Before you connect
1
A Nevermined account
Free, at nevermined.app. You never share an API key with Codex — the consent cap is the credential.
2
A funded wallet
A paid call draws on a spending cap you approve during connect — a commerce grant: a capped, revocable budget funded from your own wallet, not a key. Fund that wallet first with the asset the service settles in — see Fund your wallet. You approve the cap itself in Approve the spending cap.
Start on sandbox, where you use testnet funds and nothing costs real money, before you point Codex at live.
Add the Catalog to Codex
1
Add the server to your Codex config
Add an MCP server entry to Leave any client id / secret out — Codex identifies itself to Nevermined with its own client metadata document and runs the OAuth (PKCE) flow, so there is nothing to register and no key to paste.
~/.codex/config.toml (or a project-scoped .codex/config.toml) pointing at the environment you want. Codex reaches remote servers over Streamable HTTP:2
Sign in
Run
codex mcp login nevermined. Codex opens Nevermined’s consent page in your browser — see Approve the spending cap.Approve the spending cap
Codex opens Nevermined’s consent page when you runcodex mcp login. It is the one place a human is required.
1
Check who and where
The page shows the Sandbox / Live badge and who is asking. On live, the cap is real money.
2
Set the cap and validity
Set the spending cap (USDC or EURC) and how long the grant is valid for, then Grant access.
Make your first paid call
Ask for something only live data can answer, and name the connector so Codex reaches for it rather than answering from memory.1
Browse for free
Ask “list the Nevermined catalog categories” — a free tool call, no sign-in.
2
Ask it to buy
“Buy the service with slug
<slug> through the Nevermined connector and show me the response.” The paid call draws on the cap you approved and returns the merchant’s response.Disconnect
- Revoke the budget (Nevermined side). Open Connections and disconnect Codex. The credential stops working on its next call; discovery still works.
- Remove the connector (Codex side). Run
codex mcp logout neverminedfirst to clear the stored OAuth tokens, then remove the[mcp_servers.nevermined]block from yourconfig.toml(or runcodex mcp remove nevermined). To keep the entry but switch it off instead, setenabled = false.
Next
Using the Catalog from your web assistant
The concept and the other assistants.
Catalog MCP — full reference
Every click path, the consent details, and every refusal code.