codex-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codex-mcpReview the current branch for bugs and security vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Codex MCP
A lightweight Model Context Protocol (MCP) server that exposes the local Codex CLI (codex) to MCP-compatible coding agents.
The project intentionally keeps the architecture small: MCP tools validate inputs, a thin CLI adapter executes codex exec (and friends), and codex_raw provides an escape hatch for CLI options that are added in future Codex releases.
Features
Run Codex as a local coding agent through MCP (
codex exec).Run non-interactive code reviews (
codex exec review).Resume or fork previous sessions (
codex exec resume/codex exec fork).Control common CLI options such as model, sandbox policy, approval behavior, extra directories, images, and output handling.
Inspect version, login status, and diagnostics (
codex doctor).Pass arbitrary CLI arguments through
codex_rawfor forward compatibility.No shell execution: arguments are passed directly to the
codexprocess (shell: false).Optional server-wide model override via an environment variable (see below).
Related MCP server: codex-mcp-server
Requirements
Node.js 18+
Codex CLI installed and authenticated (
codex login)codexavailable onPATHAn MCP-compatible client
If codex is not on PATH, set CODEX_MCP_CMD to the executable path.
CODEX_MCP_CMD=/custom/path/codexWindows PowerShell:
$env:CODEX_MCP_CMD = "C:\path\to\codex.exe"Forcing a specific model
Every tool that runs the agent (codex_run, codex_review, codex_resume, codex_fork, and codex_raw when its first argument is exec) accepts a model input. If you set the CODEX_MCP_MODEL environment variable on the MCP server process, it overrides the model for every such call, regardless of what the caller (or a raw argument list) requests. This is useful when you want to pin the server to a single model — for cost control, quota limits, or consistency — no matter what any individual tool call asks for.
CODEX_MCP_MODEL=your-model-idThe override is applied last, after stripping any -m/--model flag or -c model=... config override already present in the constructed arguments, so it always wins. It is never applied to subcommands that don't accept a model (--version, login status, help, doctor, ...), so those keep working normally even when the override is set.
Quick Start
The recommended setup is through npm. You do not need to clone this repository or install the MCP server manually.
Claude Code
claude mcp add --scope user codex -- npx -y codex-mcpVerify the server:
claude mcp listIf codex is not on PATH, or you want to pin the model:
claude mcp add --scope user \
--env CODEX_MCP_CMD=/custom/path/codex \
--env CODEX_MCP_MODEL=your-model-id \
codex -- npx -y codex-mcpGemini CLI
gemini mcp add --scope user codex npx -y codex-mcpVerify:
gemini mcp listCursor
{
"mcpServers": {
"codex": {
"command": "npx",
"args": ["-y", "codex-mcp"]
}
}
}Windsurf
{
"mcpServers": {
"codex": {
"command": "npx",
"args": ["-y", "codex-mcp"]
}
}
}Cline / Roo Code / Other MCP Clients
{
"command": "npx",
"args": ["-y", "codex-mcp"]
}If the client supports environment variables, CODEX_MCP_CMD and CODEX_MCP_MODEL can be set there as well.
Local Development
git clone https://github.com/alvarosw/codex-mcp.git
cd codex-mcp
npm install
npm startNo build step is required.
Testing
npm test runs a static syntax check only — it makes no network calls and costs nothing.
npm run test:live drives the real MCP server end to end over stdio against a real, authenticated Codex CLI (in a throwaway temp git repo it creates and cleans up). It exercises every tool, including verifying that CODEX_MCP_MODEL (if set) wins over a deliberately wrong model passed in a tool call or smuggled into codex_raw arguments. This makes real model calls and is not run automatically — you need codex login completed first, and it will consume real quota/tokens against whichever model resolves for the call:
CODEX_MCP_MODEL=your-model-id npm run test:liveCODEX_MCP_MODEL is optional for this script; without it, the override-specific assertions are skipped and the rest of the suite still runs against your account's default configured model.
Tools
codex_run
Run Codex as an agent non-interactively (codex exec) with common CLI controls: prompt, model, sandbox policy, approval routing, extra directories, images, working directory, ephemeral/persisted sessions, and raw passthrough args.
Example:
{
"prompt": "Review the authentication implementation and identify security issues.",
"cwd": "/workspace/project",
"sandbox": "workspace-write",
"addDirs": ["/workspace/shared"]
}codex_review
Runs codex exec review non-interactively against the current repository. Supports uncommitted, base, commit, and title, plus a custom review prompt.
codex_resume
Resumes a previous session (codex exec resume) by sessionId, or the most recent one if omitted, optionally sending a new prompt.
codex_fork
Forks a previous session (codex exec fork) by sessionId into a new session, optionally sending a prompt.
codex_version
Returns the installed Codex CLI version.
codex_login_status
Runs codex login status to check authentication state.
codex_doctor
Runs codex doctor --json for install, auth, config, and connectivity diagnostics.
codex_help
Shows CLI help. A command can be provided for command-specific help.
codex_raw
Runs codex with an arbitrary argument array. This is the compatibility escape hatch for flags or commands not covered by the convenience tools. The model override, if set, still applies when the first argument is exec.
Example:
{
"args": ["mcp", "list"]
}Architecture
src/
├── index.js # MCP server and tool registration
├── tools.js # Tool behavior and response formatting (JSONL event parsing)
└── codex.js # Thin process adapter for the codex CLI + model-override enforcementDependency direction:
MCP transport
↓
tool handlers
↓
codex CLI adapter
↓
local codex executableThere is intentionally no service container, repository layer, or framework abstraction. The project has one external process boundary and keeps that boundary explicit.
Tools that invoke codex exec* request --json internally so output can be parsed reliably; each tool's text response is the agent's final message(s), with the full parsed event stream, command executions, token usage, and thread id available in structuredContent for programmatic consumers.
Security Notes
codex_raw can execute arbitrary Codex CLI arguments with the permissions of the user running the MCP server. The server itself does not invoke a shell, so tool arguments are not shell-interpreted, but codex still has whatever permissions its sandbox and approval settings grant it.
dangerouslyBypassApprovalsAndSandbox skips all confirmation prompts and sandboxing. Only use it when you explicitly trust the task and an already-isolated workspace.
Environment variables passed through the env field are inherited by the codex process. Avoid sending secrets through MCP tool arguments unless necessary.
License
MIT
Available Tools
9 toolscodex_doctorA
Run Codex's built-in diagnostics (codex doctor --json): install, auth, config, and connectivity health.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| timeoutMs | No | Process timeout in milliseconds. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It concretely states that a subprocess command (`codex doctor --json`) is executed and what areas it checks, which is useful transparency. However, it does not disclose whether the command is read-only, whether it accesses credentials or network endpoints, or what failure modes may occur.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with the action front-loaded and the health categories listed efficiently. There is no filler, redundancy, or repetition of information already present in the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The core purpose and command are clear, and the schema covers the parameters, but there is no output schema or annotation help. The description does not explain the shape of the returned JSON, exit behaviors, or potential side effects, so an agent is left to infer some important runtime context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters (cwd, env, timeoutMs) are already fully documented in the schema. The description adds no parameter-specific meaning, which is acceptable given the high schema coverage, but it also does not improve on it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact command (`codex doctor --json`) and the resource it operates on: Codex built-in diagnostics. It also enumerates the health domains (install, auth, config, connectivity), making it clearly distinct from siblings like codex_run or codex_login_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is for diagnosing Codex installation, auth, config, and connectivity issues, which gives the agent a clear signal about when it might be relevant. However, it does not explicitly state when to choose it over alternatives like codex_login_status or codex_help, nor does it mention when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_forkB
Fork a previous Codex session (codex exec fork) into a new session and optionally send a prompt.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| model | No | Model the agent should use. May be forced by the server's model-override environment variable. | |
| prompt | No | Optional prompt to send after forking. | |
| ephemeral | No | Skip persisting session files to disk. Defaults to true. | |
| extraArgs | No | Additional raw codex CLI arguments appended to the command. | |
| sessionId | Yes | Conversation/session id (UUID) or thread name to fork. | |
| timeoutMs | No | Process timeout in milliseconds. | |
| ignoreRules | No | Do not load user or project execpolicy .rules files. | |
| outputSchema | No | Path to a JSON Schema file describing the expected final response shape. | |
| skipGitRepoCheck | No | Allow running outside a Git repository. Defaults to true. | |
| outputLastMessage | No | Path to a file where the final agent message should be written. | |
| dangerouslyBypassApprovalsAndSandbox | No | Skip all confirmation prompts and sandboxing. Only use in an already-isolated environment. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states that the tool forks a session and optionally sends a prompt. It does not mention side effects (e.g., whether the original session is preserved, whether the new session is persisted), required permissions, network access, or what the response looks like. For a tool with 13 parameters and no annotations, this is a significant gap in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the primary action and its optional variation. It is efficient and avoids redundancy. However, given the complexity of the tool (13 parameters, no annotations, no output schema), one might argue it is too terse, but as a statement of purpose it is concise without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 13 parameters, no annotations, and no output schema, the description is far too minimal. It explains only the core function and does not cover return values, edge cases, side effects, or any operational context (e.g., when to set ephemeral, how the fork interacts with session persistence). An agent would have to rely entirely on the schema and trial-and-error to use this tool correctly, which is inadequate for a complex operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of parameters with descriptions, so the baseline is 3. The description adds marginal value by mentioning the 'prompt' parameter ('optionally send a prompt'), which aligns with the schema. However, it does not provide additional context for other parameters (e.g., ephemeral, skipGitRepoCheck, dangerouslyBypassApprovalsAndSandbox) beyond what the schema already offers. The description neither compensates for any gaps nor enriches the schema's meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to fork a previous Codex session into a new session, optionally sending a prompt. It uses a specific verb ('fork'), identifies the resource (a Codex session), and distinguishes itself from siblings like codex_resume and codex_run by its focus on forking rather than resuming or running fresh. The reference to `codex exec fork` also anchors the behavior precisely.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus its siblings (e.g., when to fork versus resume versus run). While the purpose is clear, it does not state conditions like 'use when you want a new session derived from an existing one' or contrast with codex_resume. The usage context is implied by the name and description but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_helpB
Show Codex CLI help, optionally for a specific subcommand.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| command | No | ||
| timeoutMs | No | Process timeout in milliseconds. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavior. It states the core action but does not mention output format, side effects, or handling of missing or invalid subcommands; it is acceptable for a low-risk help tool but still thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no redundant material. Every word contributes meaning, and it is immediately scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is sufficient for a simple no-argument invocation, but omits details like default behavior, output shape, and invalid-subcommand handling. Combined with the sparse description of 'command' and no output schema, some edge cases are left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents cwd, env, and timeoutMs, and the description adds that a subcommand is optional. However, it does not explain the expected format or values for the undocumented 'command' property, leaving a notable gap at 75% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a concrete verb ('Show') and names the exact resource ('Codex CLI help'), while also noting the optional subcommand behavior. It is clear on its own, though it does not explicitly contrast with sibling tools like codex_run or codex_review.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to choose help over the sibling tools or when to omit the subcommand. Usage is only implied by the word 'help,' leaving the agent to infer the triggering context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_login_statusB
Check Codex CLI authentication status (codex login status).
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| timeoutMs | No | Process timeout in milliseconds. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavior. It only says 'check authentication status' and the underlying command, but it does not state whether the operation issues a network request, what its output looks like, whether it mutates state, or what happens when authentication is missing. This is minimal disclosure of behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. It communicates the operation and the exact command reference in a compact form. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Overall the tool shape is very simple: no required parameters, one clear purpose, and a generic schema. However, the description gives no indication of the response shape or success/failure semantics, and there is no output schema and no annotations to compensate. An agent can safely invoke it but may not know how to interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all parameters (cwd, env, timeoutMs) with descriptions, so the baseline is 3. The description adds no parameter-level detail, but also none is needed because these are generic process-control parameters already well explained by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource: 'Check Codex CLI authentication status'. It also refers to the exact underlying command (`codex login status`), which leaves no ambiguity about what the tool does. The purpose is distinct from siblings like codex_review, codex_run, and codex_doctor.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explain when an agent should call this tool instead of a sibling. No prerequisites, intended scenarios, or exclusions are provided. The usage context is left entirely to inference from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_rawA
Run the Codex CLI with an arbitrary argument array. Escape hatch for options not covered by the other tools. The server's model-override environment variable, if set, still applies.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| args | Yes | ||
| timeoutMs | No | Process timeout in milliseconds. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must carry the full disclosure burden. It reveals only that a model-override env var still applies. It does not mention that executing arbitrary arguments may have side effects, security implications, or that the process output/error format is. This is a significant gap for an escape-hatch tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, with the primary purpose front-loaded and the escape-hatch positioning in the second sentence. Every word earns its place; no fluff or redundant detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the tool's raw nature, the description is incomplete for an agent that must call it safely. It does not state what the tool returns (stdout, exit code, etc.), whether it is synchronous, or warn about the risk of passing arbitrary args. Given no output schema and no annotations, more context is needed for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 75% (only args lacks a description). The description adds minimal meaning beyond the schema: 'arbitrary argument array' clarifies the args type but does not explain cwd, env, or timeoutMs further. Since coverage is high and the description contributes a small extra for args, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb-resource pair ('Run the Codex CLI') with a specific scope ('arbitrary argument array') and positions itself as an escape hatch relative to the other sibling tools. This distinguishes it from codex_run and the rest without needing to inspect schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to use it when 'options not covered by the other tools' are needed. This gives a direct condition for selection, though it does not name specific sibling tools or give excluded use cases. Still, the core guidance is unambiguous and useful.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_resumeB
Resume a previous Codex session non-interactively (codex exec resume) and optionally send a new prompt.
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | Search across all directories, not just the current one. | |
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| model | No | Model the agent should use. May be forced by the server's model-override environment variable. | |
| prompt | No | Prompt to send after resuming the session. | |
| ephemeral | No | Skip persisting session files to disk. Defaults to true. | |
| extraArgs | No | Additional raw codex CLI arguments appended to the command. | |
| sessionId | No | Conversation/session id (UUID) or thread name. Omit to resume the most recent session. | |
| timeoutMs | No | Process timeout in milliseconds. | |
| ignoreRules | No | Do not load user or project execpolicy .rules files. | |
| outputSchema | No | Path to a JSON Schema file describing the expected final response shape. | |
| skipGitRepoCheck | No | Allow running outside a Git repository. Defaults to true. | |
| outputLastMessage | No | Path to a file where the final agent message should be written. | |
| dangerouslyBypassApprovalsAndSandbox | No | Skip all confirmation prompts and sandboxing. Only use in an already-isolated environment. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral disclosure burden. It only reveals that execution is non-interactive and that a new prompt may be sent; it does not disclose side effects, whether code may be executed, sandbox implications, or what happens to the resumed session. For a tool with a destructive-looking bypass parameter, this is a significant transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence with no filler, and it front-loads the core operation and command. It earns its place, though it is so sparse that it leaves important behavioral and usage context unaddressed, which prevents a perfect conciseness score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a 14-parameter tool with no annotations, no output schema, and a one-sentence description. The description does not explain session selection defaults, output location, process behavior, safety posture, or relationship to the many sibling tools, so it is not complete enough for an agent to invoke it confidently in varied contexts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage of all 14 parameters with meaningful descriptions, so the baseline is 3. The description itself adds very little parameter-specific meaning beyond the 'new prompt' idea, but it does not need to because the schema already documents each parameter well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Resume a previous Codex session non-interactively' and even names the underlying command `codex exec resume`. It is clearly distinct from sibling tools by mentioning 'previous session,' but it does not explicitly contrast itself with codex_run or codex_fork, so it falls just short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it: when resuming a previous Codex session rather than starting a new one. However, it gives no explicit guidance about when not to use it or when to prefer a sibling tool such as codex_run or codex_fork, so the usage context is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_reviewB
Run a non-interactive Codex code review (codex exec review) against the current repository.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| base | No | Review changes against the given base branch. | |
| model | No | Model the agent should use. May be forced by the server's model-override environment variable. | |
| title | No | Optional commit title to display in the review summary. | |
| commit | No | Review the changes introduced by a single commit. | |
| prompt | No | Custom review instructions. | |
| ephemeral | No | Skip persisting session files to disk. Defaults to true. | |
| extraArgs | No | Additional raw codex CLI arguments appended to the command. | |
| timeoutMs | No | Process timeout in milliseconds. | |
| ignoreRules | No | Do not load user or project execpolicy .rules files. | |
| uncommitted | No | Review staged, unstaged, and untracked changes. | |
| outputSchema | No | Path to a JSON Schema file describing the expected final response shape. | |
| skipGitRepoCheck | No | Allow running outside a Git repository. Defaults to true. | |
| outputLastMessage | No | Path to a file where the final agent message should be written. | |
| dangerouslyBypassApprovalsAndSandbox | No | Skip all confirmation prompts and sandboxing. Only use in an already-isolated environment. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose that the operation is non-interactive and scoped to the current repository, but it omits output behavior, side effects, and runtime characteristics such as session persistence or long-running process behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. It communicates the essential operation efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite a fully documented schema, this is a complex 16-parameter external-process tool with no annotations and no output schema. The description does not explain what the review returns, how to interpret results, or what side effects to expect, leaving significant gaps for an agent deciding whether and how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already fully documented. The description adds no parameter-level meaning, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact underlying command (`codex exec review`), the target (current repository), and the execution mode (non-interactive). This clearly differentiates it from siblings like codex_run and codex_raw.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The use case is implied by the phrase 'code review', and the non-interactive qualifier suggests automated scenarios, but there is no explicit when-to-use/when-not-to-use guidance or named alternatives. An agent must infer the choice from the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_runB
Run the Codex agent non-interactively (codex exec) with common CLI controls.
| Name | Required | Description | Default |
|---|---|---|---|
| cd | No | Directory codex should treat as its working root (--cd). | |
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| model | No | Model the agent should use. May be forced by the server's model-override environment variable. | |
| images | No | Image file paths to attach to the prompt. | |
| prompt | Yes | Task for the Codex agent. | |
| addDirs | No | Additional directories to expose to the agent (--add-dir). | |
| sandbox | No | Sandbox policy for model-generated shell commands. | |
| ephemeral | No | Skip persisting session files to disk. Defaults to true. | |
| extraArgs | No | Additional raw codex CLI arguments appended to the command. | |
| timeoutMs | No | Process timeout in milliseconds. | |
| ignoreRules | No | Do not load user or project execpolicy .rules files. | |
| approveForMe | No | Route approval requests through automatic review using the workspace-write sandbox. | |
| outputSchema | No | Path to a JSON Schema file describing the expected final response shape. | |
| skipGitRepoCheck | No | Allow running outside a Git repository. Defaults to true. | |
| outputLastMessage | No | Path to a file where the final agent message should be written. | |
| dangerouslyBypassApprovalsAndSandbox | No | Skip all confirmation prompts and sandboxing. Only use in an already-isolated environment. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It discloses that the tool runs non-interactively and exposes 'common CLI controls', but it does not mention side effects like file modifications, sandbox behavior, approval routing, or the fact that `dangerouslyBypassApprovalsAndSandbox` exists. The schema provides some parameter-level behavior, but the description itself adds minimal behavioral context beyond the mode of execution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loads the core purpose. It could add a bit more context about when to use it, but it is not bloated and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (17 parameters, no output schema, no annotations), the description is thin. It doesn't explain return values, side effects, or how the tool relates to codex_raw and codex_review. The schema covers parameters, but the description doesn't provide enough operational context for an agent to know what happens when the tool runs or what the output will look like.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 17 parameters. The description adds no parameter-level meaning beyond what the schema provides. Baseline 3 is appropriate because the schema does the heavy lifting and the description doesn't need to compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Run'), a specific resource ('the Codex agent'), and the mode ('non-interactively (`codex exec`)'), which clearly distinguishes it from interactive or review-oriented siblings. It doesn't explicitly name sibling alternatives, but the mention of `codex exec` and 'common CLI controls' gives enough specificity to separate it from codex_review, codex_resume, and codex_raw.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: run the Codex agent non-interactively with CLI controls. It does not explicitly state when to use this tool versus codex_raw, codex_review, or codex_resume. The phrase 'common CLI controls' hints that codex_raw is for raw/advanced usage, but no explicit when/when-not guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_versionA
Return the installed Codex CLI version.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the codex process. | |
| env | No | Additional environment variables for codex. | |
| timeoutMs | No | Process timeout in milliseconds. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral transparency burden. It states the observable outcome (returning the version) but does not disclose execution details such as spawning a process, potential failures when Codex is not installed, or the output format. For a simple read-only version check this is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clear sentence with no filler. It is front-loaded with the action and object, making it immediately scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple version-check tool with no required parameters and a fully documented schema, the description is nearly complete. It lacks only minor context such as error behavior when the CLI is missing, but nothing essential to invoking the tool correctly is omitted.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all three parameters (cwd, env, timeoutMs). The description adds no additional parameter semantics, which aligns with the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and object: 'Return the installed Codex CLI version.' This clearly distinguishes it from the sibling tools, none of which are about version reporting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied: call this tool when you need to know the installed Codex CLI version. However, the description does not explicitly state when to use it versus alternatives or provide any exclusions, so it stops at implied guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v1.0.0- First observed
codex_doctor - First observed
codex_fork - First observed
codex_help - First observed
codex_login_status - First observed
codex_raw - First observed
codex_resume - First observed
codex_review - First observed
codex_run - First observed
codex_version
TDQS
Scored across 9 tools
Tools are mostly distinct: review, resume, run, and fork each target specific Codex execution modes, while version, login_status, doctor, help, and raw cover ancillary actions. There is slight overlap between run, resume, and fork, but descriptions clarify the differences effectively.
All tools share the consistent codex_ prefix and snake_case naming. The second part is a mix of verbs (review, resume, run, fork) and nouns (version, login_status, doctor, help, raw), but the overall pattern is predictable and readable, with minor deviation from a strict verb_noun convention.
With 9 tools, the set is well-scoped for a CLI wrapper server. It covers primary execution modes, status checks, diagnostics, help, and an escape hatch without unnecessary bloat. The count falls comfortably in the ideal 3-15 range.
The surface covers the main Codex workflows (run, review, resume, fork) and essential auxiliary actions (version, status, doctor, help). The codex_raw tool provides an arbitrary argument escape hatch, mitigating gaps for uncovered CLI options. Minor omissions like explicit auth configuration are not critical due to raw access.
Maintenance
Related MCP Connectors
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Remote MCP learning coach for coding agents.
A paid remote MCP for OpenAI Codex context compressor, built to return verdicts, receipts, usage log
A paid remote MCP for OpenAI Codex harness MCP, built to return verdicts, receipts, usage logs, and
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to spawn and control Codex CLI and Claude Code sessions on the host machine, with session management and filesystem access.4MIT
- AlicenseCqualityDmaintenanceBridges MCP clients with local Codex CLI to execute autonomous coding tasks, manage threads, and inspect history via SQLite state.13577 npm4Apache 2.0
- FlicenseNot gradedqualityCmaintenanceEnables ISLI agents and MCP clients to dispatch natural-language coding and terminal tasks to a locally-installed Claude Code CLI, supporting both one-shot execution and persistent sessions with workspace and security controls.-
- AlicenseAqualityBmaintenanceLocal MCP bridge that lets Codex operate local Claude Code sessions, including listing, starting, resuming, forking, prompting, and stopping conversations via the Remote Control CLI.14MIT