Codex proposes every Git operation over MCP and nothing runs until you approve it in FluxGit. You see the operation-specific impact, risk and recovery context first; guarded recovery names what it restores instead of promising to undo anything.
Three steps. Every command below comes straight from the README of the open-source MCP server, so what you paste is what actually ships.
Download the desktop app from the download page, which lists the platforms that have a build. This is where the approval cards appear. If you only want the free read-only shell without the app, one command puts fluxgit-mcp-sidecar on your PATH:
cargo install fluxgit-mcp-sidecar --lockedCodex is not on FluxGit's one-click detected list, so I will not pretend it is. If your Codex setup speaks the Model Context Protocol, it connects like any MCP-compatible host: add the generic block below to your host's MCP config. It is the same block the mirror README documents, so what you paste is what actually ships:
{
"mcpServers": {
"fluxgit": {
"command": "/absolute/path/to/fluxgit-mcp-sidecar",
"env": {
"FLUXGIT_MCP_HANDSHAKE_ADDR": "127.0.0.1:59647",
"FLUXGIT_MCP_AUDIT_LOG": "/optional/path/to/audit.jsonl"
}
}
}
}Tell Codex to "commit what you changed". Codex calls repo.brief to orient itself, then sends operation.preview.commit with its reason and the exact files it wants to stage. A card appears in FluxGit; you read it and click Approve or Reject. That is the whole loop.
No more discovering a reset after it already happened. Every Git write Codex wants arrives as a proposal card with a plain-language reason plus operation-specific impact, risk and recovery information; restore points appear where that operation actually creates one.
For a completed plan, the guarded action saves current state and restores branch HEAD plus tracked files to the pre-plan commit. It does not reconstruct the old index, working tree or untracked files; step snapshots and Safety Timeline keep those recovery paths separate.
repo.brief returns branch, status, recent history and worktree context in one typed response, reducing the number of separate orientation commands Codex needs before it starts the actual task.
Free mode works with verified public repositories, without remote control. Buy FluxGit Full: A perpetual desktop license for one person, on up to 3 of your computers: macOS, Windows or Linux. Includes 12 months of remote control and updates. After the included year, automatic renewal is 9.99 USD per year. Cancel future renewals in Paddle. The MCP shell itself is open source under Apache-2.0.
No. FluxGit uses the open Model Context Protocol through a local stdio sidecar. Compatible hosts that can launch that server use the same JSON shape, although permissions and config locations differ. Claude Code and Cursor are one-click detected hosts today; Codex uses the generic config above.
No direct Git mutation endpoint exists in FluxGit MCP. Twelve operation tools submit proposals, and FluxGit runs one only after your approval in the desktop app. A separate shell granted by the host remains outside this boundary.
That is the point. The card explains what the operation does in plain terms, flags the risk, and shows the recovery context available for that operation before you approve. You learn Git by reviewing real decisions instead of memorizing commands.
Read what a Git MCP server is and how to choose one, then use the generic setup guide or inspect the full contract on the MCP feature page. A real Codex terminal session has also been operated from a phone in the FluxGit Mobile private preview; the agent still runs on the paired desktop and Git proposal approval stays there. Also available: Claude Code setup and Cursor setup.