Codex Antigravity MCP Server
Bridges OpenAI Codex CLI via its app-server, allowing agents to start and resume Codex sessions, send prompts, poll task progress, approve or decline runtime requests, cancel tasks, and list or inspect historical sessions.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Codex Antigravity MCP ServerStart a Codex session to refactor the database module in my project"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Codex Antigravity MCP Server
"GPT不说人话、不背责任不粘锅而感觉每次对话都像在打卡上班?"
"Gemini满是活人感、但智商不太够导致完全不能用?"当然是选择让Gemini去拷打gpt了!
轻量级本地MCP服务, 将OpenAI Codex CLI(codex app-server --listen stdio://)桥接封装为Antigravity、Claude Desktop、Cursor等各类 Agent 宿主可直接调用的标准服务.
核心特性
原生历史会话续接与多轮上下文恢复 (
threadId):直接复用 Codex 原生保存在
~/.codex的会话持久化存储.通过
sourceKinds: ["cli", "vscode", "exec", "appServer", "unknown"]跨越终端 CLI、VS Code 插件以及 MCP, 无缝列出并无损续接历史对话.支持向宿主 Agent 直接回显指定历史会话的消息摘要与上下文.
工作区目录与沙箱策略精准映射 (
effectiveCwd):自动规范化解析
effectiveCwd(显式传入 -> 恢复会话目录 -> 默认工作区).将权限档位精确映射为底层 Codex 沙箱策略:
supervised(默认推荐): 工作区可写 (writableRoots: [effectiveCwd]), 网络禁用, 敏感操作与终端命令由宿主代理审批 (on-request).full-access: 免审批完全访问 (danger-full-access).read-only: 只读模式, 禁用写权限与网络访问.
截断指数退避长轮询 (
10s -> 20s -> 40s, 上限45s):任务执行中未决时自动递增等待窗口, 杜绝无效的密集高频空转.
任务执行完成、触发反向审批或进程断线时即刻唤醒返回, 绝不无谓挂起.
反向代理审批闭环 (
InteractionBroker+codex_approve):完整代理并转交 Codex 运行期的各项审批: 终端命令执行、文件变更、权限扩增以及交互提问 (
user_input).实时监听服务端
serverRequest/resolved通知, 杜绝重复提交或响应已失效审批.
安全防误删可选项 (
CODEX_SAFE_TRASH):防御性拦截直接永久删除命令 (如
rm -rf,del /f,Remove-Item等), 强制要求使用回收站/垃圾箱参数.支持通过环境变量
CODEX_SAFE_TRASH=false全局关闭, 或在codex_send中传入safeTrashOnly: false进行单次覆盖.
实时状态聚合与命令尾部追踪 (
TurnTracker):内存流式汇聚 Codex 回复文本.
实时维护当前正在运行之终端命令的 4KiB UTF-8 滚动输出尾部 (
activeCommand), 方便实时查看构建或测试动态.
Related MCP server: codex-mcp-server
MCP 对外工具契约
工具名称 | 参数列表 | 功能说明 |
|
| 启动新一轮任务执行. 若存在未结束任务则返回 |
|
| 轮询当前运行中任务的最新进展. 任务完成、审批触发或超时后唤醒返回. |
|
| 回复 Codex 执行期的反向审批请求, 自动根据安全配置拦截危险删除命令. |
|
| 中断正在执行的任务, 发送 |
|
| 省略 |
环境变量说明
环境变量 | 默认值 | 作用说明 |
|
| Codex CLI 执行文件路径 (支持系统 PATH 中的 |
|
| 运行入口为 JS 脚本时所调用的 Node.js 可执行文件路径. |
|
| 当请求与续接会话均未指定目录时的默认回退工作区. |
|
| 是否全局强制启用"仅移动到垃圾箱"安全拦截规则, 设置为 |
快速上手
1. 前置依赖
Node.js >= 18.0.0
OpenAI Codex CLI 已安装并完成登录授权
2. 安装与构建
git clone https://github.com/<你的用户名>/codex-antigravity-mcp.git
cd codex-antigravity-mcp
# 安装依赖
npm install
# 编译 TypeScript 至 dist/
npm run build
# 运行自动化测试套件 (17 个用例全部通过)
npm test3. 配置接入示例
Antigravity 配置
在 Antigravity 的 MCP 配置文件中加入:
{
"mcpServers": {
"codex": {
"command": "node",
"args": [
"<你的项目绝对路径>/dist/index.js"
],
"env": {
"CODEX_BIN_PATH": "codex",
"CODEX_SAFE_TRASH": "true"
}
}
}
}Claude Desktop 配置
在 claude_desktop_config.json 中配置:
{
"mcpServers": {
"codex": {
"command": "node",
"args": [
"<你的项目绝对路径>/dist/index.js"
]
}
}
}开发与验证
# 纯类型检查 (不输出文件)
npm run typecheck
# 依据本机安装的 Codex app-server 重新生成 TypeScript 协议类型
npm run protocol:generate
# 运行单元与集成测试 (内置 fake-app-server 双向测试)
npm test
# 运行真实环境两轮长对话冒烟验收
node scripts/smoke.mjs开源协议
本项目采用 MIT 协议开源.
Available Tools
5 toolscodex_approveA
回复 Codex 的反向审批请求 (命令执行、文件更改、权限申请或用户交互提问). 会自动拦截危险的直接删除命令并转为 decline.
| Name | Required | Description | Default |
|---|---|---|---|
| turnId | Yes | 轮次 ID | |
| waitMs | No | 审批后等待时长 (毫秒, 范围 0..45000, 默认 10000) | |
| answers | No | 针对 user_input 类型的问题回答字典 Record<questionId, answer> | |
| decision | Yes | 决策: accept, decline 或 cancel | |
| threadId | Yes | 会话 ID | |
| interactionId | Yes | 待审批项的 interactionId (从快照 pendingApproval 获取) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full behavioral burden. It does disclose one genuinely important non-obvious behavior: dangerous direct-delete commands are auto-intercepted and converted to decline. It does not say that the call blocks/wait (waitMs up to 45s), whether decisions are final, or what happens on a timeout, leaving meaningful gaps for a mutation-style approval tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, and the scope of the tool is front-loaded ahead of the auto-intercept caveat. Could be tighter only in that the parenthetical category list is somewhat enumerative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Badly overstated; rescored to 3. For a 6-parameter tool with a nested answers object, a blocking wait parameter, and no output schema, an agent still lacks guidance on decision choice (accept vs decline vs cancel), timeout behavior, and whether a returned result must be re-polled via codex_poll. Those omissions matter for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description's mention of 用户交互提问 hints that answers are required only for user_input cases, which adds a small amount beyond the schema, but it says nothing about decision semantics (when to choose cancel vs decline) or the waitMs trade-off.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (回复/approve) against a specific resource (Codex 反向审批请求) and enumerates the request categories it covers: command execution, file changes, permission requests, and user-input questions. Siblings (codex_poll, codex_send, codex_cancel, codex_sessions) are not named, but their verbs are distinct enough that confusion is unlikely.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage — respond when Codex has a pending reverse-approval request — but never states when not to use it, nor that interactionId must first be obtained from a snapshot/pendinApproval (that hint lives only in the schema) or that codex_poll is the way to discover pending requests. No explicit alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_cancelA
取消当前运行中的 Codex 执行轮次. 发送中断指令并等待最多 5 秒确认. 在旧命令确认停止前保持忙碌状态以防止并发写冲突.
| Name | Required | Description | Default |
|---|---|---|---|
| turnId | Yes | 轮次 ID | |
| threadId | Yes | 会话 ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does add real behavior: it sends an interrupt, waits up to 5 seconds for confirmation, and keeps the system busy until the old command confirms it stopped to avoid concurrent write conflicts. It omits what happens if the 5-second wait expires or how failure is reported.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences with the core action front-loaded, followed by the wait behavior and the concurrency rationale. No sentence is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter mutation with no output schema and no annotations, the description covers the action, its timeout, and its concurrency side effect well. It could be more complete by describing the outcome when cancellation times out or the target turn is not running.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so threadId and turnId are already documented as the session ID and turn ID. The description adds no further meaning about which turn to cancel or how the IDs relate to the running turn, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: cancel the currently running Codex execution turn, and it is clearly distinct from siblings like codex_send or codex_poll. It does not explicitly contrast itself with those siblings, which keeps it from a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: you cancel a running turn. There is no explicit statement of when to prefer this over alternatives, no prerequisite conditions, and no note on what to do if there is no running turn.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_pollA
轮询当前运行中的 Codex 任务进度. 未传 waitMs 时自动按截断指数退避 (20s -> 40s) 等待. 当任务完成、触发审批或断线时立刻返回.
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | No | 事件游标 (由上一次快照返回, 默认 0) | |
| turnId | Yes | 轮次 ID | |
| waitMs | No | 自定义等待毫秒数 (范围 0..45000, 省略时自动退避) | |
| threadId | Yes | 会话 ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses the truncated exponential backoff cadence (20s -> 40s) and the early-return triggers, which are non-obvious runtime behaviors. It stops short of stating that it is a read-only, non-mutating operation or anything about payload size, but the key timing semantics are covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the purpose followed by the waiting strategy and return conditions. No filler or repetition of the parameter list.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a polling tool with no output schema, it conveys the essential contract: it returns a snapshot plus events, and it terminates on completion/approval/disconnect. A brief note on how the cursor advances or what the snapshot contains would close the remaining gap, but nothing needed to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds value by explaining what omitting waitMs does (automatic backoff), which links the parameter to observable behavior rather than just its 0..45000 range. cursor and threadId/turnId semantics are left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('轮询当前运行中的 Codex 任务进度') and scopes it to running tasks, which cleanly separates it from the sibling write/control tools (codex_send, codex_approve, codex_cancel). An agent can identify the operation without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the default waiting mode when waitMs is omitted and enumerates the three conditions under which it returns early (completion, approval trigger, disconnect). It gives clear usage context but does not explicitly contrast with alternatives such as codex_sessions for discovering threadIds.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_sendA
向 Codex 发送提示词 (支持新建会话或在已有 threadId 上继续对话). 支持设置工作区目录、模型和权限模式. 在初始窗口 (默认 10s) 内等待, 若未完成则返回快照及下一次轮询的推荐退避时间.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | 工作目录 (绝对路径或相对路径, 省略时自动对齐会话目录或默认考研目录) | |
| model | No | Codex 使用的模型 (如 gpt-4o, o3-mini 等, 省略时遵循默认配置) | |
| effort | No | 推理深度 (low, medium, high 等, 省略时遵循默认配置) | |
| prompt | Yes | 用户发送给 Codex 的提示词文本 | |
| waitMs | No | 本轮调用等待时长 (毫秒, 范围 0..45000, 默认 10000) | |
| threadId | No | 已有会话 ID, 传入时续接该会话历史上下文 | |
| serviceTier | No | 服务速率模式 (default 标准速度, priority 优先加速 Fast) | |
| safeTrashOnly | No | 是否启用仅移入垃圾箱的安全规则 (默认遵循配置或环境变量 CODEX_SAFE_TRASH) | |
| permissionMode | No | 权限模式: supervised (默认工作区可写+反向审批), full-access (完全访问), read-only (只读) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses the initial wait window (default 10s) and that incomplete work returns a snapshot plus recommended backoff for the next poll, but it omits side-effect and safety details such as session creation, permission implications, or what actions Codex may take.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three front-loaded sentences with no wasted text. It moves from purpose to configurable behavior to the asynchronous wait/return behavior in a logical order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given nine parameters and no output schema, the description covers the core call pattern and the important partial-result behavior. The main gap is sibling routing: it does not explain how to continue with codex_poll after receiving a snapshot or when approval/cancellation tools are relevant.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented structurally. The description only notes workspace directory, model, and permission mode, adding little meaning beyond the schema and leaving prompt, threadId, waitMs, effort, serviceTier, and safeTrashOnly to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: send a prompt to Codex, either creating a new session or continuing an existing threadId. It also distinguishes the initial wait behavior from later polling, but it does not explicitly name or contrast sibling tools such as codex_poll or codex_cancel.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: use this tool to send prompts and optionally continue an existing threadId, with a partial-result path for polling. However, the description does not explicitly state when to use it instead of codex_poll, codex_approve, or codex_cancel, nor does it describe exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_sessionsB
查看本地 Codex 原生历史会话列表或指定会话的历史对话详情. 支持覆盖全来源 (CLI / VS Code / 桌面端 / exec / appServer).
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | 按项目目录筛选会话 | |
| limit | No | 返回会话数量上限 (默认 20) | |
| threadId | No | 指定会话 ID 时, 读取并返回该会话的元数据及历史消息摘要 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; '查看本地' does convey read-only local access, which is the key behavioral fact. However, it says nothing about pagination/limit behavior, ordering, performance on large histories, or whether any auth/config is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, front-loaded with the list/detail distinction and followed by the source-coverage scope note. No filler, though the source list is somewhat peripheral to how the tool is invoked.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-parameter read tool with a fully described schema, the definition is adequate to call it correctly. Since there is no output schema, the description could have said more about what the list/detail results look like, but the schema's threadId text partially compensates.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so cwd, limit and threadId are already fully documented with defaults and bounds; baseline is 3. The description adds only the cross-cutting '全来源 (CLI / VS Code / 桌面端 / exec / appServer)' context, not parameter-level meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (查看) and resource (本地 Codex 原生历史会话列表 / 指定会话详情), and covers both list and detail modes plus source coverage. Siblings (codex_poll/send/approve/cancel) are action-oriented, so the read-only history tool is easy to tell apart, though the description never names a sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The two operating modes are implied — omit threadId to list, supply it to read a session — and the schema's threadId description confirms this. There is no explicit when-to-use / when-not-to-use guidance or mention of alternatives, so usage must be inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
codex_approve - First observed
codex_cancel - First observed
codex_poll - First observed
codex_send - First observed
codex_sessions
TDQS
Scored across 5 tools
Each tool maps to a distinct lifecycle operation: send input, poll progress, approve requests, cancel execution, or inspect sessions. The boundaries are clear even though send and poll both involve waiting, because their descriptions explain that send starts/continues work while poll only observes it.
All tools share a consistent codex_ prefix, and four of five use clear action verbs. codex_sessions is noun-based and combines list/detail behavior, which is a minor deviation from the otherwise consistent verb pattern.
Five tools are well-scoped for a Codex execution wrapper, covering the essential lifecycle without redundant endpoints. Each tool earns its place and no obvious duplicate surface exists.
The set covers sending prompts, continuing threads, polling, approvals, cancellation, and session history, which supports the core workflow. Minor gaps include no explicit session deletion or model/configuration discovery, but agents can work around these.
Maintenance
Related MCP Connectors
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Your org's AI agents, tasks, runs, search, and brain files as MCP tools and resources.
Hosted MCP runtime where your agent publishes its own tools by tool call and keeps working.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to spawn and control Codex CLI and Claude Code sessions on the host machine, with session management and filesystem access.4MIT
- AlicenseNot gradedqualityDmaintenanceWraps OpenAI Codex CLI as an MCP server, exposing 8 Codex tools (exec, review, skill list, skill run, status, poll, list jobs, kill) as named tools for use with pi or codex.1,029 npmISC
- AlicenseNot gradedqualityAmaintenanceA local stdio MCP server that lets any MCP client start a Codex thread and continue it by opaque thread ID through the codex and codex-reply tools, with fail-closed sandboxing and approval policies. It restores the removed Codex CLI MCP integration by bridging clients like OpenCode to the official Codex SDK.MIT
- AlicenseAqualityBmaintenanceEnables Claude Code or any MCP client to delegate hands-on coding work to OpenAI Codex over a persistent app-server process, keeping long-lived threads with follow-ups, async polling, approvals, steering, and interrupts. Supports native code review, resuming existing sessions, structured output, and parallel worktree-isolated tasks.1024 npm1MIT