Inspiration
Developer tools are deeply personal, but changing how they feel is usually a scavenger hunt across settings, copied snippets, and disconnected galleries. DexThemes already made Codex themes easier to browse and preview. Build Week made the next step possible: make theme discovery and creation conversational, visual, and community-powered directly inside Codex.
What it does
DexThemes for Codex lets someone describe a mood, team, game, event, or personality and receive an original dark/light theme with a name, validation, and visual preview. A user-selected name is always preserved. If the user does not choose one, DexThemes suggests a name and makes it explicit that the name still needs confirmation before publication.
Users can:
create a personalized theme by speaking naturally, such as “Create a theme inspired by Argentina football at night and name it Argentina Afterglow” search official Codex, DexThemes, and community catalogs compare dark and light previews and prepare the exact Codex import handoff view daily, weekly, monthly, and historical leaderboards plus personal all-period ranks and repeat-win history inspect account achievements and unlocked themes publish an exact, reviewed community submission under their verified GitHub identity prepare a sanitized GitHub Issue from the conversation, review the exact title/body, and continue to GitHub without the plugin silently posting anything
The plugin adds five achievement rewards: Plugged In for first authenticated plugin use, Voiceprint for creating and publishing through it, Human Spark for the “OpenAI is nothing without its people” achievement, Golden Hour for Theme of the Day, and Headliner for Theme of the Week. The OpenAI achievement requires a signed, verified exact @openai.com claim and stores only the eligibility result, never the employee email address.
How it was built
OpenAI Apps SDK with an interactive MCP app resource for theme cards, dark/light previews, leaderboards, publication review, and GitHub feedback review a Codex plugin bundle with a focused DexThemes skill twelve MCP tools with strict input/output schemas and safety annotations Convex for accounts, themes, achievements, rankings, moderation, and rate limits Vercel for the public gallery and MCP endpoint OAuth 2.1 resource-server flow with GitHub as the upstream sign-in identity vanilla JavaScript, Zod, JOSE, esbuild, and Node contract tests
Codex was used to inspect the existing architecture, research current plugin and Apps SDK contracts, scaffold the app-plus-skill bundle, implement the MCP/UI/backend integration, harden identity and achievement boundaries, generate review artifacts, and run security/preflight checks. GPT-5.6 provides the creative reasoning that translates open-ended personal inspiration into an intentional palette and coordinates the complete create, name, validate, preview, apply, and publish flow.
Security and trust
Public discovery and creation stay frictionless; account data and publication require GitHub sign-in. DexThemes derives identity only from the verified OAuth token and never accepts a user or author ID from tool arguments.
Publication is split into two steps. The model-visible tool validates and renders the exact public payload. A short-lived confirmation token, bound to that payload and the OAuth session, is delivered only to the app in model-hidden metadata. Only after the user presses the app’s Publish button can the app-only write tool create public state.
OAuth state is browser-bound and protected by PKCE. Access tokens require expiry. Identity and network quotas are enforced independently. Theme IDs and palettes are validated at storage, preview, and apply boundaries. Achievements are earned from server-observed actions, leaderboard rewards count qualified non-author adoptions, GitHub feedback is redacted before review, and supporter-wall visibility is opt-in.
Challenges
The hardest product challenge was preserving a genuinely fast happy path while making every public or account-level action trustworthy. Users can discover, draft, name, preview, validate, and prepare an apply handoff with no account. Authentication appears only when personal stats, unlocks, or publication actually need an identity.
The hardest technical challenge was keeping an agent from becoming an accidental write authority. Separating the model-visible review from the model-hidden, user-pressed publication control gives the experience a clear trust boundary without sacrificing the conversational flow.
Accomplishments
voice-friendly, custom-named theme creation with live dark/light previews a short path from inspiration to a valid Codex import payload one plugin spanning discovery, creation, community publishing, stats, unlocks, and feedback daily, weekly, monthly, and historical creator ranks plus repeat-win history GitHub feedback with automatic secret, path, and email redaction five positive and three negative app-review cases 89 passing automated tests and zero known npm audit vulnerabilities in local preflight an open-source foundation that lets the community inspect, improve, and contribute to the experience
Judge path
The source, public MIT repository, production MCP endpoint, privacy, terms, support pages, and anonymous plugin flow are live and judge-testable. Public discovery, drafting, preview, validation, apply handoff, leaderboards, and GitHub Issue preparation require no account. GitHub sign-in is configured for authenticated personal stats, unlocks, achievements, and confirmed publication; the core discovery, creation, preview, validation, apply, leaderboard, and feedback workflows remain judge-testable without an account.
Public gallery: https://www.dexthemes.com/
Source: https://github.com/daeshawnballard/dexthemes
What's next
Richer comparisons, theme remix lineage, creator profiles, community collections and follows, additional accessibility checks, and a first-class Codex apply API if the host exposes one.
Built With
- codex
- convex
- esbuild
- gpt-5.6
- javascript
- jose
- model-context-protocol
- openai-apps-sdk
- vercel
- zod