Review git changes (paid)
codex_review_changesGet an independent code review of your git changes from Codex, covering working tree, branch, or commit diffs.
Instructions
Ask Codex (a different model) to review your git changes for an independent second opinion.
PAID — this spends Codex quota on every new call; use codex_dry_run or codex_status (both free) first if you only need to check scope or readiness.
scope: working_tree (tracked changes vs HEAD — untracked files follow the
untracked policy and are NOT reviewed by default), branch (needs base, reviews
base...HEAD), or commit (needs a commit SHA). The diff is gathered, secret-
redacted, and bounded by this server; Codex reviews it read-only and returns
structured findings. Pass workspace_root (absolute) for the right repo. Optional
extra_context (author intent, bounded like the diff) cuts false positives.
The result's top-level review_status and coverage disclose whether the model
actually ran and what it was shown: a pass over partial coverage is surfaced as
unknown, and a tree with nothing reviewable returns not_run, never a pass.
STATIC review, not a verify mode: the read-only sandbox blocks the writes a test/build/lint run needs, so Codex can't run the project's checks to confirm its findings — treat them as unvalidated claims you verify yourself before acting.
Data egress: this sends the gathered diff to OpenAI via the codex CLI. The diff is
secret-redacted (best-effort), but your extra_context is sent raw (unredacted),
and Codex may read and send other repo files. Codex auto-loads the resolved
workspace's AGENTS.md and discovers skills in its .agents/skills/ and
user-global $CODEX_HOME/skills/ (default ~/.codex/skills/), reachable from
outside the workspace. The plugin's isolation flags don't suppress any of it. A
selected skill's body can reach the model even if your prompt never mentions it.
Redaction is not a guarantee. Do not rely on it to protect live credentials; keep
them out of the reviewed tree and your supplied inputs, or do not request a review
of that tree.
Progress & recovery: blocks up to the resolved deadline (timeout_seconds, clamped
10-600s; when omitted, the server-configured value, built-in default 300s). If that deadline
expires the run is terminated and its partial output is not recoverable or resumable, so for a
multi-file or whole-branch review that may exceed it, prefer codex_review_changes_async (a
background job, built-in default 1800s deadline; poll codex_job_status). Coarse
notifications/progress streams while it blocks when your client requests it; some MCP
clients background a long call before the deadline, so timeout_seconds bounds the run, not
necessarily the inline wait — either way the detached run (meta.job_id) is recoverable via
codex_job_list→codex_job_status→codex_job_result.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Base git ref for scope='branch'; the review covers base...HEAD. | |
| model | No | Override the Codex model slug for this call; defaults to the server/Codex default when unset. | |
| paths | No | Repo-relative paths to narrow the review ('/' separators, no '..'); omit to review all changes in scope. | |
| scope | No | Which changes to review: 'working_tree' (tracked changes vs HEAD; untracked files follow the `untracked` policy, off by default), 'branch' (needs base), or 'commit' (needs commit). | working_tree |
| commit | No | Commit SHA or ref to review for scope='commit'. | |
| detail | No | Response verbosity: 'summary' (default) omits the raw model text; 'full' includes it. | summary |
| isolation | No | Codex config isolation: 'inherit' | 'ignore-config' | 'ignore-rules'. Defaults to the server's configured value (built-in 'inherit'; `codex_status` reports the resolved one). | |
| untracked | No | How working_tree scope treats untracked files: 'explicit_only' (default) includes only those named in `paths`; 'include' reviews all non-ignored untracked files (SENDS their contents to OpenAI — opt-in egress); 'exclude' includes none. Omitted ones are disclosed in `coverage`. Inert for branch/commit scopes. | explicit_only |
| extra_context | No | Optional author intent/background context, added as clearly-labeled UNTRUSTED prompt data. Redaction does NOT cover it — no live secrets. Full caveats and bounds: codex://params. | |
| workspace_root | No | Absolute path to the target repo root — pass it (or an MCP root) to target the intended repo; otherwise the call falls back to the server's own cwd and sets meta.workspace_warning. | |
| idempotency_key | No | Optional dedup key scoped to THIS tool + workspace. Same key + same args replays the prior result with no new spend; different args are refused (idempotency_conflict). Sync and _async are separate tools and never share a key. Omit for none; retention is bounded. Lifecycle: codex://params. | |
| timeout_seconds | No | Per-call wall-clock timeout in seconds, clamped to 10..600 (out-of-range values are coerced, not rejected). Defaults to the server's configured timeout. | |
| reasoning_effort | No | Override the Codex reasoning effort for this call (a model_reasoning_effort override); omit or pass null for the server default (CODEX_IN_CLAUDE_REASONING_EFFORT) or Codex's own resolution. An open, per-model string the backend validates at run time — commonly minimal|low|medium|high|xhigh; codex_models lists each model's advertised set (advisory). Rejection and bounds detail: codex://params. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| ok | Yes |