codex-router-mcp
Provides guardrailed delegation to OpenAI Codex, including quota checks, isolated git worktrees, checkpoints, read-only reviews, and accurate failure reporting.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codex-router-mcpCheck codex limits, then delegate a refactor in a worktree and review the diff."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
codex-router-mcp
An MCP server that puts guardrails around delegating work to OpenAI Codex.
Codex already ships its own MCP server (codex mcp-server), and it exposes two
tools: codex and codex-reply. If all you want is "run a Codex session from
another agent", use that — it is first-party and costs you nothing to maintain.
This project exists for what happens around the delegation:
Quota is checked before a thread is started, normalized by window duration, and an exhausted account returns a structured handoff instead of a failure.
Risky work runs in a dedicated git worktree, so a bad turn cannot touch your working tree.
Every turn is bracketed by checkpoints, so you can roll one back.
Reviews run read-only, in both directions, optionally with a second model.
Failed writes are reported as failed, never as changes.
Claude Code ──MCP──▶ codex-router-mcp ──JSON-RPC──▶ codex app-serverOne persistent codex app-server child process serves every thread, so the
second delegation does not pay the startup cost again. Concurrent delegations
each get their own thread and never cross results.
Requirements
Node 20+
The
codexCLI onPATH, logged in (codex login) or configured with an API key
Related MCP server: Hydra
Install
claude mcp add codex-router -s user -- npx -y codex-router-mcpOr from a clone:
npm install && npm run build
claude mcp add codex-router -s user -- node "/absolute/path/to/dist/index.js"-s user makes it available in every project. A relative path only resolves
from the directory the client was started in, so use an absolute one.
Give the model a policy
Installing the tools gives the model the ability to delegate. It still needs a policy for when. Put something like this in your global agent instructions — without it the model sees ten tools and no guidance:
You are the tech lead. Codex is an external subagent; you decide what to delegate.
Delegate work that is self-contained, mechanical and narrowly scoped — migrations, refactors that follow a pattern, filling in tests, boilerplate. Do it yourself when it needs architectural judgement, context from the conversation, or is small enough that delegating costs more than it saves.
Check
codex_get_limitsbefore anything large. Pick the model and reasoning effort fromcodex_get_modelsto match the difficulty; never guess ids.Use
isolation: "worktree"for large, risky or experimental work, or when there is uncommitted work that must not be lost.
status: "running"means Codex is still working. Pollcodex_task_status; never delegate the same task twice.Always review what Codex produced — changed files, diff, then the code — and check it stayed inside
scope. Send corrections throughcodex_continue.On
quota_exhausted, readremainingWorkand finish the task yourself. Never wait for a quota reset and never retry in a loop.If
failedFileChangesis present, those files were not written. Do not review them.
CLAUDE.md is the full version this repository runs on (in Polish).
Tools
Tool | Purpose |
| Available models and the reasoning efforts each supports, read live. |
| Quota windows normalized by duration, with a delegation verdict. |
| Run a task in a fresh Codex thread. |
| Follow-up instruction on an existing thread, context intact. |
| Status, changed files, commands, plan, diff, worktree, checkpoints. |
| Stop the in-flight turn; the thread survives. |
| Read-only review of your work or of a Codex task. |
| List working-tree snapshots taken around turns. |
| Roll the working tree back. |
| Commit or remove a task's isolated worktree. |
Quota
Limits are normalized by window duration, not by slot name:
| label |
60 |
|
300 |
|
1440 |
|
10080 |
|
43200 |
|
other | derived ( |
primary is not assumed to be the 5h window — the API is free to put the
weekly window there. Per window you get usedPercent, remainingPercent,
resetsAt (ISO + epoch), resetsInMinutes and rateLimitReached, plus
tightest (the window that actually gates the next turn) and a verdict:
ok, low (delegate, with a warning attached) or exhausted.
The handoff
When quota runs out — at preflight or mid-turn — you get this instead of a failure:
{
"status": "quota_exhausted",
"taskId": "codex-20260829173437-001",
"originalTask": "...",
"threadId": "01a04e96-7474-79a1-a173-8c3cc2919eeb",
"changedFiles": ["src/a.ts (update)"],
"summary": "Codex ran out of quota mid-task. ...",
"remainingWork": "Unfinished plan steps reported by Codex: ...",
"limits": { "windows": [ ... ] },
"nextStep": "Do NOT wait for the quota to reset ... finish it yourself."
}The router never retries and never waits for a reset. Partial work is reported so the calling agent can continue from where Codex stopped.
A non-quota failure returns status: "failed" instead — the two are kept
distinct so a compile error is not mistaken for a billing problem.
Isolation: git worktrees
isolation: "worktree" creates a linked worktree on a dedicated branch
(agent-router/<taskId> unless you pass branch) and points Codex at it. Your
working tree is never touched, whatever the turn does.
Worktrees are created under ~/.agent-router/worktrees/ — outside the
repository, so they never appear in git status. If workingDirectory was a
subdirectory of the repo, Codex is placed in the matching subdirectory.
For an isolated task, changedFiles and diff are computed against the commit
the branch started from, so they show the cumulative result across every turn.
Integration is deliberately manual:
codex_worktree({ taskId, action: "commit" }) # work lands on the task branch
git merge agent-router/<taskId> # you run this, not the router
codex_worktree({ taskId, action: "remove" }) # clean upThe router never writes to your branch.
Checkpoints
Inside a git repository, the working tree is snapshotted before and after every
turn, capturing tracked and untracked files while respecting .gitignore.
The snapshot is built through a throwaway GIT_INDEX_FILE, so it never disturbs
what you have staged. git stash create is the obvious primitive but it silently
omits untracked files — exactly what a delegated agent tends to produce.
codex_checkpoints(taskId)
codex_restore({ taskId, checkpointId: "cp-1" })codex_restore rewrites file contents with git restore --worktree, leaving the
index alone. Files created after the checkpoint are reported as
leftoverFiles and only deleted when removeUntracked: true is passed. Every
restore first captures the current state and returns it as safetyCheckpoint,
so a restore is itself undoable.
Checkpoints are dangling commits, not refs. They survive normal use and git's
default garbage collection, but an explicit git gc --prune=now discards them.
Review
codex_review uses Codex's native review/start with inline delivery and a
read-only sandbox — the reviewer cannot edit what it reviews.
Pass
workingDirectoryto have Codex review your uncommitted work.Pass
taskId(optionally with a differentmodel) to have Codex review a previous Codex task. The reviewer is given the original task and itsscope, so it also flags work that went out of bounds.
target selects what to review: uncommittedChanges (default), baseBranch,
commit, or custom.
Honest failure reporting
Codex can finish a turn cleanly while every write it attempted was rejected — a
misconfigured sandbox does exactly that. In that case changedFiles stays empty,
the rejected patches are listed under failedFileChanges, and a warning tells
the caller not to review files that were never written.
Known issue: the Codex sandbox on Windows
AGENT_ROUTER_SANDBOX defaults to workspace-write. On Windows that sandbox
needs a helper binary, codex-windows-sandbox-setup.exe, that some Codex
installations do not ship. When it is missing every write is silently rejected.
Reproduce it without this server:
codex sandbox cmd /c "echo hi > test.txt"A healthy install writes the file; a broken one prints
orchestrator_helper_launch_failed: ... program not found. Note that
windowsSandbox/readiness still reports ready, so it does not catch this.
Repair the Codex installation if you can. AGENT_ROUTER_SANDBOX=danger-full-access
works around it but removes the sandbox entirely — pair it with
isolation: "worktree" at minimum.
Configuration
All optional, set as environment variables on the MCP server entry.
Variable | Default | Purpose |
|
| Executable to spawn. |
|
| Args; a JSON array is accepted for paths with spaces. |
|
| Sandbox for delegations (reviews are always read-only). |
|
| Codex runs headless; nobody can answer prompts. |
|
| Accept an approval request that arrives anyway. |
|
| Default isolation: |
|
| Where linked worktrees are created. |
| on | Set to |
| on | Set to |
|
| Remaining percent that triggers the |
|
| Remaining percent that blocks delegation. |
|
| Blocking window before returning |
|
| Ceiling on |
|
| Task metadata file. |
|
| Mirror app-server stderr and protocol traffic to stderr. |
A task that outlives waitSeconds returns status: "running" with a taskId to
poll, so an MCP call never blocks forever.
Tests
npm test143 assertions. The real MCP server is booted over stdio but pointed at
test/fake-app-server.mjs instead of codex app-server, so the whole router —
JSON-RPC client, notification wiring, quota policy, task store, git plumbing — is
exercised without a Codex account and without spending quota. Git cases run
against throwaway repositories. This is what CI runs on Linux, macOS and Windows.
npm run smokeRead-only check against the real codex app-server: prints the live model
catalogue and current limits. Starts no turn, so it spends no quota.
Stability and terms
This server talks to codex app-server, which the Codex CLI marks
[experimental]. Its protocol has no public documentation or stability
guarantee; the type definitions in src/protocol.ts mirror only the subset used
here and were derived from codex app-server generate-ts. A Codex release can
change it. Regenerate and re-check if something breaks:
codex app-server generate-ts --out ./generated-tsOn terms: this server does not fork Codex, does not touch authentication, and
does not reimplement any OpenAI client. It spawns the official codex binary
you installed and logged into yourself. OpenAI has stated that the Codex CLI is
Apache-2.0 and that forking is permitted, but has
not clarified whether
third-party tools driving a ChatGPT-plan session are covered by the Terms of
Use, and their docs recommend API keys for automation. If you are automating
heavily, or building anything commercial on this, use an API key and take your
own legal advice.
License
MIT — see LICENSE.
Available Tools
10 toolscodex_checkpointsList task checkpointsA
List the working-tree snapshots taken around a task's turns. Each checkpoint captures tracked and untracked files without touching the user's index, and can be restored with codex_restore. Requires the working directory to be inside a git repository.
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes | Task whose checkpoints should be listed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. It adds useful transparency by stating that checkpoints capture tracked and untracked files "without touching the user's index" and that restoration happens via codex_restore. It does not detail edge cases like empty git repos or corrupted checkpoints, but for a listing tool this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with no wasted words. It front-loads the core action, then adds important behavioral details and the prerequisite. Every sentence contributes necessary information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter listing tool, the description is complete enough: it states what is listed, what checkpoints capture, that the operation does not touch the index, how to restore, and the git requirement. The absence of an output schema is acceptable because the listing semantics are clear from the description and tool name.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the single required parameter taskId is already documented in the schema as "Task whose checkpoints should be listed." The description adds contextual framing around "a task's turns" but no additional parameter-level semantics, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: "List the working-tree snapshots taken around a task's turns." It clearly distinguishes itself from the sibling codex_restore by noting that checkpoints "can be restored with codex_restore," making the tool's listing-only role unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool: to list checkpoints for a task, and it points to codex_restore as the restoration alternative. It also gives a prerequisite (must be inside a git repository). It stops short of explicitly stating when not to use it versus alternatives, so it is not a perfect 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_continueContinue a Codex taskA
Send a follow-up instruction into an existing Codex thread, keeping all of its prior context. Use it to iterate on review feedback instead of re-delegating from scratch.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Optionally switch model for this turn onward. | |
| taskId | Yes | taskId returned by a previous codex_delegate. | |
| instruction | Yes | The follow-up instruction for Codex. | |
| waitSeconds | No | How long to block before returning a pollable taskId. | |
| reasoningEffort | No | Optionally switch reasoning effort for this turn onward. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It does disclose that this is a mutating follow-up that preserves prior thread context, but it doesn't disclose the asynchronous execution model, that a pollable taskId is returned, or how invalid/expired threads are handled. Useful but incomplete behavioral coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste: purpose and identifying trait are front-loaded, and the usage guidance follows immediately. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete enough to invoke correctly: required params, purpose, and the continue-vs-delegate choice are clear, and the waitSeconds schema hint covers the pollable-taskId return flow. However, with no output schema and no annotations, the description could do more to state how results are obtained (e.g., polling via codex_task_status).
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters (taskId, instruction, model, waitSeconds, reasoningEffort) with meaning. The description only reinforces that instruction is a follow-up and taskId refers to an existing thread — baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action ('Send a follow-up instruction into an existing Codex thread') and the defining trait (keeping all prior context). It differentiates from the sibling codex_delegate by explicitly rejecting re-delegating from scratch, so an agent can tell them apart without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when-to-use ('Use it to iterate on review feedback') and names the alternative behavior to avoid ('instead of re-delegating from scratch'), which maps to codex_delegate. The selection condition is concrete and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_delegateDelegate a task to CodexA
Hand a self-contained coding task to Codex as a subagent. Starts a fresh Codex thread, runs the task, and returns the result plus the files it changed. Checks quota first: if Codex has no quota left it returns status 'quota_exhausted' with a handoff so you can finish the work yourself instead of waiting for a reset.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | The full task instruction for Codex. Be specific and self-contained. | |
| model | No | Codex model id from codex_get_models. Omit for the account default. | |
| scope | No | Scope boundary: what Codex may and may not touch. | |
| branch | No | Branch name for the worktree. Default: "agent-router/<taskId>". | |
| isolation | No | "worktree" runs Codex in a dedicated git worktree on its own branch, so a bad turn cannot touch the user's working tree. "none" edits in place. Default: none. | |
| waitSeconds | No | How long to block before returning a pollable taskId (default 240s, max 1800s). | |
| reasoningEffort | No | Reasoning effort supported by the chosen model (see codex_get_models). | |
| workingDirectory | Yes | Absolute path Codex should treat as its working directory. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden, and it delivers: it discloses that the tool checks quota before running, starts a fresh thread, returns changed files, and returns status 'quota_exhausted' with a handoff on failure. These are behavioral traits an agent cannot infer from the schema alone. It stops short of describing error behavior beyond quota or cost/long-running implications, but the disclosed traits are substantive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with zero fluff: the core purpose is front-loaded first, followed by execution behavior, then the key edge case. Every sentence earns its place — the quota-exhausted sentence describes a real decision-relevant scenario for the agent rather than filler. Appropriately sized for an 8-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description explains the essential return behavior (result plus changed files) and the most likely failure mode (quota exhaustion with handoff). The pollable taskId return is only hinted at through the waitSeconds parameter description, and the full return shape beyond 'result plus files' is underspecified. Given the moderate complexity — spawning a subagent that edits files — this is slightly better than adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 8 parameters, establishing the baseline of 3. The description adds no parameter-level meaning beyond what the schema provides — it mentions output (files changed) and quota, but neither maps to a specific parameter. This is adequate because the schema carries the parameter documentation burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb-resource pair ('Hand a self-contained coding task to Codex as a subagent') and describes a concrete outcome: runs the task and returns the result plus changed files. 'Starts a fresh Codex thread' distinguishes this from codex_continue, and the quota-first behavior distinguishes it from codex_get_limits. An agent can tell what this tool does and roughly how it differs from nearby siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The qualifier 'self-contained coding task' implies when this tool is appropriate, and the quota_exhausted handoff describes a fallback action. However, the description never explicitly names alternatives or exclusion conditions (e.g., 'use codex_continue for ongoing conversations, codex_review for reviewing changes'), which is a real gap given nine closely related siblings. Usage context is present but only implied, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_get_limitsRead Codex rate limitsA
Read Codex usage limits, normalized by window duration (300 min -> '5h', 10080 min -> 'weekly'), with usedPercent, remainingPercent, resetsAt and rateLimitReached per window, plus a delegation verdict. Check this before delegating anything large.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses normalization behavior with concrete examples (300 min -> '5h', 10080 min -> 'weekly'), lists the returned fields, and mentions a delegation verdict. While it doesn't detail error behavior or auth requirements, it is transparent enough for a read-only limits check.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences with no filler. The first sentence front-loads the operation and return details; the second gives actionable guidance. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless read tool with no output schema, the description is complete: it explains normalization, names the returned fields, signals read-only intent, and provides usage context. An agent has enough information to invoke and interpret the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema coverage is 100%, so there is no parameter information the description needs to add. The baseline for 0-parameter tools is 4, and the description appropriately focuses on output and usage rather than parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and resource ('Codex usage limits'), and details what the tool returns: normalized windows, percentages, reset times, and a delegation verdict. It also distinguishes itself from siblings like codex_delegate by framing this as a pre-flight check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool: 'Check this before delegating anything large.' This gives clear usage context relative to the delegation workflow, though it does not explicitly name alternatives or provide when-not-to-use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_get_modelsList Codex modelsA
List the Codex models available to this account, with the reasoning-effort levels each one supports. Read live from the Codex model catalogue — never hardcoded. Use it before codex_delegate when you want to match model strength to task difficulty.
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No | Bypass the 60s catalogue cache and re-read from Codex. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It adds useful context by saying it reads live from the Codex model catalogue and is never hardcoded, but it does not mention the 60-second cache behavior, and 'read live' slightly overstates freshness for a tool whose refresh parameter implies cached results by default.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: the main action, the data-source caveat, and the usage routing. It is front-loaded with the core purpose and contains no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list utility with one optional parameter already fully documented in the schema, the description covers purpose, account scope, output content (models plus reasoning-effort levels), and when to use it. The output expectation is clear even without an output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%; the refresh parameter is already documented as bypassing the 60s catalogue cache and re-reading from Codex. The description adds no parameter-level meaning, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a clear resource ('Codex models available to this account'), and a key included detail ('reasoning-effort levels each one supports'). This clearly distinguishes it from sibling tools like codex_get_limits or codex_delegate without needing to inspect their schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent when to call it: before codex_delegate, when matching model strength to task difficulty. This gives concrete, decision-relevant routing to a sibling tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_interruptInterrupt a Codex taskA
Stop the turn Codex is currently running for a task. The thread survives, so codex_continue can pick it back up.
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes | Task whose in-flight turn should be stopped. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds important non-obvious context: the thread survives interruption and can be resumed via codex_continue. It does not cover edge cases like interrupting when no turn is running, but the core behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The primary action is front-loaded, and the key consequence (thread survives, resumable) is delivered in the second sentence efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with no output schema, the description covers the essential facts: what is interrupted and what happens afterward. It does not explain behavior when there is no in-flight turn, but given the tool's simplicity and the sibling context, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the parameter taskId is already clearly described as 'Task whose in-flight turn should be stopped.' The tool description adds no new parameter detail, which is acceptable since the schema fully documents the only parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Stop') and resource ('the turn Codex is currently running for a task'), which clearly identifies the tool's action. It also distinguishes itself from related siblings like codex_continue by noting the thread survives, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly provides usage context by stating that codex_continue can pick the thread back up, which signals this tool is for pausing rather than terminating a task. It does not explicitly list exclusions or compare with siblings like codex_task_status, but the context is clear enough for most agents.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_restoreRestore a checkpointA
Roll the working tree back to a checkpoint — use it when Codex made things worse. This overwrites files on disk, so confirm with the user before calling it unless they already asked for the rollback. The pre-restore state is always captured as a new checkpoint first, so the operation is itself undoable.
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes | Task the checkpoint belongs to. | |
| checkpointId | Yes | Checkpoint id from codex_checkpoints, e.g. "cp-1". | |
| removeUntracked | No | Also delete files created after the checkpoint. Default false — they are reported as leftovers instead. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states that files on disk are overwritten (destructive), requires user confirmation, and reveals that the pre-restore state is captured as a new checkpoint, making the operation undoable. This is thorough and directly useful for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with zero waste: purpose/trigger first, then the destructive warning and consent requirement, then the undo guarantee. Every sentence earns its place and the most critical safety information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation tool with no annotations and no output schema, the description covers the essential context: what it does, when to use it, side effects, user-consent requirements, and undoability. Schema handles parameter details. Nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already explains taskId, checkpointId, and removeUntracked. The description reinforces the checkpoint concept but adds no parameter-specific syntax or format detail beyond the schema. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('roll the working tree back to a checkpoint') and a clear trigger ('use it when Codex made things worse'). This distinguishes it from siblings like codex_checkpoints, which lists checkpoints, and codex_review, which reviews work. The verb and resource are unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit when-to-use signal ('when Codex made things worse') and a pre-call requirement: confirm with the user unless they already asked for the rollback. It doesn't explicitly name alternatives or state when not to use it, but the context is clear enough for an agent to route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_reviewHave Codex review codeA
Ask Codex to review changes and report findings. Use it on YOUR OWN work for a second opinion before you ship, or on a Codex task's output with a different model. Codex reviews read-only and changes nothing. Returns a review task you can poll or extend with codex_continue.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Codex model to review with (see codex_get_models). | |
| branch | No | Base branch, for target "baseBranch". | |
| commit | No | Commit sha, for target "commit". | |
| target | No | What to review. Default: uncommittedChanges. | |
| taskId | No | Review the work of this Codex task, in its own directory or worktree. Combine with a different model for a cross-model second opinion. | |
| waitSeconds | No | How long to block before returning a pollable taskId. | |
| instructions | No | What to focus on. Required for target "custom"; otherwise added as extra guidance for the reviewer. | |
| reasoningEffort | No | Reasoning effort for the review. | |
| workingDirectory | No | Absolute path to review in. Required unless taskId is given. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing side effects, and it does so clearly: 'Codex reviews read-only and changes nothing.' It also discloses the return behavior—a review task that can be polled or extended—which is important since there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three tight sentences with no filler. The core action is front-loaded, the primary use cases follow immediately, and the safety guarantee and return contract are packed into short, scannable statements.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description covers the essential operational context: read-only behavior, return format as a pollable task, and how to chain with codex_continue. It could slightly expand on what 'report findings' means or how results are retrieved, but the schema and sibling names make the overall workflow reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and all nine parameters have meaningful descriptions in the schema itself. The tool description adds context around parameters like taskId and model ('on a Codex task's output with a different model'), but the schema already does the heavy lifting for individual parameter meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Ask Codex to review changes and report findings.' It clearly positions the tool as a review action, distinct from the sibling tools that manage checkpoints, worktrees, or delegate tasks, and it explicitly notes the returned artifact is a pollable review task.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives concrete when-to-use guidance: use on your own work before shipping, or on a Codex task's output with a different model for a cross-model second opinion. It also tells the agent how to continue after the call by polling or extending with codex_continue, though it does not explicitly say when not to use this tool or name alternative review workflows.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_task_statusCheck a Codex taskA
Read the current state of a delegated task: status, model, reasoning effort, changed files, commands run, plan, diff, worktree, checkpoints, and timestamps. Poll this when codex_delegate returned status 'running'. Omit taskId to list all known tasks.
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | No | Task to inspect. Omit to list every task this router knows about. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It clearly states this is a read operation, lists the fields the caller will see, and clarifies the list-all behavior when taskId is omitted. For a read-only status tool, this is sufficient even without detailed side-effect or rate-limit notes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The first sentence front-loads the operation and the full set of returned state fields; the second provides the polling trigger and the list-all variant. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter, no output schema, and no annotations, the description provides all essential context: what is inspected, what fields will be returned, when to poll, and how to list all tasks. Nothing an agent needs to correctly call this tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already explains that taskId is the task to inspect and that omitting it lists all known tasks. The description repeats this omission behavior without adding new syntactic or format details, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Read' and clearly identifies the resource: the current state of a delegated Codex task. It enumerates exactly what state is returned (status, model, reasoning effort, changed files, commands run, plan, diff, worktree, checkpoints, timestamps), which distinguishes it from sibling tools like codex_delegate or codex_interrupt.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit trigger condition: 'Poll this when codex_delegate returned status running.' It also explains the omit-taskId behavior for listing all tasks. It does not explicitly enumerate alternatives or state when not to use this tool, but the usage context is clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_worktreeManage a task's worktreeA
Commit or remove the isolated git worktree of a task delegated with isolation "worktree". "commit" records the work on the task branch and reports the merge command; the router never merges into the user branch itself. "remove" tears the worktree down and refuses to discard uncommitted work unless forced.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | For "remove": discard uncommitted changes in the worktree. | |
| action | Yes | "commit" the work onto the task branch, or "remove" the worktree. | |
| taskId | Yes | Task whose worktree to act on. | |
| message | No | Commit message. Defaults to the task description. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden and does well: it explains that 'commit' records work and reports a merge command without merging into the user branch, and that 'remove' tears down the worktree and refuses to discard uncommitted work unless forced. It leaves out post-commit worktree state and error conditions, but the critical side effects and safety behavior are transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler: the first states the overall purpose, the second explains commit semantics, the third explains remove semantics including the forced flag. Each sentence earns its place and the key scoping constraint is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description provides the essential operational context for a two-action tool: target resource, per-action behavior, and safety defaults. It does not describe the full return value shape or error handling, and there is no output schema to supplement, but the available information is sufficient for selection and basic invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning beyond the schema by explaining what 'commit' produces (a merge command) and that 'force' overrides a refusal to discard uncommitted work. This helps the agent reason about when to use the optional force and message params, though the message param is only documented in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names two specific actions (commit, remove) applied to a specific resource (the task's isolated git worktree), and scopes it to tasks delegated with isolation "worktree". This clearly distinguishes it from sibling tools like codex_restore or codex_checkpoints, which handle different task lifecycle concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states the tool applies only to tasks delegated with isolation "worktree", giving a concrete condition for use. It does not explicitly name alternatives or list when-not-to-use scenarios, but the isolation qualifier provides enough guidance for an agent to select it correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.1.0- First observed
codex_checkpoints - First observed
codex_continue - First observed
codex_delegate - First observed
codex_get_limits - First observed
codex_get_models - First observed
codex_interrupt - First observed
codex_restore - First observed
codex_review - First observed
codex_task_status - First observed
codex_worktree
TDQS
Scored across 10 tools
Each tool targets a clearly distinct action or resource: delegation, continuation, status polling, interrupting, reviewing, checkpoint listing/restoring, worktree management, and preflight checks for models/limits. Even the closely related checkpoint and worktree tools are differentiated by their git semantics and descriptions.
All tools share the codex_ prefix, but the action pattern is mixed: codex_delegate, codex_restore, codex_continue, codex_interrupt, and codex_review are bare verbs, codex_get_models and codex_get_limits use get_, while codex_checkpoints, codex_worktree, and codex_task_status are bare nouns. The naming is readable but not predictable enough for an agent to guess tool names confidently.
Ten tools is well-scoped for a Codex routing and task-lifecycle server. Each tool covers a necessary phase—preflight checks, delegation, follow-up, status, interruption, review, checkpoint rollback, and worktree handling—without redundant entries.
The tool surface covers the full delegation lifecycle: checking models and limits before starting, delegating, continuing, polling status, interrupting, reviewing, and rolling back via checkpoints or worktrees. No obvious dead ends or critical missing operations stand out for the router's stated purpose.
Maintenance
Related MCP Connectors
Guardian agent for AI coding: four frontier models review risky diffs and commits before they ship.
Adaptive plan/build/review cycles for AI coding assistants, persisted across sessions.
Deterministic AI code review, with an audit record. Governance inside the agent loop.
Governance layer for AI coding agents: knowledge-graph grounding, session audit, policy controls.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceEnables safe, isolated Codex implementation runs with planning approval, verification, and bounded fixes, without merging or pushing code automatically.-
- AlicenseNot gradedqualityBmaintenanceEnables Codex to delegate bounded engineering jobs to Claude Code CLI in isolated Git worktrees with strict security and allowance pacing.MIT
- AlicenseAqualityBmaintenanceEnables Codex to delegate routine repository exploration, implementation, refactors, tests, and fixes to DeepSeek Harness in isolated Git worktrees, returning compact results and patches for review while keeping the main workspace protected.529 npmMIT
- AlicenseNot gradedqualityAmaintenanceEnables bounded, multi-phase coding workflows inside Codex that plan, implement, independently review, repair, and verify repository changes, with an inline dashboard for inspecting runs.MIT