How to Connect ChatGPT / Codex CLI to Your Hosting Panel via MCP

You connect Codex CLI to your Panelica hosting panel by adding a [mcp_servers.panelica] block to ~/.codex/config.toml that runs the panelica-mcp server with your panel's URL, API key and secret as environment variables. Once saved, Codex CLI gains the same 404-tool catalogue that Claude Code and other MCP clients use to manage the server.

Why this works the same way everywhere

The Panelica MCP server does not care which AI client is talking to it — it implements the Model Context Protocol, an open standard, and any conformant client can connect to it the same way. That is the whole point of MCP: you configure the server once per client, using that client's own configuration format, and the tool catalogue, authentication and behavior are identical regardless of whether the client is Claude Code, Codex CLI, or something else entirely. We cover the standard itself in What Is MCP and Why Hosting Panels Need It.

Step 1: Get your credentials

In your Panelica panel, go to Developer > API Keys and create a key. Select only the scopes you actually intend Codex CLI to use — none are preselected. You will receive an API key and a secret; the secret is shown once, so copy it immediately.

Step 2: Edit the Codex CLI config

Codex CLI reads its MCP server definitions from ~/.codex/config.toml. Add a section like this:

[mcp_servers.panelica]
command = "npx"
args = ["-y", "panelica-mcp"]

[mcp_servers.panelica.env]
PANELICA_BASE_URL = "https://your-panel:8443/api/external"
PANELICA_API_KEY = "pk_..."
PANELICA_API_SECRET = "sk_..."

Replace the placeholders with your panel's actual hostname and the credentials from Step 1. Save the file and restart Codex CLI so it picks up the new server definition.

Step 3: Verify with a read-only request

Start with something that cannot change server state, to confirm the connection is live before trusting it with anything else:

Show me the current status of all services on my Panelica server.

A correct response reflects the actual live state of your server — PostgreSQL, MySQL, nginx, PHP-FPM and the rest — pulled through the panel's real service-status API, not inferred or guessed.

Prefer Docker over npx?

If your environment restricts outbound npm access, run the server as a container instead and point Codex CLI at it the same way, substituting the command:

[mcp_servers.panelica]
command = "docker"
args = ["run", "--rm", "-i",
  "-e", "PANELICA_BASE_URL=https://your-panel:8443/api/external",
  "-e", "PANELICA_API_KEY=pk_...",
  "-e", "PANELICA_API_SECRET=sk_...",
  "ghcr.io/panelica/panelica-mcp:latest"]

What Codex CLI can now do

The tool catalogue Codex CLI gains access to is identical to what any other MCP client sees — the same 404 tools spanning accounts, domains, DNS, databases, email, FTP, SSL, backups, files, Cloudflare, Docker, application hosting (Laravel, Node.js, Python), Git and deploy, logs, and security. A Codex CLI session can, for example, read a Laravel application's recent error logs, restart a failed queue worker, or check whether a firewall rule is blocking a specific IP — each a real call into the panel's 406-endpoint External API, with results as accurate as opening the dashboard yourself.

Scoping still matters here

The credentials you put in config.toml carry exactly the permissions you assigned to that API key — not more. If Codex CLI attempts an action outside the key's granted scopes, the panel rejects it before anything happens. Every tool is also labeled read-only, mutating or destructive (181 / 177 / 46 respectively across the catalogue), which MCP-aware clients use to prompt for confirmation before anything irreversible runs. See Is It Safe to Give an AI Access to Your Server? for the full model.

A second example: checking backup health from Codex CLI

Setup is not the interesting part once it is done — the useful part is what a session actually looks like. A request such as "check whether last night's backup for the production database completed and how large it was" resolves through a single tool call against the panel's backup API, returning the real job status, timestamp and size rather than a guess based on what usually happens. If the backup failed, the same session can inspect the failure reason and, if the key's scope allows it, trigger a fresh backup immediately instead of waiting for the next scheduled run.

This is the practical difference between an AI client with MCP access and one without: the first gives you an answer grounded in the actual state of your server, the second gives you the most plausible-sounding guess based on training data. For infrastructure work, that difference is the entire point.

Other clients

If your team standardizes on a different assistant, the pattern above generalizes: install or point to the panelica-mcp server, pass the three environment variables, and let the client's own MCP configuration format do the rest. For the Claude Code equivalent of this guide, see How to Manage a Web Server with Claude Code.