codex-grok-mcp Architecture

codex-grok-mcp Architecture An architecture diagram generated by Archify. Codex · Codex machine Codex Local MCP server · Codex machine · npm package Local MCP server npm package Private workspace · Codex machine › ephemeral prompt boundary Private workspace Grok CLI · Codex machine Grok CLI xAI Grok · Architecture component xAI Grok Paired client · Codex machine › paired key boundary Paired client Cloudflare relay · Architecture component Cloudflare relay VM companion · Grok Bot VM VM companion Grok Bot gateway · Grok Bot VM Grok Bot gateway Named Grok Bots · Grok Bot VM Named Grok Bots stdio MCP one-off ask fixed argv + prompt file authenticated Grok session paired Bot tools outbound WSS + AES-256-GCM opaque frames bounded loopback API exact non-group Bot ID Codex machine ephemeral prompt boundary paired key boundary Grok Bot VM Legend Frontend Backend Cloud Security External

Two supported paths

  • • Use Grok CLI for a stateless one-off answer
  • • Use paired mode for persistent named Bots
  • • Both paths enter through the same local MCP server

Secrets stay local

  • • Grok CLI auth remains on the Codex machine
  • • Gateway credentials remain inside the VM
  • • The relay sees connection metadata and ciphertext

Write safety

  • • Recipients bind to ordered exact Bot IDs
  • • Bulk sends require a fresh roster fingerprint
  • • Uncertain writes are never retried automatically