Connect Codex to Amazon Redshift over MCP

Codex can reach Redshift two ways. AWS publishes a Redshift MCP server you run locally with your own AWS credentials. Contextflo connects once with a read-only database user and gives Codex a single URL. Pick based on whether it is just you or a team.

Option 1: AWS's Redshift MCP server in Codex

AWS publishes awslabs.redshift-mcp-server. You run it with uvx and your AWS profile and region. Add it to ~/.codex/config.toml:

[mcp_servers.redshift]
command = "uvx"
args = ["awslabs.redshift-mcp-server"]

[mcp_servers.redshift.env]
AWS_PROFILE = "<your profile>"
AWS_REGION = "<your region>"

It runs on per-person AWS credentials. There is no shared context and no audit trail of what was asked.

Option 2: Contextflo

Create a read-only user in Redshift:

CREATE USER contextflo_ro PASSWORD '<a strong generated password>';
GRANT USAGE ON SCHEMA analytics TO contextflo_ro;
GRANT SELECT ON ALL TABLES IN SCHEMA analytics TO contextflo_ro;
ALTER DEFAULT PRIVILEGES FOR USER dbt_user IN SCHEMA analytics GRANT SELECT ON TABLES TO contextflo_ro;

Default privileges apply per user that creates tables. Repeat the last line for each such user.

Optionally add a WLM query group with a timeout.

In Contextflo, go to Data Sources, then Add data source, and choose Redshift. Enter host, port, database, username and password. SSL and an SSH bastion are optional. Pick tables and invite your team.

In Codex:

[mcp_servers.contextflo]
url = "https://mcp.contextflo.com/mcp"

codex mcp login contextflo

Check with codex mcp list. Contextflo runs SELECT only.

Which one to use

Just you, with AWS access already set up: Option 1.

Your team asks too: Contextflo. Teammates do not need AWS credentials. You get generated table and column descriptions, shared definitions, per-person table access and an audit trail of prompts and the SQL that ran.

On Claude? See Claude with Redshift.

You do the modeling, we do the rest. Connect Redshift free.

FAQ

What credentials does the AWS Redshift MCP server use in Codex? Your own AWS credentials, passed as AWS_PROFILE and AWS_REGION in the server's env table in config.toml. Every person who runs it needs their own AWS access.

Why does the default privileges line name dbt_user? Default privileges apply per user that creates tables. Run ALTER DEFAULT PRIVILEGES FOR USER once for each user that creates tables in the schema, otherwise new tables are not readable by the read-only user.

Can I stop runaway Redshift queries from Codex? Optionally set up a WLM query group with a timeout for the Contextflo user. It caps how long any one query can run.

Does Contextflo support SSL or an SSH bastion for Redshift? Yes, both are optional connection settings. The required fields are host, port, database, username and password.