OpenMyCodex is a rebuild of codex-router as a single native application. The
original runs a Node CLI and a LiteLLM Python proxy behind a Tauri shell. This
version replaces all of it with one .app bundle, built in pure Swift and
SwiftUI, with no Node.js, no Python, and no install scripts. macOS only.
Codex can point at a different OpenAI-compatible endpoint. OpenMyCodex runs that endpoint locally, translates Codex's Responses API calls into the format each provider expects, and merges the extra models into the Codex model picker.
- Desktop app to add providers, paste API keys, and switch models on or off.
- Menu bar companion that shares the same state as the window.
- 25 providers and 47 models from the original registry. API-key providers store secrets in the macOS keychain; OAuth providers (Kimi Code, Grok) reuse the official CLI session and need no key.
- macOS 26 or later (the app uses Liquid Glass).
- Swift 6.2 toolchain (Xcode 26 or later) to build.
- Codex installed, so the app can read its native model catalog.
Download OpenMyCodex.dmg, open it, and drag OpenMyCodex.app to
Applications.
The app is not code-signed (no Apple Developer license). On first launch macOS Gatekeeper will refuse to open it. This is expected and safe — the binary is built from this repository's source. To allow it:
- Right-click the app and choose Open, then confirm, or
- Open System Settings → Privacy & Security, scroll to the banner about OpenMyCodex, and click Open Anyway.
You only do this once; later launches open normally.
./build-app.sh release
open build/OpenMyCodex.appThe bundle is self-contained. There is nothing else to install.
- Pick a provider in the sidebar.
- Paste its API key. The key goes straight to your keychain.
- Turn the provider on.
- Press Connect.
- Restart Codex so it reloads the model list.
Press Disconnect to put Codex back exactly as it was.
The app edits only three root keys in ~/.codex/config.toml:
openai_base_url, model_catalog_json, and model.
Before the first edit it snapshots the previous value of each key, and keeps a verbatim copy of the whole file next to it. Disconnecting restores those values and deletes any key that was absent before. Comments, tables, blank lines, and every other setting are left untouched.
This is verified against a real 293-line config: after a full connect and disconnect cycle the file's SHA-256 is unchanged.
If another router already owns the config, the app reports it instead of silently taking over, and restores that router's settings on disconnect.
- The server binds
127.0.0.1only, on the loopback interface. - Every routed request must carry a 128-bit capability token in its URL path. Without it the router returns 404, so no other local process can drive it.
- Requests carrying an
Originheader are refused, so a web page cannot reach the router even if it guesses the port. - Each request is sent upstream with only that provider's own credential. The
Codex-supplied
Authorization,chatgpt-account-id, andopenai-organizationheaders are dropped rather than forwarded. This is covered by a test that inspects what the upstream actually received. - A model whose provider is switched off is refused with a 403. It never falls through to Codex's native backend.
- State files are written atomically with
0600permissions.
Sources/RouterCore/ Registry, translation, streaming, server, install
Sources/OpenMyCodexApp/ SwiftUI window, menu bar extra, settings
Tests/RouterCoreTests/ 142 tests
swift test151 tests across 22 suites. They cover the Responses translation, SSE framing, catalog merging against the real Codex binary, config editing, credential isolation, OAuth session detection, and a full request round trip over a real socket to a mock provider.
Tests that need Codex installed, or a real config, skip themselves when those are absent.
MIT. See LICENSE.