Codex can use Taskavel’s remote MCP server to inspect and work with the Taskavel account available to the connection. Use OAuth when Codex offers it for the server. When you deliberately need a static credential, configure a Taskavel personal access token through an environment variable instead of putting its value directly in configuration.
The production MCP endpoint is:
https://taskavel.com/mcp/taskavel
Add the server
Add the following entry to your user configuration at ~/.codex/config.toml, or to a trusted project’s .codex/config.toml when the project configuration is appropriate for the connection:
[mcp_servers.taskavel]
url = "https://taskavel.com/mcp/taskavel"
With an OAuth-capable setup, Codex uses OAuth by default when the server offers it. Follow the browser approval, confirm that you are signed in to the intended Taskavel account, and then verify the connection with a read request such as “List my Taskavel projects.”
Use a PAT only when static authorization is needed
Create a named PAT in Account Settings → AI Integration (MCP). Store the value in a private environment variable, for example TASKAVEL_MCP_TOKEN, using your operating system or secret manager. Then configure Codex to reference that variable:
[mcp_servers.taskavel]
url = "https://taskavel.com/mcp/taskavel"
bearer_token_env_var = "TASKAVEL_MCP_TOKEN"
Do not replace the variable name with the actual token in the TOML file. Codex also supports http_headers and env_http_headers for configurations that need HTTP headers, but bearer_token_env_var is the clearest choice for a Taskavel PAT. Keep user-level configuration private; use a project configuration only when every trusted collaborator and execution environment should have the same server definition, never the same raw token.
Verify and operate safely
Ask Codex to list projects or inspect a known task first. If it authenticates but a project is absent, verify the Taskavel account and membership instead of creating another token. For writes, identify the project, target, and desired result. Ask Codex to report ambiguous matches before acting.
Taskavel applies the connected user’s normal project roles. Review available operations through the generated MCP tools reference, especially the read/write/destructive classification. Permanent deletion requires an already archived task and explicit confirmation. Revoke a PAT or disconnect an OAuth connection in AI Integration (MCP) when that Codex setup should no longer have access.