diff --git a/.codex/config.toml b/.codex/config.toml
new file mode 100644
index 00000000..e45e0889
--- /dev/null
+++ b/.codex/config.toml
@@ -0,0 +1,8 @@
+# Project-local Codex MCP config. Codex CLI loads this only when the
+# repository is marked trusted in the user's global Codex config.
+#
+# TODO: replace this manual file with APM-managed `.codex/config.toml`
+# once microsoft/apm#803 lands.
+[mcp_servers.chrome-devtools]
+command = "nix"
+args = ["develop", ".#e2e", "--command", "just", "ai::mcp-chrome-devtools"]
diff --git a/.gitattributes b/.gitattributes
index 49945b26..948960db 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -5,4 +5,5 @@ CLAUDE.md linguist-generated
 .claude/launch.json -linguist-generated
 .agents/** linguist-generated
 .codex/** linguist-generated
+.codex/config.toml -linguist-generated
 .opencode/** linguist-generated
diff --git a/agents/ai.just b/agents/ai.just
index 7cb3128d..5bd40419 100644
--- a/agents/ai.just
+++ b/agents/ai.just
@@ -86,7 +86,12 @@ apm-sync: apm-audit
         echo "ERROR: .claude/ out of sync with sources — run: just ai::apm" >&2
         exit 1
     fi
-    if ! diff -r .codex "$scratch/.codex"; then
+    # `.codex/config.toml` is currently a checked-in manual fallback for
+    # project-local Codex MCP until microsoft/apm#803 lands; current APM
+    # does not emit it in the scratch tree yet.
+    if ! diff -r \
+        -x config.toml \
+        .codex "$scratch/.codex"; then
         echo "ERROR: .codex/ out of sync with sources — run: just ai::apm" >&2
         exit 1
     fi
@@ -94,10 +99,22 @@ apm-sync: apm-audit
         echo "ERROR: .agents/ out of sync with sources — run: just ai::apm" >&2
         exit 1
     fi
-    if ! diff -r .opencode "$scratch/.opencode"; then
+    if ! diff -r \
+        -x .gitignore \
+        -x node_modules \
+        -x package-lock.json \
+        -x package.json \
+        .opencode "$scratch/.opencode"; then
         echo "ERROR: .opencode/ out of sync with sources — run: just ai::apm" >&2
         exit 1
     fi
+    if [[ -e opencode.json || -e "$scratch/opencode.json" ]]; then
+        if [[ ! -e opencode.json || ! -e "$scratch/opencode.json" ]] || \
+           ! diff <(jq -S . opencode.json) <(jq -S . "$scratch/opencode.json"); then
+            echo "ERROR: opencode.json out of sync with sources — run: just ai::apm" >&2
+            exit 1
+        fi
+    fi
     if ! diff AGENTS.md "$scratch/AGENTS.md"; then
         echo "ERROR: AGENTS.md out of sync with sources — run: just ai::apm" >&2
         exit 1
@@ -109,18 +126,25 @@ agent *args: apm
     just prepare
     {{ env('AI_AGENT', 'claude --dangerously-skip-permissions') }} {{ args }}
 
-# Launch chrome-devtools-mcp server over stdio — wired up via the root
-# `.mcp.json`, which shells out via `nix develop --command just
-# ai::mcp-chrome-devtools` (Claude Code starts outside the nix devshell).
+# Launch chrome-devtools-mcp server over stdio.
+#
+# Today the checked-in project-local MCP entrypoints are:
+# - Claude Code: `.mcp.json`
+# - Codex CLI: `.codex/config.toml` (only for trusted projects)
+#
+# The top-level `apm.yml` mirrors the same server for runtimes APM can
+# configure natively today. Codex project-scoped MCP is tracked upstream
+# in microsoft/apm#803; once that lands, `.codex/config.toml` should
+# become APM-managed like the other generated runtime config.
+#
+# All paths shell out via `nix develop .#e2e --command just
+# ai::mcp-chrome-devtools` so agent runtimes that start outside the nix
+# devshell still get Playwright's Chrome-for-Testing.
 # Chrome binary resolved from Playwright's nix-provided Chrome-for-Testing
 # across platforms: `chrome-linux64/chrome` on Linux and
 # `chrome-mac-*/Google Chrome for Testing.app/.../Google Chrome for Testing`
 # on macOS. `find` picks either layout; a miss fails loud downstream
 # (empty --executable-path → MCP server errors out visibly).
-#
-# TODO: fold .mcp.json's entry into `dependencies.mcp` above once
-# microsoft/apm#655 (Claude Code MCP adapter) merges and lands in juspay's
-# fork — `.mcp.json` then becomes a generated artifact of `just ai::apm`.
 mcp-chrome-devtools:
     bash -c 'shopt -s nullglob; \
       for c in "$PLAYWRIGHT_BROWSERS_PATH"/chromium-*/chrome-linux64/chrome \
diff --git a/apm.lock.yaml b/apm.lock.yaml
index c4180d29..51d5dbf9 100644
--- a/apm.lock.yaml
+++ b/apm.lock.yaml
@@ -1,5 +1,5 @@
 lockfile_version: '1'
-generated_at: '2026-04-22T18:22:05.656399+00:00'
+generated_at: '2026-04-22T19:34:51.132897+00:00'
 apm_version: 0.9.1
 dependencies:
 - repo_url: _local/agents
@@ -134,3 +134,17 @@ dependencies:
     .opencode/agents/hickey.md: sha256:edde9b0d3b27b947b7372f662b2e8652d136e0bb9af7924892b00450a1e586bc
     .opencode/agents/lowy.md: sha256:a1c8e5ba115439bcfa0d7e331f96e71b2d690ff2e5fb9b824bb5f588eb43ac75
   content_hash: sha256:f309878ce79ee166620ef89812d093707f07b79cbebaa74725dc6f32f3cac8d3
+mcp_servers:
+- chrome-devtools
+mcp_configs:
+  chrome-devtools:
+    name: chrome-devtools
+    transport: stdio
+    args:
+    - develop
+    - .#e2e
+    - --command
+    - just
+    - ai::mcp-chrome-devtools
+    registry: false
+    command: nix
diff --git a/apm.yml b/apm.yml
index ac01bd5b..8d1c8e7d 100644
--- a/apm.yml
+++ b/apm.yml
@@ -13,3 +13,14 @@ dependencies:
     - juspay/skills/skills/nix-justfile
     - juspay/skills/skills/nix-typescript
     - anthropics/skills/skills/frontend-design
+  mcp:
+    - name: chrome-devtools
+      registry: false
+      transport: stdio
+      command: nix
+      args:
+        - develop
+        - .#e2e
+        - --command
+        - just
+        - ai::mcp-chrome-devtools
diff --git a/opencode.json b/opencode.json
new file mode 100644
index 00000000..0fdc0c36
--- /dev/null
+++ b/opencode.json
@@ -0,0 +1,16 @@
+{
+  "mcp": {
+    "chrome-devtools": {
+      "type": "local",
+      "enabled": true,
+      "command": [
+        "nix",
+        "develop",
+        ".#e2e",
+        "--command",
+        "just",
+        "ai::mcp-chrome-devtools"
+      ]
+    }
+  }
+}