Deploy from Codex to a live URL

Q: Does this work if Codex just generated the app?

Yes. Push or commit so nexusai_deploy_source has a Git URL, or use nexusai_builder_push for a preview first. The agent already knows the framework, port, and start command.

Q: How does authentication work? Is there an API key?

No static key. The MCP server uses OAuth with PKCE. codex mcp login nexus-ai runs the browser sign-in and Codex stores a short-lived token in its credential store, refreshing it on its own. You approve the scopes during login. The personal access tokens at nexusai.run/settings/tokens are for the REST API, not the MCP server.

Q: Where is the config stored?

~/.codex/config.toml for a global server, or .codex/config.toml in the repo for a project-scoped one. The [mcp_servers.nexus-ai] block only holds the URL; the token lives in Codex's credential store, not the file, so a project-scoped config is safe to commit.

Codex reads the repo and changes it. The database, public URL, backups, and rollback come after. Add one MCP server with codex mcp add plus codex mcp login, and the same agent deploys the full stack to a live HTTPS URL with Postgres.

By NEXUS AI Team • September 2, 2026 • AI Deployments

# Deploy from Codex to a live URL

**Published:** September 2, 2026
**Category:** AI Deployments · MCP
**Reading time:** 6 minutes
**Author:** NEXUS AI Team

---

**Connect OpenAI Codex to NEXUS AI over MCP, deploy the repo you just worked on, and get a public HTTPS URL with Postgres. Then back up, tail logs, and roll back without leaving the terminal.**

Codex is good at reading a repo and changing it. Production still needs a database, secrets, a URL, and a rollback path. NEXUS AI is the deploy layer for that session: one MCP server, one OAuth sign-in, one prompt, and the same agent that edited the code calls `nexusai_deploy_source`.

This is the Codex path. See also [Deploy from Claude Code](https://nexusai.run/blog/deploy-from-claude-code) and [Deploy from Cursor](https://nexusai.run/blog/deploy-from-cursor) — same MCP server, same tools.

## What you need

- A NEXUS AI account ([start free](https://nexusai.run/pricing))
- Codex CLI installed and signed in to OpenAI
- An app in a Git repo Codex can see

No API key to paste. Codex runs an OAuth sign-in against the server and stores the token in its own credential store.

## 1. Add the NEXUS AI MCP server

Two commands:

```bash
codex mcp add nexus-ai --url https://mcp.nexusai.run/mcp
codex mcp login nexus-ai
```

`codex mcp add` writes a `[mcp_servers.nexus-ai]` block to `~/.codex/config.toml`. `codex mcp login` reads the server's OAuth metadata, opens a browser, and stores the access token — nothing lands in the config file or your shell history.

Prefer to edit the file yourself? Add this to `~/.codex/config.toml` (global) or `.codex/config.toml` in the repo (project-scoped), then run `codex mcp login nexus-ai`:

```toml
[mcp_servers.nexus-ai]
url = "https://mcp.nexusai.run/mcp"
```

**Approve only what the agent needs** in the browser consent screen. `deployments:read` and `deployments:logs` to inspect. Add `deployments:create` to deploy, `secrets:manage` to write secrets, `db:admin` for backups and restores, `buckets:manage` for storage. Leave the delete scopes (`deployments:delete`, `buckets:delete`, `db:source:delete`) off unless you want them.

**Confirm it connected:**

```bash
codex mcp list
```

`nexus-ai` should show as authenticated. Then, in a session:

> Call `nexusai_whoami` and tell me which tenant I am connected to.

If login failed, re-run `codex mcp login nexus-ai`. To remove the server, `codex mcp remove nexus-ai`.

## 2. Paste this prompt

In the repo, start Codex and send:

> Deploy this repo to NEXUS AI with Postgres and Redis. Detect the framework and start command from the project. Wait until the deployment is healthy, then give me the public HTTPS URL, the deployment ID, and the masked database host. Do not write a Dockerfile unless the build fails.

What the agent should call:

1. `nexusai_projects_list` (or create a project)
2. `nexusai_deploy_source` with the Git URL, framework, and `services: ["postgresql", "redis"]`
3. `nexusai_deploy_status` until healthy
4. `nexusai_deploy_logs` if the build fails

No cloud console, no compose YAML. Codex already has the repo context.

Postgres and Redis run as sidecars on the NEXUS managed container platform, with `DATABASE_URL` and `REDIS_URL` injected automatically. On a single-container cloud target (App Runner, Cloud Run, Container Apps), Postgres becomes a managed instance and Redis is not available.

For uploads, follow with:

> Create a bucket named `user-uploads`, attach it to this deployment, and redeploy so the app gets `S3_ENDPOINT`, `S3_BUCKET`, `S3_ACCESS_KEY`, and `S3_SECRET_KEY`.

That is `nexusai_bucket_create`, `nexusai_bucket_attach`, then `nexusai_deploy_redeploy`.

## 3. Operate from the same session

**Snapshot before a migration**

> Before you run the migration, take a Postgres backup of this deployment. If the migration fails, restore that backup and roll back the deploy.

**Triage a 500**

> Tail the last 200 log lines for this deployment, name the failure, and fix it. If it is a missing secret, create it in the vault and redeploy.

**Roll back**

> Snapshot Postgres, then roll this deployment back to the previous release. Confirm it is healthy.

Backups and rollback are safe. The tools that overwrite or delete data (`nexusai_db_restore`, `nexusai_deploy_delete`, bucket and volume delete) carry a destructive hint, so Codex asks you to confirm each call. SQL that writes rows or changes schema also needs an explicit `confirmed: true`.

## 4. Optional: preview in the builder first

Ask Codex to push the current files with `nexusai_builder_push` to get a live preview URL before production, then deploy. `nexusai_builder_pull` brings builder-side edits back into the workspace. Same MCP server, no extra install.

## Frequently asked questions

### Does this work if Codex just generated the app?

Yes. Push or commit so `nexusai_deploy_source` has a Git URL, or use `nexusai_builder_push` for a preview first. The agent already knows the framework, port, and start command.

### How does authentication work? Is there an API key?

No static key. The MCP server uses OAuth with PKCE. `codex mcp login nexus-ai` runs the browser sign-in and Codex stores a short-lived token in its credential store, refreshing it on its own. You approve the scopes during login. The personal access tokens at `nexusai.run/settings/tokens` are for the REST API, not the MCP server.

### Where is the config stored?

`~/.codex/config.toml` for a global server, or `.codex/config.toml` in the repo for a project-scoped one. The `[mcp_servers.nexus-ai]` block only holds the URL; the token lives in Codex's credential store, not the file, so a project-scoped config is safe to commit.

### Is this an MCP gateway?

No. NEXUS AI is an app deploy platform that agents drive over MCP. It is not a gateway for hosting other MCP servers.

### What does the live stack include?

App container, optional Postgres, MySQL, or Mongo, Redis, workers, volumes, S3-compatible buckets, HTTPS, logs, backups, and rollback. Full-stack deploys run on the NEXUS managed container platform. Single-container apps can target AWS App Runner, Google Cloud Run, or Azure Container Apps.

### Claude Code or Cursor instead?

Same product, same MCP server, different client. See [Deploy from Claude Code](https://nexusai.run/blog/deploy-from-claude-code) and [Deploy from Cursor](https://nexusai.run/blog/deploy-from-cursor).

## Related reading

- [MCP deployment platform](https://nexusai.run/mcp-deployment-platform)
- [Deploy a full-stack app with a database](https://nexusai.run/deploy-full-stack-app)
- [Connect NEXUS AI MCP over OAuth](https://nexusai.run/docs#mcp-oauth-flow)