--- title: "How to Connect Your Bank to Codex CLI" slug: how-to-connect-your-bank-to-codex-cli url: https://bankbridge.money/guides/how-to-connect-your-bank-to-codex-cli category: how-to published: 2026-07-10 updated: 2026-07-10 --- # How to Connect Your Bank to Codex CLI > Add a [mcp_servers.bankbridge] table to ~/.codex/config.toml with url = "https://bankbridge.money/api/mcp" and bearer_token_env_var = "BANKBRIDGE_API_KEY", set experimental_use_rmcp_client = true at the top level of the file, then export your bbk_ key and restart Codex. Run /mcp inside a session to confirm all 11 BankBridge tools loaded. Connect Your Bank to Codex CLI via MCP | BankBridge | BankBridge [How-to](/guides/how-to) # How to Connect Your Bank to Codex CLI Updated Jul 10, 2026ยท5 min read Add a \[mcp\_servers.bankbridge\] table to ~/.codex/config.toml with url = "https://bankbridge.money/api/mcp" and bearer\_token\_env\_var = "BANKBRIDGE\_API\_KEY", set experimental\_use\_rmcp\_client = true at the top level of the file, then export your bbk\_ key and restart Codex. Run /mcp inside a session to confirm all 11 BankBridge tools loaded. ## Codex does MCP a little differently If you've added MCP servers to Claude Desktop or Cursor before, you've been editing JSON. Codex CLI doesn't use JSON. Its config lives at ~/.codex/config.toml, and MCP servers go in \[mcp\_servers.\] tables, one table per server. There's a second wrinkle. Codex supports two kinds of MCP servers: local stdio servers that it spawns as child processes (you give it a command and args), and remote streamable-HTTP servers it connects to over the network (you give it a url). BankBridge is the remote kind, a hosted server you just point at. And remote servers currently sit behind a feature flag. Miss the flag and Codex loads zero tools without so much as a warning. OpenAI's docs cover the mechanism but are thin on complete working examples, which is presumably why you're here. The whole setup is four lines of TOML and one environment variable. ## Get a BankBridge API key BankBridge is a hosted MCP server that gives agents read-only access to your live bank data. Sign up at bankbridge.money with your email (magic link, no password), then connect a bank from the dashboard. The link flow runs inside a secure, bank-provided UI. You pick your institution, sign in there, and approve read-only access. BankBridge stores an encrypted access token, never your bank password, and none of your financial data is cached on our servers. Every question Codex asks gets answered with a live fetch. With a bank connected, create an API key. It starts with bbk\_ and is shown exactly once, so copy it now. Pricing is $5/mo per connected bank, cancel anytime. ## The config.toml entry Open ~/.codex/config.toml. If the file doesn't exist yet, create it. Add this: > experimental\_use\_rmcp\_client = true > \[mcp\_servers.bankbridge\] > url = "https://bankbridge.money/api/mcp" > bearer\_token\_env\_var = "BANKBRIDGE\_API\_KEY" Three things worth knowing. First, experimental\_use\_rmcp\_client = true is a top-level setting. It has to appear above any \[section\] header. TOML assigns every key to whichever table it appears under, so if the flag ends up inside \[mcp\_servers.bankbridge\], Codex treats it as a random server option and your remote server never loads. Second, url points at BankBridge's hosted endpoint. There's nothing to install, no npx wrapper, no local process to babysit. Third, bearer\_token\_env\_var names an environment variable instead of holding the key itself. Codex reads the actual secret from your shell, which keeps it out of a file that has a habit of ending up in public dotfile repos. ## Export the key in your shell One line: > export BANKBRIDGE\_API\_KEY="bbk\_your\_key\_here" Run it in the terminal where you'll launch Codex, and add it to ~/.zshrc or ~/.bashrc so new shells get it too. Keeping the key in an env var also makes rotation painless: swap the export, leave the TOML alone. We have a short guide on rotating your key if you ever need to. ## Confirm the 11 tools loaded Start a new session with codex. Inside the TUI, type /mcp. Codex lists each configured server along with the tools it exposes. Recent builds also ship a codex mcp list subcommand you can run from the shell without starting a session. You're looking for bankbridge with 11 tools: list\_accounts, get\_account, list\_transactions, search\_transactions, get\_spending\_summary, get\_recurring\_charges, get\_monthly\_cashflow, get\_merchant\_history, list\_categories, list\_holdings, and list\_investment\_transactions. Then ask it something real: > How much did I spend this week? Codex should call get\_spending\_summary or list\_transactions and come back with numbers from your actual account. There's no sync step and no snapshot; every answer is fetched live at the moment you ask. ## If Codex loads zero tools The failure mode is silent, which makes it more annoying than a crash. Work through these in order. The flag is missing or in the wrong place. This is the cause nine times out of ten. experimental\_use\_rmcp\_client = true belongs at the very top of config.toml, above every \[section\]. Inside the server block it does nothing. The key isn't in Codex's environment. Codex resolves bearer\_token\_env\_var at startup, so an export from a different terminal tab, or one you added to .zshrc but never sourced, won't be visible. Run echo $BANKBRIDGE\_API\_KEY in the same shell right before launching. You pasted JSON. Snippets from Claude Desktop or Cursor docs won't parse as TOML. If Codex complains about the config file, or silently ignores it, look for stray braces and colons. Codex is out of date. Streamable-HTTP MCP support is relatively new. Upgrade with npm install -g @openai/codex (or brew upgrade codex if you installed via Homebrew) and try again. ## What to ask once it's in Some starting points that map cleanly onto the tools: > What are my recurring charges, sorted by monthly cost? > Which merchants did I spend the most with last month? > Compare my income against my expenses for June. Everything is read-only by design. There are no tools for moving money, paying bills, or placing trades, so the blast radius of a curious agent is exactly zero dollars. And the key isn't Codex-specific: the same bbk\_ key works in Claude Code, Gemini CLI, Cursor, and the other MCP hosts we document, so connecting your second agent takes about thirty seconds. ## FAQ Where does Codex CLI look for MCP server config? In ~/.codex/config.toml. Each server gets its own \[mcp\_servers.\] table. Local stdio servers use command and args keys; remote streamable-HTTP servers like BankBridge use url, plus bearer\_token\_env\_var for authentication. The file doesn't exist until you create it. Why does Codex show zero MCP tools after I add the server? Almost always because experimental\_use\_rmcp\_client = true is missing or misplaced. It must sit at the top level of config.toml, above any \[section\] header. Remote HTTP MCP servers are behind this flag, and without it Codex skips them without an error message. Is BankBridge access from Codex read-only? Yes. All 11 tools read data: balances, transactions, spending summaries, recurring charges, cashflow, merchant history, categories, and investment holdings. There are no tools for transfers, payments, or trades, so no agent connected through BankBridge can move your money. What does BankBridge cost with Codex CLI? $5 per month per connected bank, regardless of how many agents use it. The same bbk\_ key works in Codex CLI, Claude Code, Gemini CLI, Cursor, and every other MCP host. Cancel anytime from the dashboard and billing stops. Does this work for Codex Cloud too? This guide covers the local Codex CLI, which reads ~/.codex/config.toml. OpenAI's cloud-hosted Codex (the GitHub-connected one) configures MCP servers per environment in its own settings instead. BankBridge works there too; the endpoint and bearer key are the same. Can I keep the API key out of config.toml? That's the default here. bearer\_token\_env\_var tells Codex to read the key from an environment variable, so config.toml never contains the secret. Export BANKBRIDGE\_API\_KEY in your shell profile, and when you rotate the key you only change the export. ## FAQ ### Where does Codex CLI look for MCP server config? In ~/.codex/config.toml. Each server gets its own [mcp_servers.] table. Local stdio servers use command and args keys; remote streamable-HTTP servers like BankBridge use url, plus bearer_token_env_var for authentication. The file doesn't exist until you create it. ### Why does Codex show zero MCP tools after I add the server? Almost always because experimental_use_rmcp_client = true is missing or misplaced. It must sit at the top level of config.toml, above any [section] header. Remote HTTP MCP servers are behind this flag, and without it Codex skips them without an error message. ### Is BankBridge access from Codex read-only? Yes. All 11 tools read data: balances, transactions, spending summaries, recurring charges, cashflow, merchant history, categories, and investment holdings. There are no tools for transfers, payments, or trades, so no agent connected through BankBridge can move your money. ### What does BankBridge cost with Codex CLI? $5 per month per connected bank, regardless of how many agents use it. The same bbk_ key works in Codex CLI, Claude Code, Gemini CLI, Cursor, and every other MCP host. Cancel anytime from the dashboard and billing stops. ### Does this work for Codex Cloud too? This guide covers the local Codex CLI, which reads ~/.codex/config.toml. OpenAI's cloud-hosted Codex (the GitHub-connected one) configures MCP servers per environment in its own settings instead. BankBridge works there too; the endpoint and bearer key are the same. ### Can I keep the API key out of config.toml? That's the default here. bearer_token_env_var tells Codex to read the key from an environment variable, so config.toml never contains the secret. Export BANKBRIDGE_API_KEY in your shell profile, and when you rotate the key you only change the export.