Codex CLI skills: the best ones, how to install them and how to add MCP

Codex CLI is OpenAI's coding agent for the terminal, with 131.5k ★ on GitHub. Like Claude Code, it reads your project, edits files and runs commands. A skill gives it instructions for a type of task; an MCP server gives it access to data and outside services. This article was updated on 29 October 2026; the latest stable Codex CLI release on that date is 0.165.0, published on 27 October.

Quick picks by task

• Development workflow: Matt Pocock's skills, minimal access. npx skillfoxx add skills/skills-for-real-engineers --agent codex
• Stages from spec to release: Agent Skills, minimal access. npx skillfoxx add skills/agent-skills --agent codex
• Testing a site in a browser: Playwright Skill, broad access. npx skillfoxx add skills/playwright-skill --agent codex
• Code security audit: security-audit, extended access. npx skillfoxx add skills/security-audit --agent codex
• Word, PDF and Excel documents: Anthropic's skills and anydoc, extended access. npx skillfoxx add skills/anydoc --agent codex
• UI design: Taste Skill, minimal access. npx skillfoxx add skills/taste-skill --agent codex

How to get started in five minutes

1. Open your repository and run npx skillfoxx add skills/skills-for-real-engineers --agent codex. Access is minimal. Add --lang en if you want the installer's output in English.
2. Start Codex and give it a task that matches the skill's description, for example finding the cause of a bug. If the task matches, Codex opens the SKILL.md.
3. For site testing, add Playwright Skill and try it on a local server first.
4. Connect Context7 or another read-only MCP server.
5. After a week, remove the skills Codex never opened.

What are the best Codex skills by task?

This list covers skills in the SKILL.md format that Codex finds in ~/.agents/skills or in the project's .agents/skills.

The access level comes from the catalog card. Minimal access means the skill is instructions only and runs no scripts of its own. Extended access means it runs scripts or calls outside services. Broad access goes to skills that execute arbitrary code or change databases, and the SkillFoxx CLI installs those only after you confirm.

Development workflow

Matt Pocock's skills for real engineers target three common agent failures: editing without clarifying the task, code without tests, and debugging by guesswork. grill-me runs an interview before a change, tdd drives the red-green-refactor loop, and diagnosing-bugs sets an order for debugging. Run the setup-matt-pocock-skills skill once per repository. Access is minimal, although some of the skills create commits and tracker issues.

npx skillfoxx add skills/skills-for-real-engineers --agent codex

Agent Skills by Addy Osmani is a set of 25 skills organized by development stage, from spec to release. Each skill has steps, checkpoints and a list of excuses agents typically make. It draws on the book Software Engineering at Google. Access is minimal. For Codex CLI 0.122 and newer the author also ships a plugin; the SkillFoxx CLI places the same skills into folders.

npx skillfoxx add skills/agent-skills --agent codex

Superpowers makes the agent clarify the task, agree on the design in pieces and split the work into small verified steps. Subagents then run the plan with a two-stage review. Access is extended, because the plugin adds a hook at session start. The SkillFoxx CLI installs Superpowers only in Claude Code. In Codex, type /plugins, search for Superpowers and choose Install Plugin.

Karpathy-inspired guidelines fit into one skill with four principles. The agent states its assumptions, avoids unnecessary abstractions, touches only the lines that need changing and defines a testable success criterion. Access is minimal, with no scripts or hooks.

npx skillfoxx add skills/karpathy-inspired-claude-code-guidelines --agent codex

Design

Taste Skill steers design through three variables: DESIGN_VARIANCE, MOTION_INTENSITY and VISUAL_DENSITY. Access is minimal.

UI UX Pro Max looks up styles, palettes and fonts in a local database with Python 3. Access is extended. The author also has an installer of their own: uipro init --ai codex.

Impeccable installs with npx impeccable install from the project root, and afterwards you approve its hook in /hooks.

I compared ten design skills in more detail in a separate article on the best skills for UI design.

npx skillfoxx add skills/taste-skill --agent codex

npx skillfoxx add skills/ui-ux-pro-max --agent codex

Understanding a codebase

graphify builds a graph of the links between your project's files, functions and documents. Code is parsed locally with tree-sitter, while documents and images go to the agent's model. The output is an interactive HTML page and a GRAPH_REPORT.md report. Access is extended. The SkillFoxx CLI doesn't install it. You need Python and the graphifyy package, spelled with two y's; other packages named graphify are unrelated.

uv tool install graphifyy

graphify install --project --platform codex

Testing and code review

With Playwright Skill, the agent writes and runs Playwright scripts: forms, checkout flows, screenshots at two widths, broken link checks. The browser opens visibly by default. Access is broad, since the agent executes Node.js code it generates. It needs Node.js 20 or newer, and after installing you run npm run setup in the skill's folder, which downloads Playwright and Chromium.

npx skillfoxx add skills/playwright-skill --agent codex

security-audit from Cloudflare runs a code security audit in six phases. A separate subagent checks each finding, and a finding is marked confirmed only after a full trace through the source. The skill doesn't edit your code; it describes the fixes. Access is extended, and builds and tests of the target run only in a sandbox without network access.

npx skillfoxx add skills/security-audit --agent codex

Documents

Anthropic's skills include docx, pdf, pptx and xlsx, the skills behind Claude's work with files. The CLI installs the whole set along with the creative examples, and you can delete the folders you don't need. Access is extended, because the document skills run scripts. Anthropic notes that the set is meant as a demonstration and that agent behavior may vary.

npx skillfoxx add skills/skills --agent codex

anydoc from Firecrawl converts Word, PowerPoint, Excel, EPUB and PDF into Markdown that Codex reads like any text file. The converter is written in Rust and runs without outside services. It has no OCR of its own: a scanned PDF is recognized only with the --ocr hosted flag, and then the whole document goes to Firecrawl's cloud. Access is extended, and it needs Node.js 20.

npx skillfoxx add skills/anydoc --agent codex

How do you install a skill in Codex manually?

The header of a SKILL.md file holds name and description, and the agent uses them to decide when to open the skill. The format is the same as in Claude Code, so most skills from the catalog work in both agents. Codex collects skills from three folders plus its built-in set:

• .agents/skills in the current folder and in every parent folder up to the repository root;
• ~/.agents/skills in your home folder, visible in every project;
• /etc/codex/skills for the machine's administrator;
• system skills bundled by OpenAI, such as skill-creator and skill-installer.

To install a skill by hand, copy its folder into one of these places. The SkillFoxx CLI does the same and shows the access level before installing. Inside a project, a skill goes into that project by default; with --global it goes into your home folder.

Codex picks up new skills on its own. If a skill doesn't appear, restart the agent. To turn a skill off without deleting it, add a [[skills.config]] block with the skill's path and enabled = false to ~/.codex/config.toml, then restart. To test a skill, give Codex a task that matches its description. At the start of a session Codex sees the names and descriptions of all skills and opens a SKILL.md when a task fits.

OpenAI's documentation caps that list at 2% of the model's context window, or 8,000 characters when the window size is unknown. When you have many skills, Codex first shortens the descriptions, then drops some skills and prints a warning. So install the skills from this list one at a time as tasks call for them, and remove the ones you don't use.

How do you add an MCP server to Codex?

An MCP server isn't tied to one agent. The same Context7 that works in Claude Code connects to Codex with one command, taken from OpenAI's documentation:

codex mcp add context7 -- npx -y @upstash/context7-mcp

The command writes the server into the [mcp_servers.context7] table of ~/.codex/config.toml. The CLI, the editor extension and the desktop app all read that file. A server for a single project goes into .codex/config.toml inside the repository, and Codex reads it only in a trusted project. Keys are passed with --env NAME=value, and codex mcp login with the server's name starts an OAuth sign-in.

The SkillFoxx CLI writes the same entry for you, using the command from the catalog card:

npx skillfoxx add mcp/context7 --agent codex

codex mcp list prints the connected servers. If a server is missing, check the table name in config.toml and restart the session.

How I checked this list

I ran the install commands through the SkillFoxx CLI with the --dry-run flag on 29 October 2026. Where the CLI doesn't install an entry into Codex, I give the command from the author's README. Access levels come from the catalog cards.

Codex CLI permissions and security

Codex CLI has broad access in the catalog: the agent runs commands, edits files and sends code to OpenAI's models. By default it runs in workspace-write mode. The agent changes files only in the working folder, network access for commands is off, and it leaves the folder only after you approve. The /permissions command switches a session to read-only.

A skill gets the same permissions as Codex itself. An MCP server adds its own, so connect a server that writes to a database or sends messages only after you've tested it on a copy of your data.

Using Codex together with Claude Code

The Codex plugin for Claude Code is made by OpenAI and has 34.7k ★ on GitHub. /codex:review asks Codex to review your changes and doesn't touch your files. /codex:rescue tasks do edit the project, so the plugin's access is extended, and your code and session context go to OpenAI.

oh-my-codex, 33.7k ★ on GitHub, builds a process on top of Codex: clarify the task, plan, execute, with commands such as $deep-interview, $ralplan and $ultragoal. Access is broad, and the --madmax mode from the author's recommended launch turns off approvals and the sandbox. I'd install it once you're comfortable with plain Codex.

All entries that support Codex, with filters by section, are on the Codex agent page.