Skip to main content
This page covers where org-level control over Pleo MCP access lives for Codex, which has no admin console of its own. Codex CLI reads its MCP server configuration from a file on each developer’s own machine (~/.codex/config.toml), so there’s no “add a custom connector” step for an admin to complete here. Instead, control over custom connectors sits in one of the following places, depending on how your organisation runs Codex:
  • Using Codex through a ChatGPT Business, Enterprise, or Edu workspace: your workspace admin controls custom connectors centrally. See How to Add Pleo MCP as a Custom Connector in ChatGPT.
  • Using Codex CLI directly on developer machines: administrators can restrict which MCP servers Codex enables with an mcp_servers approved list in managed requirements.toml. If you use one, add the Pleo MCP to it. Codex enables a server only when both its name and its URL match an entry, so use the name developers configure (pleo-mcp in How to Install the Pleo MCP in Codex):
    Codex’s connection to the Pleo MCP is made by Codex itself, so if your organisation also restricts outbound connections at the firewall or proxy, allow mcp.pleo.io there.
Once your organisation’s network and Pleo-side access allow it, individual developers can connect Codex to Pleo themselves. See How to Install the Pleo MCP in Codex.

​
Allow Network Access for Receipt Uploads

When the agent attaches a receipt file, Pleo issues a short-lived upload URL on mcp.pleo.io and the agent uploads the file to it with an HTTP PUT from a command it runs. In the ChatGPT desktop app, Codex CLI, and the IDE extension, those commands run in a sandbox with no network access by default. Codex’s connection to the Pleo MCP itself isn’t affected. For how this works across AI clients, see Allow Network Access for Receipt Uploads. With the default on-request approval policy, Codex asks for approval before running a command that needs network access. To allow network access without the prompt, add this to ~/.codex/config.toml:
This opens outbound access for all sandboxed commands. To allow only mcp.pleo.io, also turn on Codex’s network proxy, which OpenAI marks as experimental, and give it a domain rule:
Administrators can enforce a managed domain allowlist with [experimental_network] in requirements.toml, which is also experimental. If you use one, add mcp.pleo.io to it:
With managed_allowed_domains_only = true, a developer’s own domain rule is ignored, so the managed entry is required. A managed allowlist doesn’t grant network access by itself: developers still need network_access = true. See OpenAI’s documentation: Agent approvals & security, Sandbox, and Managed configuration

​
What Comes Next?