# Cultup Codex MCP Setup

Goal: use the static Cultup Codex installer to exchange a one-time Cultup setup code for a local scoped token, configure Codex MCP, verify tools, then draft one test scheduling link only.

## Agent Contract

You must:
1. Prefer the static installer script from the setup message.
2. Never expose the exchanged `cu_...` token in chat, commands, approval prompts, repo files, or logs.
3. Store the token only in user-level local files or environment variables.
4. Configure Codex MCP with `bearer_token_env_var = "CULTUP_AGENT_TOKEN"`.
5. Download, checksum-verify, and inspect the installer before asking to run it.
6. Verify with `codex mcp get cultup`.
7. Verify with the read-only `verify_cultup_connection` MCP tool.
8. Confirm tool discovery includes `verify_cultup_connection`, `draft_meeting_link`, `send_meeting_invite`, and `create_calendar_event`.
9. Draft only after verification succeeds.
10. Never call `send_meeting_invite`, `send_group_meeting_vote_invites`, or `create_calendar_event` unless the user explicitly approves sending or creating and the token has that permission.

## Inputs

The user message should include:
- `setupCode`: one-time code beginning with `cu_setup_`
- `mcpUrl`: usually `https://api.cultup.com/mcp`
- `setupScriptUrl`: static installer URL, usually `https://api.cultup.com/downloads/cultup-codex-setup.sh`
- `installerSha256`: expected SHA-256 of the installer
- permission tier: default is `Draft Links`

The installer exchanges the setup code, writes the scoped token to `~/.cultup/codex-token.json`, writes `~/.cultup/codex-env.sh`, configures Codex MCP with `bearer_token_env_var = "CULTUP_AGENT_TOKEN"`, and verifies `codex mcp get cultup`.

Ask for approval before running it because it may modify `~/.cultup`, supported shell startup files, and `~/.codex/config.toml`.

```bash
curl -fsSLo /tmp/cultup-codex-setup.sh "https://api.cultup.com/downloads/cultup-codex-setup.sh"
printf '%s  /tmp/cultup-codex-setup.sh\n' "INSTALLER_SHA256_REPLACE_ME" | sha256sum -c -
sed -n '1,220p' /tmp/cultup-codex-setup.sh
bash /tmp/cultup-codex-setup.sh --setup-code cu_setup_REPLACE_ME --mcp-url https://api.cultup.com/mcp
```

## Manual Fallback

If you cannot run the verified installer, exchange setup code without printing the real token:

```bash
mkdir -p ~/.cultup
chmod 700 ~/.cultup
curl -fsS https://api.cultup.com/api/agent/setup/exchange \
  -H "Content-Type: application/json" \
  --data '{"setupCode":"cu_setup_REPLACE_ME","agent":"codex"}' \
  > ~/.cultup/codex-token.json
chmod 600 ~/.cultup/codex-token.json
```

Set token from the local file, then configure `~/.codex/config.toml`:

```bash
export CULTUP_AGENT_TOKEN="$(node -e 'process.stdout.write(JSON.parse(require("fs").readFileSync(process.env.HOME + "/.cultup/codex-token.json", "utf8")).token)')"
codex mcp add cultup --url https://api.cultup.com/mcp --bearer-token-env-var CULTUP_AGENT_TOKEN
```

## Verification

First run:

```bash
codex mcp get cultup
```

Confirm:
- `enabled: true`
- `url: https://api.cultup.com/mcp`
- `bearer_token_env_var: CULTUP_AGENT_TOKEN`

Then verify through Codex MCP with `verify_cultup_connection`. This tool is read-only and must not create drafts, send email, create calendar events, reserve quota, search contacts, or call calendar provider APIs.

The default Codex setup token has `Draft Links` permission. It can verify and draft scheduling links. Sending email or creating calendar invites requires the user to upgrade the token permissions in Cultup settings.

Avoid raw `curl` verification unless Codex MCP tool execution is unavailable or cancelled. If MCP HTTP fallback is necessary, use `$CULTUP_AGENT_TOKEN`; do not put the raw token in the command, approval prompt, chat, repo files, or logs.

In fallback mode, first call `tools/list` or `verify_cultup_connection`. Only call `draft_meeting_link` after verification succeeds.

Expected tools:
- `verify_cultup_connection`
- `draft_meeting_link`
- `update_meeting_draft`
- `send_meeting_invite`
- `create_calendar_event`
- `draft_group_meeting_vote`
- `send_group_meeting_vote_invites`

## Test Task

After verification, use Cultup to draft a scheduling link only with:

- guestName: `Example Guest`
- guestEmail: `example.guest@example.com`
- title: `Cultup setup test`
- duration: `30`
- dates: tomorrow

Report the scheduling link and match ID. Do not send email. Do not create a calendar event.