Practical checks for common WebCodex deployment issues. Do not paste or share real tokens, env files, Authorization headers, or complete agent.toml files while debugging.
Server:
webcodex --versionprints a version.webcodex-cli server status --env-file /etc/webcodex/webcodex.envreports the local server reachable.curl http://127.0.0.1:8080/openapi.jsonreturns OpenAPI JSON on the server host.- Public HTTPS is reachable through nginx or your chosen reverse proxy, if used.
Client:
webcodex-agent --versionprints a version.webcodex-cli agent status --profile workstationcan read the local agent config.webcodex-cli doctor --strict --profile workstation --server-url https://your-domain.examplepasses.listAgents/runtime_statusshows the agent online.
Use --overwrite only when you intentionally want to replace the existing unit:
sudo webcodex-cli server install-service \
--env-file /etc/webcodex/webcodex.env \
--bin /usr/local/bin/webcodex \
--overwrite
sudo systemctl daemon-reloadThen restart or start the service according to your normal deployment process.
Check the local service first, then the reverse proxy:
systemctl status webcodex
journalctl -u webcodex
curl http://127.0.0.1:8080/openapi.jsonIf local HTTP works but public HTTPS does not, check the nginx upstream host/port and TLS configuration. WebCodex CLI does not automate reverse proxy setup.
Install or symlink the CLI onto the client's PATH, for example:
sudo ln -s /opt/webcodex/bin/webcodex-cli /usr/local/bin/webcodex-cliUse the actual install path for your host.
webcodex-cli pairing create is server/admin-side and uses the server bootstrap env file. A friend/client machine should run webcodex-cli client enroll with the short-lived wc_pair_* code from the server owner.
Copy only the wc_pair_* code between machines. Do not copy WEBCODEX_TOKEN, user API tokens, agent tokens, env files, or complete agent.toml files.
That can be acceptable on agent-only client machines. Agent-only clients need webcodex-agent and webcodex-cli; the server binary webcodex is only required on server hosts.
Check the agent service and its connection details:
systemctl status webcodex-agent
journalctl -u webcodex-agentAlso verify the server URL, local token files, and agent allowed_roots. Missing or empty allowed_roots defaults to $HOME; explicit allowed_roots replaces that default.
Full listRuntimeTools includes expanded schemas and metadata. For GPT Actions,
prefer callRuntimeTool with tool="tool_manifest" for daily discovery. For a
focused schema/debug view, call listRuntimeTools with summary_only=true plus
category, features, or limit.
Re-import the OpenAPI schema from the deployed /openapi.json, then check the
operation count. The current recommended count is 25 and the GPT Actions limit
is 30. If the count exceeds 30, do not deploy the schema as-is; artifact upload
tools should remain runtime-only behind callRuntimeTool, not promoted to new
dedicated Actions.
Reconnect or restart the MCP client so it runs a fresh initialize and
tools/list. If the server was just upgraded, verify public HTTPS reaches the
new service and check journalctl -u webcodex for startup or auth errors.
Run runtime_status or listAgents, then check the agent host:
systemctl status webcodex-agent
journalctl -u webcodex-agentConfirm the agent server URL, token file, service user, and allowed_roots.
GPT Actions and MCP should use a managed wc_pat_* token or a
deployment-allowed shared key. wc_agent_* is only for webcodex-agent.
WEBCODEX_TOKEN is bootstrap/admin-oriented and should not be copied into GPT
Actions, MCP, or agent config.
git_status requires a git repository for a clean deployment smoke result.
Initialize the disposable smoke project with git and an initial commit, or point
the smoke at another safe agent-backed git project.
The GPT Actions surface must stay at or below 30 operations. Keep runtime-only
tools, including chunked artifact upload tools, behind callRuntimeTool unless
there is an explicit product decision and operation budget for a dedicated
Action.
artifact_upload_chunk, artifact_upload_finish, and artifact_upload_abort
must repeat the exact path used by artifact_upload_begin. This binds the
opaque upload_id to the requested target artifact path.
Use a safe project-relative artifact path and a MIME type that matches the file
extension. For smoke tests, prefer a simple .txt path with text/plain. Avoid
secret-like paths, absolute paths, .env*, .git, token/credential paths, and
unsafe binary extensions.