Review git changes (paid)
codex_review_changesSubmit a git working tree, branch, or commit diff to Codex for an independent second-opinion review and structured findings.
Instructions
Deprecated: use amicus_review_changes. Ask Codex (a different model) to review your git changes for an independent second opinion.
PAID — this spends Codex quota on every new call; use codex_dry_run or codex_status (both free) first if you only need to check scope or readiness.
scope: working_tree (tracked changes vs HEAD — untracked files follow the
untracked policy and are NOT reviewed by default), branch (needs base, reviews
base...HEAD), or commit (needs a commit SHA). The diff is gathered, secret-
redacted, and bounded by this server; Codex reviews it read-only and returns
structured findings. Pass workspace_root (absolute) for the right repo. Optional
extra_context (author intent, bounded like the diff) cuts false positives.
The result's top-level review_status and coverage disclose whether the model
actually ran and what it was shown: a pass over partial coverage is surfaced as
unknown, and a tree with nothing reviewable returns not_run, never a pass.
STATIC review, not a verify mode: the read-only sandbox blocks the writes a test/build/lint run needs, so Codex can't run the project's checks to confirm its findings — treat them as unvalidated claims you verify yourself before acting.
Data egress: this sends the gathered diff to OpenAI via the codex CLI. The diff is
secret-redacted (best-effort), but your extra_context and
developer_instructions are sent raw (unredacted).
Codex can read files outside the workspace — up to everything the OS user running it can
read — and send them to OpenAI. The sandbox bounds writes, not reads, so no choice of
workspace is a read boundary. Codex auto-loads the resolved workspace's
AGENTS.md and, in a repository, ancestor AGENTS.md files through its root, plus a
user-global $CODEX_HOME/AGENTS.override.md, else $CODEX_HOME/AGENTS.md; it discovers
skills in the
workspace's .agents/skills/ and user-global $CODEX_HOME/skills/ (default
~/.codex/skills/), reachable from outside the workspace. The plugin's isolation flags
don't suppress any of it.
A skill's name and description arrive up front; selecting one makes the model read
its body, which can reach OpenAI even if your inputs never mention it.
Redaction is not a guarantee. Do not rely on it to protect live credentials; keep
them out of the reviewed tree and your supplied inputs, or do not request a review
of that tree.
Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped
10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline
expires the run is terminated and its partial output is not recoverable or resumable, so for a
multi-file or whole-branch review that may exceed it, prefer codex_review_changes_async (a
background job, built-in default 1800s deadline; poll codex_job_status). Coarse
notifications/progress streams while it blocks when your client requests it; some MCP
clients background a long call before the deadline, so timeout_seconds bounds the run, not
necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via
codex_job_list→codex_job_status→codex_job_result.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Base git ref for scope='branch'; the review covers base...HEAD. Control characters are rejected, not stripped. | |
| model | No | Override the Codex model slug for this call; defaults to the server/Codex default when unset. Control characters are rejected, not stripped. | |
| paths | No | Repo-relative paths to narrow the review ('/' separators, no '..'); omit to review all changes in scope. | |
| scope | No | Which changes to review: 'working_tree' (tracked changes vs HEAD; untracked files follow the `untracked` policy, off by default), 'branch' (needs base), or 'commit' (needs commit). | working_tree |
| commit | No | Commit SHA or ref to review for scope='commit'. Control characters are rejected, not stripped. | |
| detail | No | Response verbosity: 'summary' (default) omits the raw model text; 'full' includes it. | summary |
| isolation | No | Codex config isolation: 'inherit' | 'ignore-config' | 'ignore-rules'. Defaults to the server's configured value (built-in 'inherit'; `codex_status` reports the resolved one). | |
| untracked | No | How working_tree scope treats untracked files: 'explicit_only' (default) includes only those named in `paths`; 'include' reviews all non-ignored untracked files (SENDS their contents to OpenAI — opt-in egress); 'exclude' includes none. Omitted ones are disclosed in `coverage`. Inert for branch/commit scopes. | explicit_only |
| extra_context | No | Optional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: codex://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it (or an MCP root) to target the intended repo; otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. On an active call it selects where Codex works, not what it can read — it is not a read boundary. | |
| idempotency_key | No | Optional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: codex://params. | |
| timeout_seconds | No | Per-call wall-clock timeout in seconds, clamped to 10..600 (out-of-range values are coerced, not rejected). Defaults to the server's configured timeout. | |
| reasoning_effort | No | Override the Codex reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (CODEX_IN_CLAUDE_REASONING_EFFORT) or Codex's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; codex_models lists each model's advertised set (advisory). Rejection and bounds detail: codex://params. | |
| developer_instructions | No | Optional caller stance/focus text for Codex's developer turn, placed BEHIND this server's always-leading framing; omit for no developer override. UNTRUSTED — never build it from workspace content; grants no tools; Codex is instructed, not compelled — verdicts stay its own, and compliance with the rest is best-effort and may be silent. Rides the codex command line and the background-job record on disk — never put secrets here; meta reports only {sha256, bytes}. Stripped; blank = omitted; max 4096 bytes. Full contract: codex://params. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ok | Yes |