# Codex

The Synthient plugin for Codex: the [MCP server](https://docs.synthient.com/ai/mcp) for data, and six skills for the judgment the tools cannot carry.

It carries the same six skills as the [Claude Code plugin](https://docs.synthient.com/ai/claude) and bundles the same MCP server. The two differ only where the hosts do: Codex names skills `synthient-<name>` and invokes them with `$`, and it relies on the CLI's own credential chain rather than prompting for a key.

> **Note**: The plugin is open source at [github.com/synthient/plugins](https://github.com/synthient/plugins). It needs the CLI on your `PATH`, since the MCP server ships inside it: `brew install synthient/tap/synthient`.

## Install

Add the repository as a marketplace, then install the plugin:

```bash
codex plugin marketplace add synthient/plugins
codex plugin add synthient@synthient
```

Installing **Synthient** from the `/plugins` browser in Codex does the same thing. Either way, start a new session afterwards: bundled skills and MCP servers are picked up at session start.

## Credentials

Codex forwards `SYNTHIENT_API_KEY` to the server through `env_vars`, but the OS keychain is the reliable path. An MCP server's working directory is wherever Codex launched it, so a `.env` lookup may not land where you expect:

```bash
synthient auth
```

Get a key from the dashboard at [synthient.com](https://synthient.com), then run `$synthient-doctor` to confirm the CLI, the credentials, the granted scopes, the remaining credits, and the MCP tools are all in place.

## Skills

| Skill                  | Purpose                                                                                           |
| ---------------------- | ------------------------------------------------------------------------------------------------- |
| `$synthient`           | API reference: auth, response shape, field vocabularies, credits, rate limits, errors             |
| `$synthient-integrate` | Wire Synthient into the current codebase, with fail-open handling and the benign-automation guard |
| `$synthient-migrate`   | Move off Spur, IPQualityScore, or another vendor: audit, map, report, rewrite, verify             |
| `$synthient-triage`    | Investigate an address, a list, or a domain and return a reasoned verdict                         |
| `$synthient-feeds`     | Parquet snapshots, filtered stream capture, CSV export, local analysis                            |
| `$synthient-doctor`    | Diagnose credentials, scopes, credits, and MCP connectivity                                       |

Codex also loads a skill on its own when a task matches its description; naming one is for when you want it specifically.

## Migrating from another vendor

```txt
$synthient-migrate spur
```

Also takes `ipqs`, or any other vendor name. It audits every call site, maps the fields, and shows the report before changing anything.

The report leads with semantic changes rather than renamed fields, because those are what break quietly: a ported `fraud_score` threshold that shifts who gets blocked, a `client.count` that now counts distinct device signatures rather than concurrent clients, an operator-name string comparison that stops matching and so returns clean for everything.

See [Migrating from Spur](https://docs.synthient.com/migration/spur) and [Migrating from IPQualityScore](https://docs.synthient.com/migration/ipqs) for the mappings it works from.