codex-app-mcp
You can use this MCP server to run Codex conversations through Claude Code: it exposes two tools that start and continue persistent Codex threads via a long-lived codex app-server child process.
codex— starts a new thread (persisted conversation) from a requiredprompt, with optional model, cwd, sandbox (default read-only), approval-policy (default never), config, timeout (default 900s), base-instructions, developer-instructions, and compact-prompt (folded into developer-instructions).codex-reply— continues an existing thread using a requiredpromptplusthreadId(or deprecatedconversationId), with optional timeout.Results include the final answer in
content[0].textand structured data (threadId,turnId,status,declinedRequests); the server auto-declines approval/permission requests since it runs headless.Handy for reusing existing skills/tooling that call
mcp__codex__codexormcp__codex__codex-replywithout changes.
Provides integration with OpenAI's Codex CLI via its app-server JSON-RPC protocol, enabling agents to start new Codex threads and continue existing conversations with configurable model, sandbox, approval policy, and timeouts.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codex-app-mcpStart a new Codex conversation to review my current branch."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
codex-app-mcp
What this is
codex mcp-server was deprecated in codex-cli 0.149.1 and removed in 0.153.0
(PR #42993). This is a thin
stdio MCP server that re-exposes the same codex / codex-reply tool
interface the removed server offered, but drives it by talking to
codex app-server — the official (if experimental) JSON-RPC successor
protocol — instead of shelling out per call.
Related MCP server: opencode-codex-mcp
Requirements
Node >= 20
the
codexCLI onPATH, already authenticated (codex login, or an API key) — auth is not this server's joba codex-cli new enough to have
codex app-server(developed and tested against codex-cli 0.154.0)
Install
npm install
npm run buildRegister with Claude Code
claude mcp add --scope user codex -- node /home/anon/tmp-create-codex-mcp/dist/index.jsBy default the server spawns codex from PATH. Set CODEX_BIN to point at
a specific binary if the one you want isn't first on PATH, e.g.:
CODEX_BIN=/path/to/codex claude mcp add --scope user codex -- node /home/anon/tmp-create-codex-mcp/dist/index.jsTools exposed
Both tools mirror the removed codex mcp-server's 0.151.0 interface, so
existing skills/tooling that call mcp__codex__codex /
mcp__codex__codex-reply need no changes.
codex — starts a new thread (a persisted codex conversation)
Param | Values | Default | Note |
| string | — | required |
| string | — | optional |
| string | server cwd | optional |
|
|
|
|
|
|
| |
| object | — | optional |
| string | — | optional |
| string | — | optional |
| string | — | folded into |
| number |
| |
| — | — | rejected outright — app-server has no equivalent field |
codex-reply — continues an existing thread
Param | Values | Default | Note |
| string | — | required, or use |
| string | — | deprecated alias for |
| string | — | required |
| number |
|
Result shape (both tools)
content[0].text is the final answer. structuredContent carries
threadId, turnId, status, and declinedRequests — the method names of
any app-server approval/permission requests this server auto-declined,
since it runs headless and can't grant filesystem or exec access.
structuredContent.threadId is present in every case except one: codex
when thread/start itself fails, before any thread has ever existed.
There's nothing to report in that case, so no id is synthesized; codex-reply
always has one, since its threadId comes from the caller, not from a
thread/start this server made.
Updating this server
After git pull (or any local fix) + npm run build, restart or reconnect any Claude
Code session that already had this server connected — a running Node process doesn't
pick up a rebuilt dist/ on its own; it keeps serving whatever was on disk when Claude
Code spawned it. In Claude Code, open the /mcp panel, find codex, and choose
Reconnect (discards the cached tool list and respawns the process; no full session
restart needed). Confirmed live (2026-09-15) as the actual cause of an already-fixed bug
appearing to recur across sessions that predated the fix.
To check which version a running server is on, look at its stderr: it logs
[codex-app-mcp] starting vX.Y.Z (pid N) on every startup.
Testing
npm testruns the full suite (78 tests) againsttests/fake-app-server.mjs, a scripted stand-in forcodex app-server. Fast, no network, no auth needed — this is what CI/every commit should run.bin/smoke.sh(orCODEX_LIVE=1 npm run smoke) runs a real end-to-end check against your actualcodexCLI: starts a thread, gets a reply, continues it same-process, then continues it again from a freshAppServerClient(simulating a process restart), plus one call through thetools.tshandler layer. Run this after everycodex update—codex app-serveris an experimental/unstable protocol surface, and this is the drift alarm that catches it before a skill call does.
Fallback note
If codex app-server's protocol changes enough to make this wrapper costly
to maintain, 0Pinky0/codex-mcp-sidecar's CODEX_MCP_SIDECAR_COMPAT=1
adapter was evaluated as a fallback (see
~/.claude/docs/decisions/2026-09-14-codex-leg-transport.md).
Architecture
AppServerClient (JSON-RPC framing over the child's stdio, request
correlation, notification/server-request dispatch) is wrapped by
TurnRunner (thread/turn lifecycle, approval declines, per-thread
serialization, timeouts), which tools.ts adapts to the MCP tool contract
(zod schemas, kebab-case field mapping, result shaping). src/index.ts wires
these together behind a lazy child spawn that respawns automatically if the
codex app-server process ever exits. schema/ is regenerated from the
installed codex CLI before every test run (pretest), so any protocol
drift shows up immediately as test failures rather than at runtime.
Available Tools
2 toolscodexB
Runs a prompt against Codex over a long-lived codex app-server child, starting a new thread. Mirrors the removed codex mcp-server's codex tool (0.151.0 field set); profile is not supported (app-server has no equivalent) and compact-prompt is folded into developer-instructions.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| model | No | ||
| config | No | ||
| prompt | Yes | ||
| profile | No | ||
| sandbox | No | read-only | |
| compact-prompt | No | ||
| approval-policy | No | never | |
| timeout-seconds | No | ||
| base-instructions | No | ||
| developer-instructions | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses the long-lived child process, new-thread behavior, and the profile/compact-prompt differences. However, it does not mention side effects, permissions, return format, or timeout implications beyond what schema implies. This is moderate transparency but incomplete for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no fluff. The core action is front-loaded, followed by essential caveats. It is concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (11 parameters, nested objects, no annotations, no output schema), the description is far too sparse. It omits explanations of critical parameters like sandbox, approval-policy, and model, and does not describe the return value or error behavior. The description covers only a fraction of what an agent needs to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only clarifies that 'profile' is not supported and 'compact-prompt' is folded into developer-instructions, which addresses two of 11 parameters. It leaves cwd, model, config, sandbox, approval-policy, timeout-seconds, base-instructions, and developer-instructions unexplained. This is insufficient for an agent to use the tool effectively.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action: 'Runs a prompt against Codex' and adds implementation detail (long-lived child, new thread). It also contextualizes its lineage by referencing the removed mcp-server tool. This is sufficiently distinct and unambiguous, even though it doesn't explicitly differentiate from the sibling codex-reply.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus the sibling codex-reply. It only notes differences from a removed version (profile unsupported, compact-prompt folded into developer-instructions), which is historical context, not usage selection. No alternatives or conditions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex-replyA
Continues an existing Codex thread started by codex (or a previous session) with a follow-up prompt. Mirrors the removed codex mcp-server's codex-reply tool; conversationId is accepted as a deprecated alias for threadId.
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | ||
| threadId | No | ||
| conversationId | No | ||
| timeout-seconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It mentions the deprecated alias and timeout parameter, but does not specify side effects, error behavior when the thread does not exist, whether results are streamed or returned in full, or any authentication/permission requirements. This is a minimal disclosure for a tool that sends prompts and likely mutates session state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no redundant text. The primary purpose is stated first, followed by useful context about the tool's provenance and deprecated alias. Every phrase carries meaning, making it efficiently scannable for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations, output schema, and 0% schema coverage, the description is incomplete. An agent would not know what constitutes a valid `threadId` format, how `timeout-seconds` behaves, what errors may occur, or what the response format looks like. This is a significant gap for a tool that requires a user-provided identifier and prompt.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must add meaning to parameters. It clarifies that `conversationId` is a deprecated alias for `threadId`, which is helpful. However, it does not explain the `prompt` parameter beyond being a follow-up prompt, nor does it describe `timeout-seconds` semantics (e.g., what happens on timeout). It partially compensates for the missing schema descriptions but leaves key parameters under-explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific purpose: continuing an existing Codex thread with a follow-up prompt. It identifies the resource (existing thread) and distinguishes itself from the sibling `codex` tool by noting the thread is started by `codex`, making the differentiation explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys when to use this tool (when continuing an existing thread, including a previous session) and implies that `codex` is for starting threads. However, it does not explicitly state 'use this instead of `codex` when a thread already exists,' but the context is strong enough. It also clarifies the deprecated `conversationId` alias, which guides parameter selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.1.0- First observed
codex - First observed
codex-reply
TDQS
Scored across 2 tools
The two tools have clearly distinct roles: codex starts a new thread, while codex-reply continues an existing thread using a threadId. There is no meaningful overlap or ambiguity between them.
Both names share a consistent codex prefix and the -reply suffix clearly marks the continuation operation. The naming is not a strict verb_noun convention, but the pattern is predictable and understandable.
With only two tools, the server feels minimal, but this is arguably appropriate for a narrow conversation-thread workflow. It falls into the borderline range where the count is thin but not unreasonable.
The server covers the core lifecycle of Codex interactions: starting a new thread and continuing an existing one. There are minor gaps such as no explicit session listing or cancellation, but agents can work around them using the returned thread IDs.
Maintenance
Related MCP Connectors
Real-time chat for AI agents. Claude Code, Cursor, Cline and Codex join channels over MCP.
- QuallaaOAuthcom.quallaa
Talk to your public-facing AI from any MCP client — Claude, ChatGPT, Cursor, Cline, Windsurf.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Enable secure connectivity between Sentry issues and debugging data, and LLM clients, using a Model Context Protocol (MCP) server.
Related MCP Servers
- AlicenseAqualityBmaintenanceBridges OpenAI Codex CLI to any MCP client, allowing headless Codex sessions via tools like codex and codex-reply.220 npm1MIT
- FlicenseNot gradedqualityCmaintenanceEnables MCP-compatible hosts such as OpenCode to drive the Codex CLI through codex app-server over stdio, exposing tools to run prompts, inspect status, list threads, and interrupt running turns.-
- AlicenseNot gradedqualityBmaintenanceEnables MCP clients and external AI supervisors to oversee and steer native Codex sessions through a thin local stdio bridge. It exposes eleven codex_* supervisory tools for tasks such as listing threads, starting turns, observing progress, steering, responding to approvals, interrupting, checkpointing, and rolling over work.MIT
- AlicenseAqualityBmaintenanceEnables MCP clients to run non-interactive Codex CLI sessions via codex and codex-reply tools, including resuming conversations by thread ID and passing codex exec flags.2MIT