# Your coding agent spends its budget thinking, and you are already paying someone else to think
There are two halves to what a coding agent does for you, and only one of them is typing.
Before it writes a line, it plans: reads enough of your project to work out what the change actually touches, decides on an order, picks an approach. After it finishes, it reviews: checks whether the thing it just did works, whether the tests it claims to have run actually ran. Planning and reviewing are the reasoning-heavy parts, and reasoning is what you are metered on.
Meanwhile there is a ChatGPT subscription on your account that you pay for every month whether you open it or not, and on most days it sits close to idle.
`codex-with-chatgpt` is an eleven-day-old MIT project that puts those two facts next to each other. ChatGPT does the planning and the review, on the plan you already bought. Codex keeps execution — the writing, the shell, the commits — on your own machine.
If you would rather skip the paragraph and do it by hand, that is three commands:
git clone https://github.com/XiaoDuoYa/codex-with-chatgpt ~/codex-with-chatgpt
cd ~/codex-with-chatgpt && corepack pnpm install && corepack pnpm build
mkdir -p ~/.codex/skills/codex-with-chatgpt && cp skill/SKILL.md ~/.codex/skills/codex-with-chatgpt/
Then tell Codex "Set up Codex with ChatGPT" and it runs first-time setup itself.
How the split works
The two halves talk over two separate channels, and the difference between them is the whole security story.
The control plane is tiny: Codex and ChatGPT exchange short structured state messages — INIT → PLAN → EXECUTED → REVIEW → DONE. No diffs, no logs, no file contents.
The data plane is where ChatGPT reads your code, and it can only read. Nine tools exist on that side and no others: workspace_info, list_directory, read_file, search_workspace, git_status, git_diff, test_status, execution_summary, execution_output. There is no write tool, no delete tool, no shell tool, no commit tool. Not disabled — absent. A prompt injection cannot reach for a capability the server does not implement.
Worth being precise about one thing, because the appealing version of this sentence is false. Your repository is never uploaded. The lines ChatGPT asks for do travel. It pulls what it needs, when it needs it, rather than shipping the tree — so the files it reads leave your machine and the other several thousand do not. .env files, keys, SSH material and credentials are denied by default before any of that happens, and you can extend the denylist with a .c2cignore.
The part that is actually interesting
The review step is not a courtesy. After Codex executes, ChatGPT goes and reads the real git diff and the real test records itself, rather than accepting a summary.
Anyone who has watched an agent announce that everything passed, and then found out otherwise, will recognise why that matters. The reviewer here is a different model on a different plane with read-only access to the evidence. It cannot be talked out of what the diff says.
Installing it without knowing what MCP is
The project's install path is a paragraph you paste to your agent. It clones, builds, installs the skill, runs first-time setup and stops to ask you only when it needs a login.
It asks for two. ChatGPT, so it can add the connector — required. Cloudflare, optional: sign in and you get a stable hostname, skip it and you get a temporary address that changes on restart, which the agent repairs by itself. Skipping costs you a slower reconnect and nothing else.
The requirements it does not mention out loud are git and Node 20 or newer. The paragraph installs them for you if they are missing, which is fine until you are watching an unexplained Homebrew run and wondering what you agreed to.
Where it stops
It is Codex-only. The skill installs to ~/.codex/skills/. There is no Claude Code version, no Cursor version, no Windsurf version. If you do not use Codex this is not for you today, and that is the honest reason this piece is shorter than most.
It does not make your plan bigger. It moves work onto quota that is usually idle. For most people that quota is genuinely spare and the saving is real. If you were already running your ChatGPT plan to its limit, you will now reach that limit sooner. This is a reallocation, not free capacity.
It is eleven days old. 3,272 stars, 337 forks, three tagged releases, last pushed five days before this was written — all read off the GitHub API rather than a badge. Projects that young change, including in ways that make articles about them wrong.
What to actually do
If you use Codex: run the readiness check, paste the paragraph, and try it on one real task before deciding anything. The comparison worth making is not "is this clever" but "did my agent get further today on the same budget."
If you do not use Codex: the transferable idea is the split itself. Planning and review are the expensive half of agent work, they are separable from execution, and you may already be paying for somewhere to put them.
---
*codex-with-chatgpt is MIT, by XiaoDuoYa. Everything above was read off the project's own README and the GitHub API on 2026-09-09. The readiness check in the kit is ours.*