feat(plugins): Codex gets the plugin surface /mcp/plugin/chatgpt; Claude Code keeps the full /mcp

.github/workflows/check.yml

@@ -19,17 +19,35 @@ jobs:
         run: |
           for f in .agents/plugins/marketplace.json .claude-plugin/marketplace.json \
             plugins/corespeed/.codex-plugin/plugin.json plugins/corespeed/.claude-plugin/plugin.json \
-            plugins/corespeed/.mcp.json plugins/corespeed-cli/.codex-plugin/plugin.json; do
+            plugins/corespeed/.mcp.json plugins/corespeed/.mcp.claude.json plugins/corespeed-cli/.codex-plugin/plugin.json; do
             jq empty "$f" || { echo "::error file=$f::invalid JSON"; exit 1; }
           done
-      - name: The MCP server signs in with OAuth
+      - name: The MCP servers sign in with OAuth
         # The plugin must never ask for an API key: the client discovers the
-        # authorization server from the /mcp challenge (RFC 9728), so the entry
-        # carries only the URL — no headers, no token env var, no oauth_resource.
+        # authorization server from the server's challenge (RFC 9728), so each
+        # entry carries only the URL — no headers, no token env var, no oauth_resource.
         run: |
-          jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"]) and .corespeed.url == "https://api.corespeed.io/mcp"' \
-            plugins/corespeed/.mcp.json > /dev/null \
-            || { echo "::error file=plugins/corespeed/.mcp.json::expected exactly {type, url} pointing at https://api.corespeed.io/mcp"; exit 1; }
+          jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"])' plugins/corespeed/.mcp.json > /dev/null \
+            || { echo "::error file=plugins/corespeed/.mcp.json::expected exactly {type, url}"; exit 1; }
+          jq -e '.mcpServers | length == 1 and (.corespeed | keys == ["type", "url"])' plugins/corespeed/.mcp.claude.json > /dev/null \
+            || { echo "::error file=plugins/corespeed/.mcp.claude.json::expected exactly {type, url}"; exit 1; }
+      - name: Codex and the Directory get the plugin surface; Claude Code the full server
+        # The OpenAI Plugins Directory accepts mcpServers only as the root
+        # ./.mcp.json, so that file is the fixed plugin surface
+        # /mcp/plugin/chatgpt (memory, connector discovery), which no
+        # organization's connector count can push past Codex's catalog limit.
+        # Claude Code loads .mcp.json first and then the file its manifest
+        # names; the later `corespeed` entry replaces the earlier one, so it
+        # gets the full /mcp from .mcp.claude.json.
+        run: |
+          [ "$(jq -r .mcpServers plugins/corespeed/.codex-plugin/plugin.json)" = "./.mcp.json" ] \
+            || { echo "::error file=plugins/corespeed/.codex-plugin/plugin.json::mcpServers must be ./.mcp.json (the Directory accepts no other path)"; exit 1; }
+          [ "$(jq -r .mcpServers.corespeed.url plugins/corespeed/.mcp.json)" = "https://api.corespeed.io/mcp/plugin/chatgpt" ] \
+            || { echo "::error file=plugins/corespeed/.mcp.json::must point at https://api.corespeed.io/mcp/plugin/chatgpt"; exit 1; }
+          [ "$(jq -r .mcpServers plugins/corespeed/.claude-plugin/plugin.json)" = "./.mcp.claude.json" ] \
+            || { echo "::error file=plugins/corespeed/.claude-plugin/plugin.json::mcpServers must be ./.mcp.claude.json"; exit 1; }
+          [ "$(jq -r .mcpServers.corespeed.url plugins/corespeed/.mcp.claude.json)" = "https://api.corespeed.io/mcp" ] \
+            || { echo "::error file=plugins/corespeed/.mcp.claude.json::must point at https://api.corespeed.io/mcp"; exit 1; }
       - name: The CLI plugin is skills-only and bundles the same cs-cli skill
         # corespeed-cli registers no MCP server: that is the point of it (a
         # client loads no tool list). Its cs-cli skill is a copy of the MCP

README.md

@@ -34,6 +34,17 @@ select **Authenticate** (or open **Settings → MCP servers → CoreSpeed**) and
 finish the sign-in in the browser. In the ChatGPT desktop app the plugin
 appears under the **CoreSpeed** marketplace once it has been added.
 
+In Codex the plugin's server (the root `.mcp.json`, the one file the OpenAI
+Plugins Directory accepts) is `https://api.corespeed.io/mcp/plugin/chatgpt`: a
+fixed, small tool list — shared memory and connector discovery — that no
+organization's connector count can push past Codex's catalog limit. Claude Code
+gets the full `https://api.corespeed.io/mcp` from `.mcp.claude.json`, which its
+manifest declares and which replaces the root entry by name. The agent
+finds an app with `manage__connectors_search`, hands you a link to connect it,
+calls a connected app's tools through the bundled `cs-cli` skill
+(`cs mcp search`, `cs mcp get`, `cs mcp call`), and moves files in and out
+of the organization's Drive with `cs drive`.
+
 ## Codex, CLI only
 
 ```bash
@@ -64,7 +75,7 @@ organizations, connects apps, and calls tools from a terminal. See the
 
 | Plugin | Part | What it does |
 | --- | --- | --- |
-| `corespeed` | MCP server | `https://api.corespeed.io/mcp` with browser sign-in (OAuth 2.1 + PKCE). You never paste an API key. |
+| `corespeed` | MCP server | Browser sign-in (OAuth 2.1 + PKCE), never a pasted key. Claude Code: the full `https://api.corespeed.io/mcp`. Codex: the plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory, connector discovery). |
 | `corespeed` | `cs-cli` skill | Using the `cs` CLI: sign-in, finding and calling tools from a shell, memory, files in the Drive, API keys, organizations, connectors, remote MCP servers, credit. |
 | `corespeed` | `cs-api` skill | Calling CoreSpeed over HTTP from code and CI: credentials, `tools/list` and `tools/call`, error codes, credits. |
 | `corespeed-cli` | `cs-cli` skill | The same skill, and nothing else: no MCP server is registered. |
@@ -73,9 +84,9 @@ If you added CoreSpeed to your client by hand earlier (`claude mcp add` or
 `codex mcp add`), remove that entry before installing the plugin, so every
 tool is registered once.
 
-Sign-in happens at `login.corespeed.io`, and the plugins' only server is
-`https://api.corespeed.io/mcp`. Anything else claiming to be CoreSpeed is not
-this plugin.
+Sign-in happens at `login.corespeed.io`, and the plugins' only servers are
+`https://api.corespeed.io/mcp` and `https://api.corespeed.io/mcp/plugin/chatgpt`.
+Anything else claiming to be CoreSpeed is not this plugin.
 
 ## Other clients
 

plugins/corespeed-cli/skills/cs-cli/SKILL.md

@@ -9,10 +9,13 @@ description: Use when a task needs the CoreSpeed CLI (cs, npm package @corespeed
 under a member session stored on this machine. It needs Node.js 20 or Bun and
 has no runtime dependencies.
 
-If your client already has the CoreSpeed MCP server
-(`https://api.corespeed.io/mcp`), call its tools directly. Use `cs` when it
-does not: a plugin without an MCP server, a client that cannot load a large
-tool list, a human at a terminal, or a CI job that needs an API key.
+If your client has the full CoreSpeed MCP server
+(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's
+server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and
+connector discovery only, so there a connected app's tools are called with
+`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a
+large tool list, when a human is at a terminal, or when a CI job needs an API
+key.
 
 The canonical reference is https://corespeed.io/docs/cli. When this skill and
 the docs disagree, the docs win.

plugins/corespeed/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "corespeed",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Connect Claude Code to CoreSpeed: your connected apps, shared memory, Drive, media, web and social tools through one MCP server, plus skills for the cs CLI and the HTTP API.",
   "author": {
     "name": "CoreSpeed",
@@ -10,5 +10,6 @@
   "homepage": "https://corespeed.io/docs",
   "repository": "https://github.com/corespeed-io/cs",
   "license": "Apache-2.0",
-  "keywords": ["corespeed", "mcp", "memory", "drive", "connectors", "cli", "agents"]
+  "keywords": ["corespeed", "mcp", "memory", "drive", "connectors", "cli", "agents"],
+  "mcpServers": "./.mcp.claude.json"
 }

plugins/corespeed/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "corespeed",
-  "version": "0.2.2",
-  "description": "Connect Codex to CoreSpeed: your connected apps, shared memory, Drive, media, web and social tools through one MCP server, plus skills for the cs CLI and the HTTP API.",
+  "version": "0.3.0",
+  "description": "Connect Codex to CoreSpeed: long-term memory shared across your agents and connector discovery through one MCP server, the tools of your connected apps and the files in your organization's Drive through the cs CLI, plus skills for the CLI and the HTTP API.",
   "author": {
     "name": "CoreSpeed",
     "email": "contact@corespeed.io",
@@ -23,8 +23,8 @@
   "mcpServers": "./.mcp.json",
   "interface": {
     "displayName": "CoreSpeed",
-    "shortDescription": "Connected apps, memory and tools for agents",
-    "longDescription": "Connect Codex to CoreSpeed's MCP server with a browser sign-in: the tools of every app your organization has connected, long-term memory shared across agents, a Drive every tool reads and writes, media generation and understanding, live web search and public social data, all on one wallet with spend caps and an audit trail. Bundled skills cover the cs CLI and calling CoreSpeed over HTTP from code and CI.",
+    "shortDescription": "Shared memory, connector discovery, and your apps' tools and files through the cs CLI",
+    "longDescription": "Connect Codex to CoreSpeed with a browser sign-in. The plugin's MCP server carries long-term memory shared across your organization's agents and connector discovery: the agent finds an app your organization uses, sees whether it is connected, and hands you a one-click link to connect it. The tools of connected apps are called through the bundled cs CLI skill (cs mcp search, cs mcp get, cs mcp call), and files move in and out of the organization's Drive with cs drive, so Codex loads a small, fixed tool list whatever your organization has connected. Every call is metered on one wallet with spend caps and an audit trail, and a human can be asked to approve a write first.",
     "developerName": "CoreSpeed",
     "category": "Developer Tools",
     "capabilities": [
@@ -35,9 +35,9 @@
     "websiteURL": "https://corespeed.io",
     "privacyPolicyURL": "https://corespeed.io/privacy",
     "defaultPrompt": [
-      "Search my CoreSpeed memory for context relevant to this task.",
-      "Show my connected CoreSpeed tools and explain what I can do with them.",
-      "Set up this project's CI to call CoreSpeed with an API key."
+      "Search my CoreSpeed memory for context on this repository before we start.",
+      "Find out whether my organization has Notion connected on CoreSpeed, and give me the link if not.",
+      "Use the cs CLI to find the CoreSpeed tool for this task, show its schema, then call it."
     ],
     "brandColor": "#C2410C",
     "composerIcon": "./assets/icon.svg",

plugins/corespeed/.mcp.claude.json

@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "corespeed": {
+      "type": "http",
+      "url": "https://api.corespeed.io/mcp"
+    }
+  }
+}

plugins/corespeed/.mcp.json

@@ -2,7 +2,7 @@
   "mcpServers": {
     "corespeed": {
       "type": "http",
-      "url": "https://api.corespeed.io/mcp"
+      "url": "https://api.corespeed.io/mcp/plugin/chatgpt"
     }
   }
 }

plugins/corespeed/skills/cs-api/SKILL.md

@@ -8,7 +8,9 @@ description: Use when calling CoreSpeed over HTTP from code, CI, or a headless a
 CoreSpeed is one authenticated MCP server, `https://api.corespeed.io/mcp`,
 that carries the tools of the apps an organization has connected, long-term
 memory, media generation and understanding, live web search, and public social
-data. An agent with this plugin installed already has it as an MCP server; this
+data. An agent with this plugin installed already has it — or, in Codex, the
+plugin surface `https://api.corespeed.io/mcp/plugin/chatgpt` (memory and
+connector discovery), which takes the same credentials — as an MCP server; this
 skill is for code that talks to it directly: a service, a CI job, a script, or
 a client without OAuth.
 
@@ -26,7 +28,7 @@ decides which tools, accounts, and memories the response contains.
 
 | Credential | Who is calling | Use it for |
 | --- | --- | --- |
-| Browser sign-in (MCP OAuth token) | A member, from an OAuth-capable client | Interactive agents. Accepted on `POST /mcp` only |
+| Browser sign-in (MCP OAuth token) | A member, from an OAuth-capable client | Interactive agents. Accepted on `POST /mcp` and `POST /mcp/plugin/<name>` (one token, the URL picks the surface) |
 | `sk-cs-…` API key | The member who created it | CI, services, clients without OAuth |
 | `sk-csa-…` agent key | An agent principal with its own identity | Unattended agents; reaches the organization's shared accounts only |
 | Session JWT | A member, from the `cs` CLI or the dashboard | One-off scripts (`cs token`); lives five minutes |

plugins/corespeed/skills/cs-cli/SKILL.md

@@ -9,10 +9,13 @@ description: Use when a task needs the CoreSpeed CLI (cs, npm package @corespeed
 under a member session stored on this machine. It needs Node.js 20 or Bun and
 has no runtime dependencies.
 
-If your client already has the CoreSpeed MCP server
-(`https://api.corespeed.io/mcp`), call its tools directly. Use `cs` when it
-does not: a plugin without an MCP server, a client that cannot load a large
-tool list, a human at a terminal, or a CI job that needs an API key.
+If your client has the full CoreSpeed MCP server
+(`https://api.corespeed.io/mcp`), call its tools directly. The Codex plugin's
+server (`https://api.corespeed.io/mcp/plugin/chatgpt`) carries memory and
+connector discovery only, so there a connected app's tools are called with
+`cs`. Use `cs` as well when there is no MCP server, when a client cannot load a
+large tool list, when a human is at a terminal, or when a CI job needs an API
+key.
 
 The canonical reference is https://corespeed.io/docs/cli. When this skill and
 the docs disagree, the docs win.