Runs on your machineNo API key field. No hosted provider request. No raw output retained.Read the boundary
by Flow7
Sign inCreate account

Codex provider doctor · v0.1.1

Find the break before Codex does.

Build a local diagnostic for any OpenAI Responses-compatible custom provider. The safe pass checks the endpoint without a key or prompt. Paid protocol probes stay off until you opt in and confirm in your terminal.

Build local commandsDownload doctor.py
executionyour Python process
safe defaultno key · no prompt
paid boundarytyped terminal confirmation
resultsredacted · never uploaded

Local command builder

Name the endpoint. Keep the key off this page.

The endpoint, model, and generated commands remain in this browser tab. This form has no credential field.

Use the API version root. HTTPS is required except explicit localhost testing.
The doctor compares this with the provider’s self-reported response.model.
Enter the variable name only. Set its value in your terminal.
Nothing has been sent. Build a local command when the endpoint and model are known.
Run fromthe folder containing doctor.py
Download
1 · safe defaultURL, DNS, TLS, unauthenticated model list
Build the command on the left.

No key is read. No request reaches /responses. Use --offline when even an endpoint connection is out of scope.

2 · optional paid probesJSON, SSE, tools, structured output
Paid mode remains off.

The script prints the target, four-request count, and 96-token output cap per request, then requires RUN PAID CHECKS. It never retries.

Protocol record: 2026-08-11 · Python 3.9+ · standard library only · SHA-256 fdfce265d78be9a8c97f9f2e34f28e09763b8f4bc693aefff0db6f5878fe42de

What it checks

One boundary at a time.

A green HTTP response is not enough for Codex. The doctor separates connection failures from the Responses protocol behaviors an agent loop depends on.

Safe · no credential

Endpoint reachability

Validates URL policy, resolves DNS, verifies the TLS certificate and hostname, then calls /models without authorization. A 401 or 403 is a warning: it establishes only that the requested host/path returned a response, not API authentication, model access, or compatibility.

Paid · request 1

Responses object

Requires a completed object = "response", checks a fixed-output probe without printing it, and records the provider’s self-reported model identifier.

Paid · request 2

SSE completion

Requires text/event-stream, ordered sequence numbers, response.created, a text delta, and a terminal response.completed. A closed stream without completion fails.

Paid · requests 3–4

Tools and structured output

Forces one inert strict function call and one strict JSON Schema response. It validates arguments and call_id, but never executes the tool or returns tool output.

Installable Agent Skill

Put the same safety boundary in Codex.

The provider-neutral skill bundles this exact standard-library doctor. It runs the credential-free pass first and never answers the paid confirmation for the user.

DO_NOT_TRACK=1 npx -y skills@1.5.22 add https://infer.flow7.org --skill codex-provider-doctor -g -a codex

Archive v0.1.1 · Open Agent Skills CLI 1.5.22 checked 2026-08-11 · digest published in Infer’s discovery index and SHA256SUMS. Version 0.1.0 is retired. Read the tested operating boundary in Route Note 002.

Privacy and spend boundary

The page does not become a proxy.

The downloaded file connects from your machine straight to the URL you supply. Environment proxies and redirects are disabled so an Authorization header is not forwarded elsewhere.

DefaultThe API-key environment variable is not read; no prompt or model request is sent.
CredentialPaid mode reads the named local environment variable only after typed confirmation. The key is never accepted as a URL or command-line argument.
OutputRaw model output, error bodies, headers, addresses, and request identifiers are neither printed nor written.
TelemetryThis page may record an aggregate download event with page and campaign attribution. It never includes the endpoint, model, command, key, prompt, or diagnostic result.
ProviderYour chosen provider controls pricing and retention. store=false is requested, not independently verified.

Failure diagnosis

The first broken contract gets a name.

DNS / TLS

Host resolution, certificate, hostname, or direct connection failed before HTTP.

3xx

Redirect refused. Fix the base URL; Authorization was not forwarded.

401 / 403

Without a key, only a host/path response is established. Authentication, authorization, model access, and compatibility remain unresolved.

404

The base path may not end at the API version root, or the requested model is absent.

400 / 422

The provider rejected a Responses, tool, or structured-output field used by the probe.

429 / 5xx

Rate, quota, credit, capacity, provider, or upstream failure. The doctor does not retry.

SSE incomplete

The connection closed without a completed response.completed event.

model mismatch

The provider self-reported a different identifier. That may be alias resolution or route drift.

Exact limitation record

A probe is not an attestation.

Version 0.1.1 targets the OpenAI Responses surface documented on 2026-08-11. It has not been certified against every provider or every Codex release.

Identityresponse.model is provider self-report. It cannot prove weights, snapshot, upstream vendor, or route origin.
CodexThe four probes do not cover a full Codex run, multi-turn continuation, tool result submission, image input, MCP, cancellation, retries, or long streams.
EconomicsThe doctor cannot guarantee price, credits, retention, rate limits, or latency. Paid requests may incur input, output, and fixed request charges.
Next testAfter the doctor passes, run one bounded real Codex workload and inspect the provider’s own usage and receipt record.
Protocol referencesOfficial OpenAI documentation checked 2026-08-11.
Responses API reference ↗Streaming events ↗Codex config reference ↗

Diagnose first. Route second.

When a provider passes the local protocol checks, compare its request economics against Infer’s current route sheet.

Build a route sheetCreate account