Skip to main content
Glama

Codex MCP

A lightweight Model Context Protocol (MCP) server that exposes the local Codex CLI (codex) to MCP-compatible coding agents.

The project intentionally keeps the architecture small: MCP tools validate inputs, a thin CLI adapter executes codex exec (and friends), and codex_raw provides an escape hatch for CLI options that are added in future Codex releases.

Features

  • Run Codex as a local coding agent through MCP (codex exec).

  • Run non-interactive code reviews (codex exec review).

  • Resume or fork previous sessions (codex exec resume / codex exec fork).

  • Control common CLI options such as model, sandbox policy, approval behavior, extra directories, images, and output handling.

  • Inspect version, login status, and diagnostics (codex doctor).

  • Pass arbitrary CLI arguments through codex_raw for forward compatibility.

  • No shell execution: arguments are passed directly to the codex process (shell: false).

  • Optional server-wide model override via an environment variable (see below).

Related MCP server: codex-mcp-server

Requirements

  • Node.js 18+

  • Codex CLI installed and authenticated (codex login)

  • codex available on PATH

  • An MCP-compatible client

If codex is not on PATH, set CODEX_MCP_CMD to the executable path.

CODEX_MCP_CMD=/custom/path/codex

Windows PowerShell:

$env:CODEX_MCP_CMD = "C:\path\to\codex.exe"

Forcing a specific model

Every tool that runs the agent (codex_run, codex_review, codex_resume, codex_fork, and codex_raw when its first argument is exec) accepts a model input. If you set the CODEX_MCP_MODEL environment variable on the MCP server process, it overrides the model for every such call, regardless of what the caller (or a raw argument list) requests. This is useful when you want to pin the server to a single model — for cost control, quota limits, or consistency — no matter what any individual tool call asks for.

CODEX_MCP_MODEL=your-model-id

The override is applied last, after stripping any -m/--model flag or -c model=... config override already present in the constructed arguments, so it always wins. It is never applied to subcommands that don't accept a model (--version, login status, help, doctor, ...), so those keep working normally even when the override is set.

Quick Start

The recommended setup is through npm. You do not need to clone this repository or install the MCP server manually.

Claude Code

claude mcp add --scope user codex -- npx -y codex-mcp

Verify the server:

claude mcp list

If codex is not on PATH, or you want to pin the model:

claude mcp add --scope user \
  --env CODEX_MCP_CMD=/custom/path/codex \
  --env CODEX_MCP_MODEL=your-model-id \
  codex -- npx -y codex-mcp

Gemini CLI

gemini mcp add --scope user codex npx -y codex-mcp

Verify:

gemini mcp list

Cursor

{
  "mcpServers": {
    "codex": {
      "command": "npx",
      "args": ["-y", "codex-mcp"]
    }
  }
}

Windsurf

{
  "mcpServers": {
    "codex": {
      "command": "npx",
      "args": ["-y", "codex-mcp"]
    }
  }
}

Cline / Roo Code / Other MCP Clients

{
  "command": "npx",
  "args": ["-y", "codex-mcp"]
}

If the client supports environment variables, CODEX_MCP_CMD and CODEX_MCP_MODEL can be set there as well.

Local Development

git clone https://github.com/alvarosw/codex-mcp.git
cd codex-mcp
npm install
npm start

No build step is required.

Testing

npm test runs a static syntax check only — it makes no network calls and costs nothing.

npm run test:live drives the real MCP server end to end over stdio against a real, authenticated Codex CLI (in a throwaway temp git repo it creates and cleans up). It exercises every tool, including verifying that CODEX_MCP_MODEL (if set) wins over a deliberately wrong model passed in a tool call or smuggled into codex_raw arguments. This makes real model calls and is not run automatically — you need codex login completed first, and it will consume real quota/tokens against whichever model resolves for the call:

CODEX_MCP_MODEL=your-model-id npm run test:live

CODEX_MCP_MODEL is optional for this script; without it, the override-specific assertions are skipped and the rest of the suite still runs against your account's default configured model.

Tools

codex_run

Run Codex as an agent non-interactively (codex exec) with common CLI controls: prompt, model, sandbox policy, approval routing, extra directories, images, working directory, ephemeral/persisted sessions, and raw passthrough args.

Example:

{
  "prompt": "Review the authentication implementation and identify security issues.",
  "cwd": "/workspace/project",
  "sandbox": "workspace-write",
  "addDirs": ["/workspace/shared"]
}

codex_review

Runs codex exec review non-interactively against the current repository. Supports uncommitted, base, commit, and title, plus a custom review prompt.

codex_resume

Resumes a previous session (codex exec resume) by sessionId, or the most recent one if omitted, optionally sending a new prompt.

codex_fork

Forks a previous session (codex exec fork) by sessionId into a new session, optionally sending a prompt.

codex_version

Returns the installed Codex CLI version.

codex_login_status

Runs codex login status to check authentication state.

codex_doctor

Runs codex doctor --json for install, auth, config, and connectivity diagnostics.

codex_help

Shows CLI help. A command can be provided for command-specific help.

codex_raw

Runs codex with an arbitrary argument array. This is the compatibility escape hatch for flags or commands not covered by the convenience tools. The model override, if set, still applies when the first argument is exec.

Example:

{
  "args": ["mcp", "list"]
}

Architecture

src/
├── index.js   # MCP server and tool registration
├── tools.js   # Tool behavior and response formatting (JSONL event parsing)
└── codex.js   # Thin process adapter for the codex CLI + model-override enforcement

Dependency direction:

MCP transport
    ↓
tool handlers
    ↓
codex CLI adapter
    ↓
local codex executable

There is intentionally no service container, repository layer, or framework abstraction. The project has one external process boundary and keeps that boundary explicit.

Tools that invoke codex exec* request --json internally so output can be parsed reliably; each tool's text response is the agent's final message(s), with the full parsed event stream, command executions, token usage, and thread id available in structuredContent for programmatic consumers.

Security Notes

codex_raw can execute arbitrary Codex CLI arguments with the permissions of the user running the MCP server. The server itself does not invoke a shell, so tool arguments are not shell-interpreted, but codex still has whatever permissions its sandbox and approval settings grant it.

dangerouslyBypassApprovalsAndSandbox skips all confirmation prompts and sandboxing. Only use it when you explicitly trust the task and an already-isolated workspace.

Environment variables passed through the env field are inherited by the codex process. Avoid sending secrets through MCP tool arguments unless necessary.

License

MIT

Available Tools

9 tools
codex_doctorA

Run Codex's built-in diagnostics (codex doctor --json): install, auth, config, and connectivity health.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
timeoutMsNoProcess timeout in milliseconds.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full behavioral burden. It concretely states that a subprocess command (`codex doctor --json`) is executed and what areas it checks, which is useful transparency. However, it does not disclose whether the command is read-only, whether it accesses credentials or network endpoints, or what failure modes may occur.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence with the action front-loaded and the health categories listed efficiently. There is no filler, redundancy, or repetition of information already present in the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The core purpose and command are clear, and the schema covers the parameters, but there is no output schema or annotation help. The description does not explain the shape of the returned JSON, exit behaviors, or potential side effects, so an agent is left to infer some important runtime context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters (cwd, env, timeoutMs) are already fully documented in the schema. The description adds no parameter-specific meaning, which is acceptable given the high schema coverage, but it also does not improve on it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the exact command (`codex doctor --json`) and the resource it operates on: Codex built-in diagnostics. It also enumerates the health domains (install, auth, config, connectivity), making it clearly distinct from siblings like codex_run or codex_login_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies that this tool is for diagnosing Codex installation, auth, config, and connectivity issues, which gives the agent a clear signal about when it might be relevant. However, it does not explicitly state when to choose it over alternatives like codex_login_status or codex_help, nor does it mention when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_forkB

Fork a previous Codex session (codex exec fork) into a new session and optionally send a prompt.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
modelNoModel the agent should use. May be forced by the server's model-override environment variable.
promptNoOptional prompt to send after forking.
ephemeralNoSkip persisting session files to disk. Defaults to true.
extraArgsNoAdditional raw codex CLI arguments appended to the command.
sessionIdYesConversation/session id (UUID) or thread name to fork.
timeoutMsNoProcess timeout in milliseconds.
ignoreRulesNoDo not load user or project execpolicy .rules files.
outputSchemaNoPath to a JSON Schema file describing the expected final response shape.
skipGitRepoCheckNoAllow running outside a Git repository. Defaults to true.
outputLastMessageNoPath to a file where the final agent message should be written.
dangerouslyBypassApprovalsAndSandboxNoSkip all confirmation prompts and sandboxing. Only use in an already-isolated environment.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states that the tool forks a session and optionally sends a prompt. It does not mention side effects (e.g., whether the original session is preserved, whether the new session is persisted), required permissions, network access, or what the response looks like. For a tool with 13 parameters and no annotations, this is a significant gap in transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that front-loads the primary action and its optional variation. It is efficient and avoids redundancy. However, given the complexity of the tool (13 parameters, no annotations, no output schema), one might argue it is too terse, but as a statement of purpose it is concise without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 13 parameters, no annotations, and no output schema, the description is far too minimal. It explains only the core function and does not cover return values, edge cases, side effects, or any operational context (e.g., when to set ephemeral, how the fork interacts with session persistence). An agent would have to rely entirely on the schema and trial-and-error to use this tool correctly, which is inadequate for a complex operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 100% of parameters with descriptions, so the baseline is 3. The description adds marginal value by mentioning the 'prompt' parameter ('optionally send a prompt'), which aligns with the schema. However, it does not provide additional context for other parameters (e.g., ephemeral, skipGitRepoCheck, dangerouslyBypassApprovalsAndSandbox) beyond what the schema already offers. The description neither compensates for any gaps nor enriches the schema's meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to fork a previous Codex session into a new session, optionally sending a prompt. It uses a specific verb ('fork'), identifies the resource (a Codex session), and distinguishes itself from siblings like codex_resume and codex_run by its focus on forking rather than resuming or running fresh. The reference to `codex exec fork` also anchors the behavior precisely.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus its siblings (e.g., when to fork versus resume versus run). While the purpose is clear, it does not state conditions like 'use when you want a new session derived from an existing one' or contrast with codex_resume. The usage context is implied by the name and description but not spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_helpB

Show Codex CLI help, optionally for a specific subcommand.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
commandNo
timeoutMsNoProcess timeout in milliseconds.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavior. It states the core action but does not mention output format, side effects, or handling of missing or invalid subcommands; it is acceptable for a low-risk help tool but still thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no redundant material. Every word contributes meaning, and it is immediately scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is sufficient for a simple no-argument invocation, but omits details like default behavior, output shape, and invalid-subcommand handling. Combined with the sparse description of 'command' and no output schema, some edge cases are left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents cwd, env, and timeoutMs, and the description adds that a subcommand is optional. However, it does not explain the expected format or values for the undocumented 'command' property, leaving a notable gap at 75% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a concrete verb ('Show') and names the exact resource ('Codex CLI help'), while also noting the optional subcommand behavior. It is clear on its own, though it does not explicitly contrast with sibling tools like codex_run or codex_review.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to choose help over the sibling tools or when to omit the subcommand. Usage is only implied by the word 'help,' leaving the agent to infer the triggering context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_login_statusB

Check Codex CLI authentication status (codex login status).

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
timeoutMsNoProcess timeout in milliseconds.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosing behavior. It only says 'check authentication status' and the underlying command, but it does not state whether the operation issues a network request, what its output looks like, whether it mutates state, or what happens when authentication is missing. This is minimal disclosure of behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It communicates the operation and the exact command reference in a compact form. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Overall the tool shape is very simple: no required parameters, one clear purpose, and a generic schema. However, the description gives no indication of the response shape or success/failure semantics, and there is no output schema and no annotations to compensate. An agent can safely invoke it but may not know how to interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all parameters (cwd, env, timeoutMs) with descriptions, so the baseline is 3. The description adds no parameter-level detail, but also none is needed because these are generic process-control parameters already well explained by the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: 'Check Codex CLI authentication status'. It also refers to the exact underlying command (`codex login status`), which leaves no ambiguity about what the tool does. The purpose is distinct from siblings like codex_review, codex_run, and codex_doctor.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explain when an agent should call this tool instead of a sibling. No prerequisites, intended scenarios, or exclusions are provided. The usage context is left entirely to inference from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_rawA

Run the Codex CLI with an arbitrary argument array. Escape hatch for options not covered by the other tools. The server's model-override environment variable, if set, still applies.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
argsYes
timeoutMsNoProcess timeout in milliseconds.

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must carry the full disclosure burden. It reveals only that a model-override env var still applies. It does not mention that executing arbitrary arguments may have side effects, security implications, or that the process output/error format is. This is a significant gap for an escape-hatch tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, with the primary purpose front-loaded and the escape-hatch positioning in the second sentence. Every word earns its place; no fluff or redundant detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the tool's raw nature, the description is incomplete for an agent that must call it safely. It does not state what the tool returns (stdout, exit code, etc.), whether it is synchronous, or warn about the risk of passing arbitrary args. Given no output schema and no annotations, more context is needed for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75% (only args lacks a description). The description adds minimal meaning beyond the schema: 'arbitrary argument array' clarifies the args type but does not explain cwd, env, or timeoutMs further. Since coverage is high and the description contributes a small extra for args, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb-resource pair ('Run the Codex CLI') with a specific scope ('arbitrary argument array') and positions itself as an escape hatch relative to the other sibling tools. This distinguishes it from codex_run and the rest without needing to inspect schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to use it when 'options not covered by the other tools' are needed. This gives a direct condition for selection, though it does not name specific sibling tools or give excluded use cases. Still, the core guidance is unambiguous and useful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_resumeB

Resume a previous Codex session non-interactively (codex exec resume) and optionally send a new prompt.

ParametersJSON Schema
NameRequiredDescriptionDefault
allNoSearch across all directories, not just the current one.
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
modelNoModel the agent should use. May be forced by the server's model-override environment variable.
promptNoPrompt to send after resuming the session.
ephemeralNoSkip persisting session files to disk. Defaults to true.
extraArgsNoAdditional raw codex CLI arguments appended to the command.
sessionIdNoConversation/session id (UUID) or thread name. Omit to resume the most recent session.
timeoutMsNoProcess timeout in milliseconds.
ignoreRulesNoDo not load user or project execpolicy .rules files.
outputSchemaNoPath to a JSON Schema file describing the expected final response shape.
skipGitRepoCheckNoAllow running outside a Git repository. Defaults to true.
outputLastMessageNoPath to a file where the final agent message should be written.
dangerouslyBypassApprovalsAndSandboxNoSkip all confirmation prompts and sandboxing. Only use in an already-isolated environment.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral disclosure burden. It only reveals that execution is non-interactive and that a new prompt may be sent; it does not disclose side effects, whether code may be executed, sandbox implications, or what happens to the resumed session. For a tool with a destructive-looking bypass parameter, this is a significant transparency gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single efficient sentence with no filler, and it front-loads the core operation and command. It earns its place, though it is so sparse that it leaves important behavioral and usage context unaddressed, which prevents a perfect conciseness score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a 14-parameter tool with no annotations, no output schema, and a one-sentence description. The description does not explain session selection defaults, output location, process behavior, safety posture, or relationship to the many sibling tools, so it is not complete enough for an agent to invoke it confidently in varied contexts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides 100% coverage of all 14 parameters with meaningful descriptions, so the baseline is 3. The description itself adds very little parameter-specific meaning beyond the 'new prompt' idea, but it does not need to because the schema already documents each parameter well.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Resume a previous Codex session non-interactively' and even names the underlying command `codex exec resume`. It is clearly distinct from sibling tools by mentioning 'previous session,' but it does not explicitly contrast itself with codex_run or codex_fork, so it falls just short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it: when resuming a previous Codex session rather than starting a new one. However, it gives no explicit guidance about when not to use it or when to prefer a sibling tool such as codex_run or codex_fork, so the usage context is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_reviewB

Run a non-interactive Codex code review (codex exec review) against the current repository.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
baseNoReview changes against the given base branch.
modelNoModel the agent should use. May be forced by the server's model-override environment variable.
titleNoOptional commit title to display in the review summary.
commitNoReview the changes introduced by a single commit.
promptNoCustom review instructions.
ephemeralNoSkip persisting session files to disk. Defaults to true.
extraArgsNoAdditional raw codex CLI arguments appended to the command.
timeoutMsNoProcess timeout in milliseconds.
ignoreRulesNoDo not load user or project execpolicy .rules files.
uncommittedNoReview staged, unstaged, and untracked changes.
outputSchemaNoPath to a JSON Schema file describing the expected final response shape.
skipGitRepoCheckNoAllow running outside a Git repository. Defaults to true.
outputLastMessageNoPath to a file where the final agent message should be written.
dangerouslyBypassApprovalsAndSandboxNoSkip all confirmation prompts and sandboxing. Only use in an already-isolated environment.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose that the operation is non-interactive and scoped to the current repository, but it omits output behavior, side effects, and runtime characteristics such as session persistence or long-running process behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler. It communicates the essential operation efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite a fully documented schema, this is a complex 16-parameter external-process tool with no annotations and no output schema. The description does not explain what the review returns, how to interpret results, or what side effects to expect, leaving significant gaps for an agent deciding whether and how to invoke it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already fully documented. The description adds no parameter-level meaning, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the exact underlying command (`codex exec review`), the target (current repository), and the execution mode (non-interactive). This clearly differentiates it from siblings like codex_run and codex_raw.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The use case is implied by the phrase 'code review', and the non-interactive qualifier suggests automated scenarios, but there is no explicit when-to-use/when-not-to-use guidance or named alternatives. An agent must infer the choice from the tool name and sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_runB

Run the Codex agent non-interactively (codex exec) with common CLI controls.

ParametersJSON Schema
NameRequiredDescriptionDefault
cdNoDirectory codex should treat as its working root (--cd).
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
modelNoModel the agent should use. May be forced by the server's model-override environment variable.
imagesNoImage file paths to attach to the prompt.
promptYesTask for the Codex agent.
addDirsNoAdditional directories to expose to the agent (--add-dir).
sandboxNoSandbox policy for model-generated shell commands.
ephemeralNoSkip persisting session files to disk. Defaults to true.
extraArgsNoAdditional raw codex CLI arguments appended to the command.
timeoutMsNoProcess timeout in milliseconds.
ignoreRulesNoDo not load user or project execpolicy .rules files.
approveForMeNoRoute approval requests through automatic review using the workspace-write sandbox.
outputSchemaNoPath to a JSON Schema file describing the expected final response shape.
skipGitRepoCheckNoAllow running outside a Git repository. Defaults to true.
outputLastMessageNoPath to a file where the final agent message should be written.
dangerouslyBypassApprovalsAndSandboxNoSkip all confirmation prompts and sandboxing. Only use in an already-isolated environment.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden of behavioral disclosure. It discloses that the tool runs non-interactively and exposes 'common CLI controls', but it does not mention side effects like file modifications, sandbox behavior, approval routing, or the fact that `dangerouslyBypassApprovalsAndSandbox` exists. The schema provides some parameter-level behavior, but the description itself adds minimal behavioral context beyond the mode of execution.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is concise and front-loads the core purpose. It could add a bit more context about when to use it, but it is not bloated and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (17 parameters, no output schema, no annotations), the description is thin. It doesn't explain return values, side effects, or how the tool relates to codex_raw and codex_review. The schema covers parameters, but the description doesn't provide enough operational context for an agent to know what happens when the tool runs or what the output will look like.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 17 parameters. The description adds no parameter-level meaning beyond what the schema provides. Baseline 3 is appropriate because the schema does the heavy lifting and the description doesn't need to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Run'), a specific resource ('the Codex agent'), and the mode ('non-interactively (`codex exec`)'), which clearly distinguishes it from interactive or review-oriented siblings. It doesn't explicitly name sibling alternatives, but the mention of `codex exec` and 'common CLI controls' gives enough specificity to separate it from codex_review, codex_resume, and codex_raw.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: run the Codex agent non-interactively with CLI controls. It does not explicitly state when to use this tool versus codex_raw, codex_review, or codex_resume. The phrase 'common CLI controls' hints that codex_raw is for raw/advanced usage, but no explicit when/when-not guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_versionA

Return the installed Codex CLI version.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the codex process.
envNoAdditional environment variables for codex.
timeoutMsNoProcess timeout in milliseconds.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the behavioral transparency burden. It states the observable outcome (returning the version) but does not disclose execution details such as spawning a process, potential failures when Codex is not installed, or the output format. For a simple read-only version check this is acceptable but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single clear sentence with no filler. It is front-loaded with the action and object, making it immediately scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple version-check tool with no required parameters and a fully documented schema, the description is nearly complete. It lacks only minor context such as error behavior when the CLI is missing, but nothing essential to invoking the tool correctly is omitted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all three parameters (cwd, env, timeoutMs). The description adds no additional parameter semantics, which aligns with the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and object: 'Return the installed Codex CLI version.' This clearly distinguishes it from the sibling tools, none of which are about version reporting.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied: call this tool when you need to know the installed Codex CLI version. However, the description does not explicitly state when to use it versus alternatives or provide any exclusions, so it stops at implied guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 9 tool updatesv1.0.0
    • First observedcodex_doctor
    • First observedcodex_fork
    • First observedcodex_help
    • First observedcodex_login_status
    • First observedcodex_raw
    • First observedcodex_resume
    • First observedcodex_review
    • First observedcodex_run
    • First observedcodex_version

TDQS

A3.6/5.0

Scored across 9 tools

Disambiguation4/5

Tools are mostly distinct: review, resume, run, and fork each target specific Codex execution modes, while version, login_status, doctor, help, and raw cover ancillary actions. There is slight overlap between run, resume, and fork, but descriptions clarify the differences effectively.

Naming Consistency4/5

All tools share the consistent codex_ prefix and snake_case naming. The second part is a mix of verbs (review, resume, run, fork) and nouns (version, login_status, doctor, help, raw), but the overall pattern is predictable and readable, with minor deviation from a strict verb_noun convention.

Tool Count5/5

With 9 tools, the set is well-scoped for a CLI wrapper server. It covers primary execution modes, status checks, diagnostics, help, and an escape hatch without unnecessary bloat. The count falls comfortably in the ideal 3-15 range.

Completeness4/5

The surface covers the main Codex workflows (run, review, resume, fork) and essential auxiliary actions (version, status, doctor, help). The codex_raw tool provides an arbitrary argument escape hatch, mitigating gaps for uncovered CLI options. Minor omissions like explicit auth configuration are not critical due to raw access.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers