If Codex can search your Kipt library but cannot see save_prompt, start by checking the active connection's permissions. Kipt deliberately keeps read access and saving access separate. A browser sign-in can remain read-only even after you create a different manual token with saving enabled. The permission message on the manual token card describes that token, not every app connected to your account.
This guide covers that specific situation. If Codex cannot connect at all, begin with the general Codex MCP setup guide. If search works, avoid repeatedly creating new tokens before identifying which credential the client actually uses. That can leave you with more credentials while the original connection remains unchanged.
For a first connection, follow the Kipt MCP setup guide, which covers Settings, access choices, example requests and save verification.
Understand the two connection types
Kipt supports browser sign-in and manual connection tokens. Browser sign-in opens a consent page, shows the requesting app and asks you to approve access to the connected library. Manual setup creates a token in Settings that a compatible client sends with requests. They are independent authorization records.
For either method, saving must be enabled for the credential the agent presents. Kipt does not let an agent edit or delete existing prompts through the save tool. Agent-created prompts receive the inbox tag so you can review them in the library. A writable connection therefore means permission to create new prompts, rather than unrestricted repository editing.
| What you see | What to check |
|---|---|
| Search works, save tool missing | The active connection's saving permission and current tool discovery. |
| Manual token says it can save | Whether Codex uses that token or a separate browser connection. |
| Connected app says read-only | Reconnect that app and explicitly approve saving. |
| New consent is complete, tool still missing | Restart or reconnect the client and check the active account and endpoint. |
| Authentication fails for every tool | Credentials, endpoint and account connection before write permissions. |
These checks follow Kipt's permission model. They are not a claim that every MCP server uses the same scopes or exposes separate tools for writes.
Check the connection shown in Kipt
Open Settings, then Agent connection. Under Connected apps, find the entry corresponding to Codex. Review whether it says read-only or can read and save new prompts. App names help identify a connection, but the name alone is not proof that a particular process is using it. Compare the account and library with the one you intend to access.
If the app is read-only, choose Enable saving. The reconnect flow requests a new browser approval. Checking a box in the manual token section and creating a token will not modify the browser grant. Existing read-only credentials should not gain permission silently; the person connecting the app needs to approve the broader access.
If several older entries exist, establish which new connection works before revoking unused ones. Revoking a live grant stops its access. Keep that action deliberate, especially if another agent still relies on the connection.
Reconnect an existing Codex browser connection
For a Codex CLI server named kipt that already uses browser sign-in, run the following commands in your own Terminal:
codex mcp logout kipt
codex mcp login kipt --scopes kipt:read,kipt:write,offline_access
The first command removes the saved OAuth login for that MCP server. The second starts a new authorization request with Kipt's read and save scopes. These commands retain the registered server definition; they do not require re-adding an existing entry. If you chose another server name, use that name in both commands.
When Kipt opens, verify the account and library. Check Allow saving new prompts, then choose Connect. Return to Codex after the browser approval completes. The exact client interface can vary; this command flow is for Codex CLI OAuth connections, not every connector installed through another host application.
OpenAI documents the MCP login, logout and scope options in its developer command reference. Kipt's scope names are product-specific. For a fresh installation, use Connect MCP in Kipt Settings to obtain installation commands before logging in. A reconnect command assumes the server already exists.
Refresh discovery and verify the save capability
After the updated server is deployed, Kipt Settings offers Verify saving for the selected connection. Copy its request into your agent. The connection_status tool identifies the actual login method and approved permissions; verify_connection performs an explicitly approved write, then compares the saved Markdown and complete index entry. Return to Settings and refresh to see Save verified. An empty validation request does not establish a successful save.
Restart Codex or reconnect the integration using the controls available in your client. A running agent may still have the tool list it discovered before you approved saving. Ask it to check whether Kipt exposes save_prompt. This checks capability availability without creating test clutter in your library.
Once the tool is available, choose a real prompt you want to keep. Ask the agent to save it to Kipt with an accurate title and description. Open Kipt, refresh the library and filter by inbox to review the result. Confirm the body and tags, not just the success message in chat.
Tool discovery and a successful save establish different things. Seeing save_prompt shows the client discovered the capability. Receiving a successful save result and finding the item in the intended library verifies the write path. Keep those outcomes separate when reporting what has been checked.
Handle manual-token connections deliberately
If Codex uses a bearer-token environment variable or a configured authorization header, the browser reconnect flow may not replace that authentication method. Decide whether to continue manual setup or migrate to browser sign-in. Kipt Settings provides the appropriate install flow; avoid mixing a manual credential and browser grant while diagnosing which one is active.
For advanced manual setup, Codex supports naming an environment variable for the bearer token. The variable must exist in the environment that launches the client. A value set only in an unrelated terminal does not necessarily reach an already running desktop process. OpenAI's MCP documentation describes this configuration approach. You do not need to paste the secret into an agent conversation or ask a restricted agent to edit protected user settings.
If a connection token has already been shared in chat or another unintended place, replace or revoke that manual token in Kipt Settings. Browser OAuth and manual-token revocation remain separate actions. Replacing a token also means updating any client that intentionally used the old one.
If saving remains unavailable
Collect non-secret evidence: the client type, registered server name, endpoint, whether search works, the Connected apps permission and the names of tools currently discovered. Include the sanitized error if a tool call fails. Never attach access tokens, refresh tokens, authorization headers or raw configuration containing credentials.
Then check one boundary at a time. Confirm the client reaches the intended Kipt deployment and account. Confirm fresh consent included saving. Confirm the client rediscovered tools after approval. If the save tool appears but the request fails, investigate the returned error rather than repeating the authorization steps indefinitely.
You can keep a reusable diagnostic request in Kipt: ask the agent to identify the active authentication method, compare approved access with the failing operation and report only sanitized evidence. The OAuth integration prompts provide a longer version for developers reviewing the implementation.