Turn a coding request into work you can open.

Black Label Operator is a hosted place to run Claude Code or Codex away from your own computer. You add one remote connector to the AI client you already use and describe a coding task. Operator runs that task once in a separate sandbox that belongs to your account, then returns the files it produced, a transcript of the run and a receipt with a SHA-256 digest for every file.

Operator calls one of those runs a mission. It isn’t a new model, a chat assistant, an editor or a remote desktop, and it never connects to your computer. In the service’s own words, the hosted product “has no bridge to the buyer’s filesystem.”

The connector

https://operator.blacklabelbots.com/mcp is a remote MCP server with OAuth sign-in. Claude, Codex and other MCP clients use it to start missions and read results.

The workspace

Each customer gets one separate workspace on Cloudflare’s container infrastructure. Every mission runs in its own new folder inside your sandbox.

Your subscription

Claude Code runs on your Claude subscription and Codex runs on your ChatGPT subscription. Operator doesn’t supply either one and doesn’t ask for API keys.

The evidence

A completed mission saves its files to artifact storage with a SHA-256 digest for each one, then writes a receipt.json that ties those files to the run.

“Remote” can mean several different things. The right choice depends on where your code lives and how closely you want to steer the agent.

Claude Code’s documentation covers Remote Control, which continues a local session from another device, along with programmatic runs and dev containers. OpenAI documents codex exec for running Codex from scripts and CI. If your task depends on a local checkout, a private repository or a session you can keep talking to, start with those, because the hosted Operator service doesn’t do any of the three.

Operator fits the last row: a task with a clear result that can run by itself in a sandbox you don’t have to build, patch or keep online.

Setup takes one connector and one provider login. There’s no server to run, no card and no activation code.

Before you start

• A Claude or ChatGPT subscription that’s eligible for Claude Code or Codex. Operator doesn’t supply one, and the provider’s terms and usage limits still apply.
• An AI client that can add a remote MCP server with OAuth. Claude does this through custom connectors and Codex through codex mcp add. If you don’t see the setting, check your client’s own documentation.
• For Claude Code missions, access to Claude Code once, so you can run claude setup-token.

1. Add the connector

   In Claude: open connector settings and add a custom connector with this address. The Add to Claude button on this page opens the same settings screen.

   https://operator.blacklabelbots.com/mcp

   In Codex: run these two commands.

   codex mcp add operator --url https://operator.blacklabelbots.com/mcp
   codex mcp login operator --scopes operator:read,operator:run,operator:billing

   

2. Approve the connection

   Your client sends you to Operator’s approval page. It names the client and lists what it can do: read status, start remote missions and manage your plan. Choose Connect and start free. Your first approval creates one customer account, one workspace and a trial of 25 questions. When the page says Authorization approved, continue back to your client. That authorization code expires after 10 minutes and works once.

   There’s no username or password. Operator recognizes you by a signed cookie in that browser, so approve Claude and Codex in the same browser to keep them on one account. A different browser, or cleared cookies, leads to the signed-out page shown above, and a new approval there creates a separate account.

3. Connect the provider you want to run

   Open your Operator account. Claude and Codex each have a panel and a separate authorization.

   Claude Code: run claude setup-token in Claude Code, paste the token into the CLAUDE_CODE_OAUTH_TOKEN field and choose Connect Claude. Treat that token like a password. It belongs in this field, never in a mission or a support email.

   Codex: choose Connect Codex. Operator starts OpenAI’s device login inside your remote workspace and shows a link and a code. Finish the login, then choose Check connection. The attempt expires after 15 minutes. You can run the same flow from your AI client with operator_connect_codex and operator_check_codex.

4. Confirm it’s ready

   Ask your client for your Operator status, which calls operator_status. Look for workspace_state set to ready and cli_authorized showing true for your provider. A working connector doesn’t by itself mean the provider is ready, so check this before you assign real work.

5. Start one small mission

   Ask your client to run a task through Operator. It calls operator_start with three inputs: objective (up to 12,000 characters), provider (claude or codex) and idempotency_key (a unique label for this request). The first-task prompt above is a good test because you can check its result yourself.

6. Review the result

   operator_get_run shows the status. operator_list_artifacts lists each file with its size and digest. operator_get_artifact returns a file’s metadata and an authorized download path. Read the transcript, compare the digests, run the tests, then decide whether to keep the work.

There’s no long-lived session to attach to. A mission is one non-interactive run of the CLI: claude -p for Claude Code and codex exec for Codex, with session history turned off. When it ends, it’s over. A follow-up is a new mission in a new folder, so it has to carry its own context. Don’t count on files from an earlier run still being in the sandbox.

If the CLI fails or runs out of time, the run is marked failed and its files aren’t saved. Size each mission well inside the limit. operator_start returns when the mission ends. While it runs, operator_get_run shows its status, but there’s no live log. The transcript arrives with the artifacts.

If your client drops the response, check Recent missions in your account and keep the same idempotency key rather than starting a duplicate. A key can’t be reused for a different objective or provider. That returns idempotency_conflict.

What’s in a receipt

Downloads are named operator-artifact-<id>, so use the path values in the receipt to put files back where they belong.

The hosted service has no approval step during a mission. This is the most important thing to understand before you start one.

Your control sits before and after the run:

• Connector approval. You decide which client connects, review its permissions on the approval page, and can revoke the connector in that client later.
• Provider authorization. Connect only the provider you’ll use. Remove authorization in your account deletes the stored login from Operator.
• Your client’s tool prompt. operator_start is marked destructive and open-world in its MCP annotations, so a client that honors those hints can ask you before calling it. That behavior belongs to your client.
• The brief. Scope, allowed changes and what to do when blocked all go in the objective.
• Your review. Returned files stay separate from your code until you apply them.

Tools and the permission each one needs

Your computer’s files stay put. What you type into a mission leaves, and so do the logins you choose to connect.

The Privacy notice says Operator doesn’t sell personal information or use customer code, objectives, credentials or artifacts for targeted advertising. Anthropic and OpenAI act under your own subscriptions, so their terms and data policies apply to what the CLI sends them.

Retention. Operator doesn’t publish a fixed deletion schedule. Authorization stays until you remove it, it expires or it’s revoked. Account, billing, mission, artifact and security records stay while they’re needed to provide the service, keep receipts, resolve disputes, prevent fraud or meet legal duties. Temporary sandbox state follows the run lifecycle.

Your controls. Remove either provider from your account at any time and revoke the connector in your AI client. To request access, correction, export, artifact deletion or account deletion, email info@blacklabelbots.com with “Operator privacy request”. Required transaction, security and accounting records may remain. Never email a setup token or auth cache.

What protects you

• Separation by account. Each customer has a separate workspace and sandbox. Runs, artifacts and credentials are looked up by the account asking, so another account’s ID returns not found.
• Encrypted logins. Provider authorizations are encrypted at rest and stored per provider. Only the selected provider’s login goes into your sandbox, and it’s redacted from the saved transcript and error text.
• OAuth with PKCE. The connector accepts only the authorization-code flow with S256 PKCE. Access tokens last 1 hour. Refresh tokens last 30 days and rotate on use. Operator stores those tokens as SHA-256 hashes.
• Private artifacts. An artifact request needs a bearer token with operator:read from the account that owns it.
• Evidence you can check. Each saved file has a SHA-256 digest, and the receipt ties the files to the run.

What the sandbox doesn’t do for you

• It doesn’t limit the network. A mission can reach external services. A line such as “Do not connect to external services” is an instruction to the agent, not a firewall rule.
• It doesn’t hide your provider login from the mission. The selected login is in the sandbox while the CLI runs with prompts off, so text the agent reads from an untrusted repository or web page could try to misuse it. Point missions only at sources you trust, and remove the authorization when you’re finished.
• It doesn’t make the output correct. Generated work and receipts are evidence of the recorded run, not a guarantee that the result is correct, secure, complete or fit for a particular use. Review and test before you deploy.
• It isn’t for regulated data. The public hosted service isn’t offered for regulated protected health information without separate compliance review and any required written agreement. Keep passwords, private keys, recovery codes, card data and unnecessary personal records out of objectives. This page makes no claim of a third-party security certification.

Hard limits

The sandbox image includes git, so a brief can name a public repository to clone. Private repositories aren’t a supported path, because credentials don’t belong in mission text.

Twelve monthly payments come to $119.88, so the yearly plan costs $40.88 less at list price.

What counts as usage

On the trial, a question is one mission accepted through operator_start. Checking status, listing artifacts and reading billing don’t use one, and neither does a sandbox startup failure before acceptance. After acceptance it counts, even if the mission then fails. When the trial is used up, operator_start returns payment_required.

On a paid plan the meter is execution time rather than questions, recorded when a mission completes. Once the included time is used, a new mission returns execution_limit_reached. Your Claude or ChatGPT subscription is separate, and its usage limits apply to every mission.

Paying and cancelling

Choose a plan from your account. The monthly or yearly button opens Stripe Checkout, and payment starts only when you choose. The plan activates after Operator receives and verifies Stripe’s webhook, and your workspace stays the same.

To cancel renewal, choose Manage billing in your account to open the Stripe Billing Portal. Cancellation takes effect according to the subscription period shown there. Refund requests go to info@blacklabelbots.com with your Stripe receipt reference and are reviewed case by case. Refunds and cancellation has the details.

The agent can’t ask you anything, so every decision it might need has to be in the objective. Start from this template.

Goal: one result you can check.
Input: a public repository URL and commit, or data pasted below.
Allowed changes: the files or folders this mission may touch.
Output: leave these files in the working folder. Use plain file names.
Checks: run this test command. Report each result, including anything you couldn’t run.
If blocked: don’t wait for an answer. Record the blocker in NOTES.md and finish with what works.
Cleanup: remove node_modules and build caches before you finish.
Do not: use credentials or publish anything.

• Goal and output. A completed run doesn’t mean the objective was met, so make the result something you can observe. Name the files you expect.
• Input. The objective is the only input. Name a public source and its revision, or paste the data. For public data, include the schema and the source date.
• Checks. Ask the mission to run its own tests and to report failures as well as passes. The transcript records what it did.
• If blocked. Tell it to record the blocker and finish. A mission that runs out of time saves nothing.
• Cleanup. Every regular file left in the folder comes back, and a path containing @ fails the mission, so a leftover node_modules folder can sink an otherwise good run.
• Secrets. Anything in the objective goes to the sandbox and to your provider. Keep credentials out.

Check what came back

# macOS
shasum -a 256 operator-artifact-<id>

# Linux
sha256sum operator-artifact-<id>

Compare the result with the sha256 value from operator_list_artifacts. A match shows you have the bytes Operator stored. It doesn’t show they work. Read the changes, run the tests and replay the behavior in your own environment. An execution receipt and a deployment are separate facts.

More detail: Write a bounded coding mission, Read an artifact receipt and Review a completed coding mission.

For anything else, email info@blacklabelbots.com with “Operator” as the product name, your run ID or Stripe receipt reference, and the error code. Never include a Claude setup token, Codex auth cache, repository secrets or private keys. See Support.