codex-claude-councilBLOCK
Two AIs. One answer. ChatGPT and Claude discuss with each other until they agree, through your own signed-in CLIs: no API keys. Both read your project (never change it) and search the web. Plugin for Claude Code, Codex, Claude Desktop and the ChatGPT app.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Two AIs. One answer.
Ask ChatGPT (through Codex) and Claude the same question.They discuss with each other, round after round, until they agree on one answer.
Using the subscriptions you already have, in Claude Code · Claude Desktop (Cowork) · Codex · the ChatGPT desktop app · your terminal, on Windows, macOS and Linux.
Quick start · How it works · Use it · Examples · Options · Configure · Troubleshooting
🔍 Both work in your project, in plan modeThey read files, search and run read-only commands such as git log and git diff, but neither can change anything.
38067eb41c33OBSERVED · 2026-10-12Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add codex-claude-council --env FAKE_CLAUDE_AUTH=${FAKE_CLAUDE_AUTH} --env FAKE_CODEX_AUTH=${FAKE_CODEX_AUTH} -- npx -y [email protected]{
"mcpServers": {
"codex-claude-council": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"FAKE_CLAUDE_AUTH": "${FAKE_CLAUDE_AUTH}",
"FAKE_CODEX_AUTH": "${FAKE_CODEX_AUTH}"
}
}
}
}Exposed tools (8)
4 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
ask_claude | read | Ask Claude alone through Claude Code signed in with a Claude subscription. Optional model/effort overrides. |
ask_codex | read | Ask Codex alone through the Codex CLI signed in with ChatGPT. Optional model/effort overrides. |
council_ask | read | Ask Codex (ChatGPT) and Claude independently; then each replies to the other\ |
council_cancel | write | Stop a council_ask, debate, ask_codex or ask_claude call that is still working in the background. |
council_join | read | Take part in the council yourself, in this conversation, with everything you already know, instead of a separate session of your model: |
council_turn | write | Send your reply to the council message that council_join, council_turn or council_result gave you, and wait for the next step. |
debate | write | Run the council and return JSON with the final answer, whether both models agree with it, both answers, every exchange (each model\ |
llm-council | write | Run any question through a council of 5 AI advisors: they debate. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (12)
- Do not start the same question again, and do not tell the user it failed: "still working" is normal. You may briefly say which step it is at.
return JSON.parse(text.replace(/^/, ''));
const config = exists ? JSON.parse(readFileSync(path, 'utf8').replace(/^/, '') || '{}') : {};<div class="hero"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAoAAAAKACAMAAAA7EzkRAAAAOVBMVEVMaXH////////////////////////////////////////////////////////////////////////VEWhLAAAAEnRSTlMA4Z
'{"codex": {"model": "gpt-5.6-sol", "effort": "xhigh"}, "claude": {"model": "opus"}}',- **Plan mode instead of a locked-down sandbox.** Claude Code now runs in plan mode (`--permission-mode plan`) with the user's own setup (skills, plugins, MCP servers, `CLAUDE.md`, permission rules) i
- Codex runs `codex exec` in its **read-only sandbox**, enforced by the operating system, with `approval_policy="never"`. Both are set on the command line, which overrides your `config.toml`, so even
- **Keep secrets out of the question.** The question is saved in both sessions and sent to both providers. Have the host read a connection string from an environment variable instead.
- **Windows:** HTTPS from `curl.exe`, `Invoke-WebRequest` and `git` fails inside Codex's sandbox (Windows' own TLS has no credentials for the sandbox account), while Python and Node work; Codex is tol
| [Claude Code CLI](https://code.claude.com/docs/en/setup), with a Claude Pro, Max, Team or Enterprise plan | macOS / Linux / WSL: `curl -fsSL https://claude.ai/install.sh \| bash`<br>Windows: `irm ht
curl -fsSL https://raw.githubusercontent.com/hamza-aziz-ai/codex-claude-council/main/install.sh | bash
curl -fsSL https://raw.githubusercontent.com/hamza-aziz-ai/codex-claude-council/main/install.sh | bash -s -- --claude-desktop
Gates applied: instruction_override, no_behavioural_pass.
38067eb41c33full audit observations/trust-audit/mcp-server/hamza-aziz-ai__codex-claude-council.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | 38067eb41c33 | BLOCK | D | 69 | first audit |
Questions
What is the codex-claude-council MCP server?
Two AIs. One answer. ChatGPT and Claude discuss with each other until they agree, through your own signed-in CLIs: no API keys. Both read your project (never change it) and search the web. Plugin for Claude Code, Codex, Claude Desktop and the ChatGPT app.
What tools does codex-claude-council expose?
8 in total: 4 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is codex-claude-council safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does codex-claude-council need?
It reads FAKE_CLAUDE_AUTH and FAKE_CODEX_AUTH from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (38067eb41c33), read on 2026-10-12. The repository is watched and re-audited when it changes.