workbench

🧰 — See what Codex is really doing. > Put Codex's Skills, Hooks, Memory, and MCP into a readable window. [](https://github.com/fslot2601-source/workbench/releases/latest) [](https://github.com/fslot2601-source/workbench/releases/latest) [](https://github.com/fslot2601-source/workbench/actions/workflows/ci.yml) [](LICENSE) <img src="SkillLens/Resources/Assets.xcassets/AppIcon.appiconset/icon_1024.png" alt="Workbench app icon" width="160" /> Workbench is a native macOS app for viewing and managing your local Codex capabilities and status. It tells you if a Skill is implicit, explicit, or hidden, when Hooks are triggered, which tools MCP actually exposes, what Memory remembers, and how much space it occupies on your local storage. All information comes from your local Codex, current configuration, and actual runtime results. No independent accounts, no telemetry, and no need to submit your configuration to another cloud service. ## Why - **See the real status.** Configured, enabled, and connected are different stages. Workbench shows them separately. - **Know what they do.** Skills, Hooks, MCP, and Memory come with descriptions, sources, and scopes, so you don't have to dig through configurations. - **Act when needed.** Frequently used switches can be adjusted directly; for cases that shouldn't be handled by the interface, like Memory, it's left to you and Codex to decide. - **Less guessing.** Workbench doesn't fill in missing data from Codex with assumed numbers. If verification is not possible, the interface will show "Unconfirmed" or "Not verified." ## Install ### Requirements - macOS 14 or later - Local Codex installed and logged in ### GitHub Releases Download: [Latest Workbench release](https://github.com/fslot2601-source/workbench/releases/latest) Open the DMG, drag Workbench into "Applications." ### First run The current release is an unsigned community version. On the first launch: 1. Find Workbench in Finder. 2. Right-click and select "Open." 3. If macOS still blocks it, go to "System Settings → Privacy & Security" and select "Open Anyway." ## What it shows - **Skills** — Purpose, source, dependencies, errors, and implicit, explicit, or hidden invocation states. - **Hooks** — Trigger timing, processor, execution order, trust status, and current connection observed execution records. - **MCP** — Configuration switches, startup and connection phases, tools, resources, and resource templates. - **Memory** — What Codex remembers, source, update time, related projects, and current scope. - **Usage** — Codex returned quotas, reset time, token summary, and daily trends. - **Storage** — Codex Home category occupancy, and graded cleaning of cache, temporary files, logs, and archived sessions. - **Backup** — Backup desensitized configurations via local GitHub CLI and read backup records from private repositories. - **Menu bar** — Quickly view usage, storage, and self-check status without opening the main window. - **Self-check** — Check if Codex, workspace, Skills, Hooks, MCP, Memory, storage, and backup are normal. ## What the status means Workbench does not equate "configuration enabled" with "actually running in a task." MCP only shows tools and resources after they have actually returned capabilities. Hook execution records only come from the Codex App Server connected by Workbench, not representing the global history of other Codex clients. The Memory page is for reading and interpreting, not directly modifying Codex-generated Memory files. ## Privacy - No telemetry, ads, or independent account system. - Does not read or save Codex login tokens. - GitHub authentication is handled by GitHub CLI and macOS Keychain; Workbench does not touch GitHub tokens. - Memory is read-only by default; content entering the interface is restricted and desensitized; raw and Chronicle do not enter the main memory list. - MCP parameters, environment variables, query strings, and tool schema are not displayed in the interface. - Storage cleaning is limited to a fixed whitelist under the current Codex Home. Cache can be rebuilt, temporary files and logs are moved to the trash, and archive sessions require separate confirmation. - Cache cleaning is not secure erase and should not be used to destroy sensitive data. Workbench requires launching local Codex and accessing the user-selected workspace, so the current build does not enable App Sandbox. Release builds have Hardened Runtime enabled but are not Developer ID signed or Apple-notarized. ## Build from source Requires Xcode 16, Swift 6, and XcodeGen. ```bash xcodegen generate xcodebuild -project SkillLens.xcodeproj -scheme SkillLens -configuration Debug -destination 'platform=macOS' build ``` You can also open `SkillLens.xcodeproj` directly with Xcode. The app does not bundle Codex; on the first launch, it will search for `codex` from common locations and `PATH`, or you can manually select it in settings. Run tests: ```bash xcodebuild -project SkillLens.xcodeproj -scheme SkillLens -configuration Debug \ -destination 'platform=macOS' -only-testing:SkillLensTests test ``` ## Build a release ```bash ./scripts/build-release.sh ``` The script generates ZIP, DMG, and SHA-256 checksum files for universal architectures and checks if the app version, architecture, and content in the two installers match. Without Developer ID, the output is clearly marked as an unsigned community build. See [Release Checklist](docs/RELEASE_CHECKLIST.md) for the complete process. ## Docs - [Execution Plan and Compatibility Strategy](docs/EXECUTION_PLAN.md) - [Release Checklist](docs/RELEASE_CHECKLIST.md) - [Changelog](CHANGELOG.md) - [Contributing](CONTRIBUTING.md) - [Security Notes](SECURITY.md) ## License MIT. Workbench is an independent open-source project with no affiliation or official authorization from OpenAI.