptpro]
url = "http://127.0.0.1:8788/mcp-codex"
startup_timeout_sec = 20
tool_timeout_sec = 1200
enabled = true
default_tools_approval_mode = "prompt"

If MCP_CODEX_TOKEN is set, it also adds:

bearer_token_env_var = "MCP_CODEX_TOKEN"

If an old [mcp_servers.webgpt] block exists, codex:configure replaces it with the new codex_gptpro server name.

Usage

Ask Codex:

Use codex_gptpro MCP.
Register the current repository automatically if needed.
Ask ChatGPT Pro to create an implementation plan for the current task.
Save the output and summarize the next steps.

On first use, the Chrome profile may need a ChatGPT login:

Use codex_gptpro MCP.
Call prepare_pro_browser with keepBrowserOpen: true.

Main Tools

register_project: register the current repository
list_projects: list registered repositories
repo_tree: inspect repository structure safely
read_file: read allowed text files
grep_repo: search repository text
git_diff: return bounded diff output
pro_browser_status: check Chrome/Pro automation status
prepare_pro_browser: open the Chrome profile for first-run login
run_pro_prompt: send a prompt to ChatGPT Pro and return the answer
list_tasks, read_task, claim_task, write_result, read_result: .ai task handoff
run_check: run only allowlisted package scripts: typecheck, lint, test, build

Chrome Profile

Defaults:

MCP_PRO_CHROME_AUTOMATION_USER_DATA_DIR=~/.codex-gptpro/chrome-user-data
MCP_PRO_CHROME_PROFILE_DIRECTORY=codex-gptpro

This uses your existing Google Chrome app. Chrome 136+ restricts remote debugging on the default Chrome data directory, so this server uses a dedicated user data directory for MCP automation.

Optional Environment Variables

.env is optional. Create one only when needed.

cp .env.example .env
chmod 600 .env

Common values:

MCP_PORT=8788
MCP_CODEX_TOKEN=<long-random-token>
MCP_PUBLIC_PIN=<short-lived-pin>
MCP_PRO_MODEL_LABEL=Pro 拡張
MCP_PRO_CHROME_PROFILE_DIRECTORY=codex-gptpro

Security

Local and sensitive files are ignored by default:

.env, .env.*
projects.local.json
.ai/
.codex/
node_modules/, dist/, coverage/
local launchd plists
Chrome profile data
local memory files

The MCP surface is intentionally limited:

no arbitrary shell execution
no patch application
no file deletion
no git commit/push
no direct Codex invocation

Verification

pnpm build
pnpm test
pnpm lint
pnpm run healthcheck

For macOS launchd:

pnpm run launchd:install
launchctl print "gui/$(id -u)/local.codex-gptpro"

Webgpt Mcp— agent skill

Is Webgpt Mcp safe to install?

codex-gptpro: call ChatGPT Pro from Codex

日本語

これは何か

アーキテクチャ

必要条件

セットアップ

Codex設定

使い方

主なtool

Chrome profile

任意の環境変数

セキュリティ

検証

English

What It Does

Architecture

Requirements

Setup

Codex Config

Usage

Main Tools

Chrome Profile

Optional Environment Variables

Security

Verification

Audit the pieces. Scan the whole. Decide.