Deploy from Codex to a live URL

Deploy from Codex to a live URL

Published: September 2, 2026
Category: AI Deployments · MCP
Reading time: 6 minutes
Author: NEXUS AI Team

---

Connect OpenAI Codex to NEXUS AI over MCP, deploy the repo you just worked on, and get a public HTTPS URL with Postgres. Then back up, tail logs, and roll back without leaving the terminal.

Codex is good at reading a repo and changing it. Production still needs a database, secrets, a URL, and a rollback path. NEXUS AI is the deploy layer for that session: one MCP server, one OAuth sign-in, one prompt, and the same agent that edited the code calls nexusai_deploy_source.

This is the Codex path. See also Deploy from Claude Code and Deploy from Cursor — same MCP server, same tools.

What you need

• A NEXUS AI account (start free)
• Codex CLI installed and signed in to OpenAI
• An app in a Git repo Codex can see

No API key to paste. Codex runs an OAuth sign-in against the server and stores the token in its own credential store.

1. Add the NEXUS AI MCP server

Two commands:

codex mcp add nexus-ai --url https://mcp.nexusai.run/mcp
codex mcp login nexus-ai

codex mcp add writes a [mcp_servers.nexus-ai] block to ~/.codex/config.toml. codex mcp login reads the server's OAuth metadata, opens a browser, and stores the access token — nothing lands in the config file or your shell history.

Prefer to edit the file yourself? Add this to ~/.codex/config.toml (global) or .codex/config.toml in the repo (project-scoped), then run codex mcp login nexus-ai:

[mcp_servers.nexus-ai]
url = "https://mcp.nexusai.run/mcp"

Approve only what the agent needs in the browser consent screen. deployments:read and deployments:logs to inspect. Add deployments:create to deploy, secrets:manage to write secrets, db:admin for backups and restores, buckets:manage for storage. Leave the delete scopes (deployments:delete, buckets:delete, db:source:delete) off unless you want them.

Confirm it connected:

codex mcp list

nexus-ai should show as authenticated. Then, in a session:

Call nexusai_whoami and tell me which tenant I am connected to.

If login failed, re-run codex mcp login nexus-ai. To remove the server, codex mcp remove nexus-ai.

2. Paste this prompt

In the repo, start Codex and send:

Deploy this repo to NEXUS AI with Postgres and Redis. Detect the framework and start command from the project. Wait until the deployment is healthy, then give me the public HTTPS URL, the deployment ID, and the masked database host. Do not write a Dockerfile unless the build fails.

What the agent should call:

1. nexusai_projects_list (or create a project)
2. nexusai_deploy_source with the Git URL, framework, and services: ["postgresql", "redis"]
3. nexusai_deploy_status until healthy
4. nexusai_deploy_logs if the build fails

No cloud console, no compose YAML. Codex already has the repo context.

Postgres and Redis run as sidecars on the NEXUS managed container platform, with DATABASE_URL and REDIS_URL injected automatically. On a single-container cloud target (App Runner, Cloud Run, Container Apps), Postgres becomes a managed instance and Redis is not available.

For uploads, follow with:

Create a bucket named user-uploads, attach it to this deployment, and redeploy so the app gets S3_ENDPOINT, S3_BUCKET, S3_ACCESS_KEY, and S3_SECRET_KEY.

That is nexusai_bucket_create, nexusai_bucket_attach, then nexusai_deploy_redeploy.

3. Operate from the same session

Snapshot before a migration

Before you run the migration, take a Postgres backup of this deployment. If the migration fails, restore that backup and roll back the deploy.

Triage a 500

Tail the last 200 log lines for this deployment, name the failure, and fix it. If it is a missing secret, create it in the vault and redeploy.

Roll back

Snapshot Postgres, then roll this deployment back to the previous release. Confirm it is healthy.

Backups and rollback are safe. The tools that overwrite or delete data (nexusai_db_restore, nexusai_deploy_delete, bucket and volume delete) carry a destructive hint, so Codex asks you to confirm each call. SQL that writes rows or changes schema also needs an explicit confirmed: true.

4. Optional: preview in the builder first

Ask Codex to push the current files with nexusai_builder_push to get a live preview URL before production, then deploy. nexusai_builder_pull brings builder-side edits back into the workspace. Same MCP server, no extra install.

Frequently asked questions

Does this work if Codex just generated the app?

Yes. Push or commit so nexusai_deploy_source has a Git URL, or use nexusai_builder_push for a preview first. The agent already knows the framework, port, and start command.

How does authentication work? Is there an API key?

No static key. The MCP server uses OAuth with PKCE. codex mcp login nexus-ai runs the browser sign-in and Codex stores a short-lived token in its credential store, refreshing it on its own. You approve the scopes during login. The personal access tokens at nexusai.run/settings/tokens are for the REST API, not the MCP server.

Where is the config stored?

~/.codex/config.toml for a global server, or .codex/config.toml in the repo for a project-scoped one. The [mcp_servers.nexus-ai] block only holds the URL; the token lives in Codex's credential store, not the file, so a project-scoped config is safe to commit.

Is this an MCP gateway?

No. NEXUS AI is an app deploy platform that agents drive over MCP. It is not a gateway for hosting other MCP servers.

What does the live stack include?

App container, optional Postgres, MySQL, or Mongo, Redis, workers, volumes, S3-compatible buckets, HTTPS, logs, backups, and rollback. Full-stack deploys run on the NEXUS managed container platform. Single-container apps can target AWS App Runner, Google Cloud Run, or Azure Container Apps.

Claude Code or Cursor instead?

Same product, same MCP server, different client. See Deploy from Claude Code and Deploy from Cursor.

Related reading

• MCP deployment platform
• Deploy a full-stack app with a database
• Connect NEXUS AI MCP over OAuth