Tested with RepoPrompt CE 1.1.1 and its bundled Codex 0.145.0 on macOS. This also applies to later RepoPrompt CE releases while they continue to run Codex with a separate CODEX_HOME. A future release may provide a built-in import/sync feature, so check the app's release notes first.
MCP servers work in Codex CLI or the Codex desktop app, but RepoPrompt CE's Tools → MCP Servers list shows only RepoPrompt CE and a few app-specific entries.
RepoPrompt CE intentionally keeps its Codex state separate from the normal Codex home:
Normal Codex: ~/.codex
RepoPrompt CE: ~/Library/Application Support/RepoPrompt CE/Codex/Release/home
RepoPrompt CE reads MCP definitions from its own config.toml; it does not automatically merge the [mcp_servers.*] tables from ~/.codex/config.toml.
This isolation is useful. The two homes contain different sessions, databases, locks, installation state, app-specific configuration, and RepoPrompt integration settings. Do not copy or symlink the whole ~/.codex directory or either complete Codex home.
Use RepoPrompt CE's config as the base and add only missing keys under [mcp_servers] from the normal Codex config.
Preserve all RepoPrompt CE-owned settings, especially:
- its complete
RepoPromptCEMCP definition; - Code Mode and other feature settings;
- project trust and tool-output settings;
- app-specific MCPs that do not exist in the normal Codex config.
Do not import plugins, skills, prompts, auth files, secrets, sessions, databases, caches, browser state, or other top-level configuration.
The companion merge_repoprompt_ce_mcp.py script performs a missing-key-only merge. Existing RepoPrompt CE values always win. It defaults to a dry run, creates a timestamped backup before applying, writes atomically, and keeps the target mode at 0600.
Set up a temporary environment:
python3 -m venv /tmp/rpce-mcp-merge-venv
/tmp/rpce-mcp-merge-venv/bin/pip install tomlkitDownload both files from this gist, then preview the merge:
/tmp/rpce-mcp-merge-venv/bin/python merge_repoprompt_ce_mcp.pyThe script prints key paths only, never values. Review that list. Save your work and quit RepoPrompt CE before applying:
/tmp/rpce-mcp-merge-venv/bin/python merge_repoprompt_ce_mcp.py --applyReopen RepoPrompt CE. Newly imported third-party MCPs may appear disabled in the Tools permission panel; enable only the servers needed for the current task.
On Apple Silicon, RepoPrompt CE 1.1.1's bundled binary is normally here:
RPCE_HOME="$HOME/Library/Application Support/RepoPrompt CE/Codex/Release/home"
RPCE_CODEX="/Applications/RepoPrompt CE.app/Contents/Resources/BundledRuntimes/Codex/aarch64-apple-darwin/bin/codex"
CODEX_HOME="$RPCE_HOME" "$RPCE_CODEX" mcp list --jsonIf that binary path differs, locate the bin/codex executable beneath:
/Applications/RepoPrompt CE.app/Contents/Resources/BundledRuntimes/Codex/
The expected server set is the union of:
- the normal Codex
[mcp_servers.*]definitions; and - RepoPrompt CE-owned definitions that were already present.
Do not compare against somebody else's server count; MCP catalogs are user-specific.
Copying a server definition does not necessarily copy its authorization. Do not copy Codex databases, auth.json, Keychain secrets, token files, or the whole ~/.mcp-auth directory.
For a connector using mcp-remote, both Codex environments should use the same connector-scoped auth directory when the connector is intentionally shared. If the normal Codex server already has an environment table like this, the merge script adds the missing table to RepoPrompt CE without replacing its server command:
[mcp_servers.google_drive_personal.env]
MCP_REMOTE_CONFIG_DIR = "/Users/YOUR_USERNAME/.mcp-auth/google_drive_personal"Use an absolute path; replace YOUR_USERNAME. Keep each connector in its own directory.
On the first protected read, one browser approval may be legitimate. After approval:
- confirm the OAuth callback listener exists on the connector's configured port during authorization;
- confirm completed token state appears only in the connector-scoped directory;
- perform a second harmless read and verify that it does not request authorization again.
If approval redirects to localhost with ERR_CONNECTION_REFUSED, or the browser repeatedly asks for consent, stop approving. That indicates a callback/listener or state-coordination failure, not missing Google permissions. Inspect the exact connector process and callback port. Never use broad commands such as pkill node, and never delete all of ~/.mcp-auth.
Some deferred-auth servers need a connector-specific wrapper or upstream fix to start the callback listener when the first protected tool call returns 401. A table merge alone cannot repair a broken OAuth implementation.
Quit RepoPrompt CE, restore the timestamped config.toml.pre-mcp-merge-* backup printed by the script, verify mode 0600, and reopen the app. The merge does not modify the normal Codex config.
- Never publish either real
config.toml; MCP tables may contain commands, account identifiers, environment values, or secret locations. - Never publish OAuth URLs, tokens, verifier values, client files, debug logs, or callback query strings.
- Keep backups and generated configs mode
0600. - Merge configuration, not runtime state.