# Deploy an app built with OpenAI Codex

OpenAI Codex has built your app and asked how to deploy it. Add the **Salus MCP server** to Codex and it can deploy the repository itself, under the rules your organization sets on Salus: it creates the project, follows the pipeline, adds a database and hands you the URL. The setup below works for the Codex CLI and the Codex IDE extension, which read the same configuration file.

## Before you begin

-   A Salus account. [Start free](https://app.salus.cloud/register).
-   **GitHub or GitLab connected** to your Salus organization, with the code pushed. Salus builds from the repository and can’t create one for you. See [Git Management](https://salus.cloud/docs/getting-started/git-management/).
-   An app that serves HTTP on a fixed port. Salus sends traffic to the port in the release configuration (**8080** when an agent creates it) and doesn’t set a `PORT` variable, so an app that falls back to a default such as 3000 listens there.

### Install the Salus CLI

```bash
curl -fsSL https://download.salus.cloud/install.sh | bash
```

The MCP server is part of the `salus` binary, installed to `/usr/local/bin/salus`.

### Add Salus to Codex

Add the server to `~/.codex/config.toml`:

```toml
[mcp_servers.salus]
command = "salus"
args = ["mcp"]
```

Restart Codex so it reads the new configuration. In the CLI, `/mcp` lists the servers Codex has loaded.

### Sign in

Ask Codex something about Salus, such as “list my Salus projects”. The first call opens your browser to sign in, and the session is reused after that.

### Ask Codex to deploy

Push the code, then ask:

```text
Deploy this repository to Salus, in the Production environment.
The app listens on port 3000. Watch the pipeline and give me the
URL when it's live. If the build fails, read the build logs and fix it.
```

Codex finds your organization, workspace, Git connection, repository and environment, then calls `deploy_repo`. That one call creates the project, attaches a release configuration for the environment and starts the first pipeline. It polls `get_pipeline` through build, tests, vulnerability scanning and deploy, and reads the URL from `list_deployments`.

### Add a database

```text
Create a PostgreSQL database called orders-db in the same region as
this project's Production environment, link it to the project, and
update the app to read SALUS_DATABASE_ORDERS_DB_CONNECTION_STRING.
```

Linking injects the connection details as environment variables named after the database. See [Connect a Database](https://salus.cloud/docs/deployments/databases/connect/).

## What Codex can reach

Codex acts **on your behalf, with your access**: it can’t reach a workspace, project or environment you can’t, and your organization’s release rules and pipeline gates apply to what it deploys. Its deploys appear in the organization’s audit log as made by Salus MCP acting as you.

Deleting a project, database or deployment is irreversible, and Codex should confirm with you first. The Salus server also limits which tools it exposes, from **Read-only** up to **Full**; see [Getting started with MCP](https://salus.cloud/docs/mcp/getting-started/).

## Make it the project’s default

Codex reads `AGENTS.md` at the root of the repository. Add a deployment section so every session deploys the same way:

```markdown
## Deployment

This app deploys to Salus through the Salus MCP server (`salus mcp`).

- Salus builds from the Git repository, so push before you deploy.
- First deploy: `deploy_repo`. It always creates a NEW project, so check
  `list_projects` first; if one exists, use `start_deployment`.
- The app listens on port 8080 (set `port` if that changes).
- Poll `get_pipeline` until it settles; `list_deployments` has the URL.
- Ask a person before anything destructive.
```

## Troubleshooting

-   **Codex doesn’t list the Salus tools.** Check the `[mcp_servers.salus]` block in `~/.codex/config.toml`, use the full path `/usr/local/bin/salus` if `salus` isn’t on your `PATH`, and restart Codex.
-   **The pipeline passed but the app won’t load.** The app listens on a different port from the one Salus routes to. Tell Codex the real port, or make the app listen on `8080`.
-   **The build failed and the agent can’t see why.** If `get_build_logs` comes back empty, open the pipeline in the Salus console: each stage has its own logs.
-   **The app keeps restarting.** Check its logs. If it’s running out of memory, ask the agent to raise `memorySize` on the release configuration; new deployments start with **128 MB**, the smallest size, which is enough for a small web app.
-   **Two projects for one repository.** `deploy_repo` always creates a new project. Delete the duplicate and redeploy the original with `start_deployment`.

More prompts to start from: [Use cases & sample prompts](https://salus.cloud/docs/mcp/use-cases/). Using another agent? See [Deploy with an AI coding agent](https://salus.cloud/docs/guides/deploy-with-an-ai-agent/).