Connect Codex CLI

Shape Beacon's remote MCP server gives your own Codex CLI read-only access to aggregate analytics for the one verified site selected when you issued the grant. It does not install collection or grant access to another site.

Codex CLI has been demonstrated against one Owner-controlled site. Seven public tools are available, and finalized retained Page and Cross-Page results were reconciled for a narrow real cohort. Independent customer acceptance remains unproven; Claude Code has not been directly verified.

Before you start

In Workspace, select your active verified domain, open Connect Agent, and choose Create Connection. Access is read-only, limited to that domain, and expires after 30 days unless revoked sooner. Install collection separately; a connection does not create behavioral evidence.

Keep the credential private

The credential is shown once. Do not put it in a prompt, source file, project configuration, URL, screenshot, or support message. It is separate from your browser-visible collection key. Your agent provider may process returned aggregate evidence under its own terms.

Load it into the shell

In the shell that will launch Codex, enter the value without echoing it or putting it in shell history:

read -r -s -p 'Shape Beacon Agent token: ' SHAPE_BEACON_AGENT_AUTH
printf '\n'
export SHAPE_BEACON_AGENT_AUTH

This lasts only for that shell and its child processes. Use a trusted local secret manager if you need longer storage. Do not run echo or env to inspect the value.

Configure Codex

codex mcp add shape-beacon \
  --url https://agent.shapebeacon.com/mcp \
  --bearer-token-env-var SHAPE_BEACON_AGENT_AUTH
codex mcp get shape-beacon
codex mcp list

The configuration stores the environment variable name, not its value. Start a fresh Codex process from the shell where the variable is loaded. The production server offers seven tools: analytics_availability, summarize_period, inspect_cross_page, compare_periods, inspect_page, compare_page_periods, and rank_page_changes.

Try a first read

Ask Codex to use only the Shape Beacon MCP server, call analytics_availability, and report the exact hostname, available views, timezone and epoch. Then choose a completed local day shown in your dashboard and call summarize_period and inspect_cross_page. Read the returned dates, status, denominators and uncertainty. Availability does not prove recent collection.

Lost credential or disconnect

Shape Beacon cannot retrieve a credential after the one-time display. Return to your domain's Connect Agent panel to replace the connection, then update your local secret. A replaced credential may keep working for up to 24 hours. Use Disconnect in that panel to stop server access. Removing a client configuration alone does not revoke the grant.