Priya Nair
priya@acme.com
For OpenAI Codex
Deploy a Codex app for your team only
You built an internal tool with Codex. TeamOnly puts it at a private link that only coworkers can open, with their work Google or Microsoft account or a code sent to their work email. Codex does the setup and the deploy from your terminal or editor.
deploy this on TeamOnlyCodex wants to run npx teamonly deploy. It needs the network. Approve?Live at https://stock.acme.teamonly.appOnly @acme.com accounts can sign in.01Short answer
Codex reads AGENTS.md. TeamOnly writes it.
Run npx teamonly init in the project. It adds an AGENTS.md with the TeamOnly rules, and OpenAI’s docs say Codex reads AGENTS.md before doing any work.
Then ask Codex to build the tool and deploy it. It runs npx teamonly deploy and gives you a link like stock.acme.teamonly.app. Nobody outside your company can open it.
02Steps
From a folder on your laptop to a link your team signs in to
Add the rules
In the app’s folder, run
npx teamonly init. In an empty folder it creates a starter app; in an existing one it adds the TeamOnly files and leaves your code alone.Open it in Codex
Start
codexin that folder, or open the folder in your editor with the Codex extension. Both read the sameAGENTS.md.Ask for the tool
“A stock counter where anyone on the floor logs a count from their phone.” Codex writes it in the one shape TeamOnly runs: a React front end and a small API.
Deploy
Say “deploy this on TeamOnly”. Codex runs
npx teamonly deploy. The first time, it asks for your work email and the 6-digit code we send you, and offers a free 14-day trial if your company is new.Share the link
Send it to the team. Change the app later and deploy again; the link stays the same.
npx teamonly initAdded the TeamOnly instructions for Claude Code, Cursor and other AI tools npx teamonly deployLive at https://stock.acme.teamonly.app03What Codex reads
The rules Codex follows in this project
init writes a marked block into AGENTS.md at the top of the project. If you already have an AGENTS.md, the rest of your file is left as it is. The block describes the app shape, how to get the signed-in person, the database and files, and how to deploy.
OpenAI’s docs say Codex builds its instructions from AGENTS.md files, starting at the project root and walking down to the folder you work in, after an optional global file in ~/.codex. So the TeamOnly rules are there in every Codex session in this project, with nothing to switch on.
That is what stops Codex from adding Express, Next.js, Supabase or a login page. Those don’t run on TeamOnly, and the rules say so.
04Running commands
Codex asks before it goes online
On your computer, Codex runs commands in a sandbox. OpenAI’s docs say network access is off by default in the CLI and the editor extension, and Codex asks for approval to run a command that needs it. Deploying sends your app to TeamOnly, so you will see that prompt. Approve it, and the deploy finishes.
Codex Cloud is different. Cloud tasks run in OpenAI’s containers, offline by default, and they don’t have your TeamOnly sign-in. Use Codex Cloud to write the code if you like, then pull the changes and deploy from your own computer.
05MCP option
Add TeamOnly as a tool in Codex
The teamonly package is also an MCP server, so Codex can deploy, read logs and change who can open an app through tools instead of commands. Add it once:
codex mcp add teamonly -- npx -y teamonly mcpOr add it to ~/.codex/config.toml yourself. OpenAI’s docs say the Codex CLI, the editor extension and the ChatGPT desktop app share this file, so you set it up once:
[mcp_servers.teamonly]
command = "npx"
args = ["-y", "teamonly", "mcp"]06What coworkers see
A sign-in page, then your app
Your coworkers don’t need Codex, a ChatGPT account or anything installed.
They open the link and sign in with their work Google or Microsoft account, or a code sent to their work email. TeamOnly checks that before any of your code runs, and your app gets their name and email. Anyone outside your company stops at the sign-in page. People who only use apps are free. How company login works.
A door marked Staff only stands in front of the expenses app. Sam, signed in as sam@acme.com, is checked at the door and walks in. Next, randomperson@gmail.com and a bot are checked at the same door and turned away. They never reach the app, because the check happens at the door, before the app.
Does Codex read AGENTS.md?
Yes. OpenAI’s Codex docs say Codex reads AGENTS.md files before doing any work. npx teamonly init adds the TeamOnly rules to AGENTS.md, so Codex follows them without any setting.
Can Codex run npx teamonly deploy for me?
Yes, in the Codex CLI and the editor extension. Because deploying needs the network, Codex asks you to approve the command first, unless you have turned network access on in your Codex settings.
Can I deploy from Codex Cloud?
Not directly. Cloud tasks run offline by default and don’t have your TeamOnly sign-in, and the TeamOnly rules tell the AI never to work around sign-in. Let Codex Cloud write the change, pull it, and run npx teamonly deploy on your computer.
Do I need the MCP server?
No. Codex can run the commands in the terminal. The MCP server is there if you prefer Codex to use tools, for example to read the live app’s logs or change who can open it.
Will Codex write Python or Next.js?
It shouldn’t in this project. The rules in AGENTS.md describe one app shape: a React and Vite front end with a Hono API in TypeScript. TeamOnly doesn’t run Python, containers or Next.js server features.
What does it cost?
The first 14 days are free, no card. Then Builder is $19 a month for one builder and 3 apps, and Team is $249 a month for every builder and app. Coworkers who only use apps are free. Codex is billed by OpenAI as usual.
Sources
Facts about Codex checked 26 October 2026 on OpenAI’s docs: AGENTS.md, approvals, sandbox and network access, MCP servers. Codex changes often; check its docs if something looks different.
Keep reading
Early access
Put your first tool online this week.
TeamOnly is in early access, and every plan is open now. Try it free for 14 days with no card, or subscribe. Either way, your company is ready right away, and three commands put your first app online.
Not ready? Get updates
Questions go to hello@teamonly.dev, and a person answers.