Codex

Connecting an assistant lets it check your sites, read your reports and help you fix what Lockpick found, using your own Lockpick account. It never runs a scanner itself. It asks Lockpick, which runs the same limited, read-only checks as the web app.

Connect Codex

Run these. The second one opens your browser to sign in.

codex mcp add lockpick --url https://mcp.lockpick.app/mcp
codex mcp login lockpick

Or add this to ~/.codex/config.toml, then run codex mcp login lockpick.

[mcp_servers.lockpick]
url = "https://mcp.lockpick.app/mcp"

Sign in from your terminal, the window where developers type commands. You approve it in your browser.

npx lockpicks login --host https://www.lockpick.app

Then add this to ~/.codex/config.toml.

[mcp_servers.lockpick]
command = "npx"
args = ["-y","lockpicks","mcp"]
env = { LOCKPICK_HOST = "https://www.lockpick.app" }

Try it

Once it's connected, ask something like this.

Use Lockpick to check my site and explain the most important fix in plain words.

Prompts that work well has more, and permissions explains what the assistant can and can't do.