mcp-server-codex
Provides tools for driving the OpenAI Codex CLI locally, including running and resuming agent sessions, forking threads, reviewing code, applying diffs, and generating images.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-server-codexReview my uncommitted changes and flag any issues"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-server-codex
Serveur MCP (Model Context Protocol) en TypeScript pour piloter le CLI Codex localement : lancer des sessions d'agent, les reprendre, les bifurquer, faire des revues de code, appliquer des diffs et générer des images — le tout depuis n'importe quel client MCP (Claude Code, Claude Desktop, Codex lui-même…).
Le code, les identifiants et les messages d'erreur sont en anglais : ils sont lus par des agents. La documentation est en français.
Ce que ça fait
Le CLI Codex est conçu pour un humain devant un terminal. Ce serveur le rend pilotable par un agent :
Il force
--jsonpartout et parse le flux JSONL en résultats structurés.Il gère les runs longs sans faire tomber l'appel d'outil (voir Exécution hybride).
Il restreint ce que Codex peut toucher sur le disque.
Il expose la génération d'images, que Codex n'offre pas comme service appelable.
Related MCP server: codex-mcp-server
Prérequis
Outil | Rôle | Installation Windows |
Codex CLI ≥ 0.154 | le binaire piloté |
|
Node.js ≥ 22.0 | exécution du serveur (≥ 22.18 pour développer) |
|
git |
|
|
Vous devez être authentifié côté Codex (codex login). Le serveur n'a besoin d'aucune clé API, y compris pour les images.
⚠️ La version de Codex publiée sur winget est en retard sur celle de npm. Ce serveur est écrit contre le comportement de la 0.154 (voir Notes d'implémentation). Préférez npm. Un Codex installé par npm n'apparaît pas dans
winget list: évitez de mélanger les deux voies, sous peine d'avoir deux binaires concurrents dans lePATH. En cas de doute, pointezCODEX_BINsur le bon exécutable.
Installation
npm install
npm run buildConfiguration client
Claude Code
claude mcp add codex -- node C:/chemin/vers/mcp-server-codex/dist/index.jsClaude Desktop / configuration JSON générique
{
"mcpServers": {
"codex": {
"command": "node",
"args": ["C:/chemin/vers/mcp-server-codex/dist/index.js"],
"env": {
"CODEX_MCP_ALLOWED_ROOTS": "C:/projets/mon-app",
"CODEX_MCP_DEFAULT_SANDBOX": "workspace-write"
}
}
}
}Le serveur parle stdio. Tous ses diagnostics vont sur stderr : stdout transporte le protocole et écrire dedans corromprait la session.
Variables d'environnement
Variable | Défaut | Rôle |
|
| Chemin ou nom du binaire Codex. |
|
| Racine Codex : sessions et images générées y sont lues. |
| cwd du serveur | Répertoires autorisés, séparés par |
|
| À |
|
| Sandbox par défaut : |
|
| Attente avant bascule en arrière-plan. |
|
| Taille du tampon d'événements par job. |
|
| Durée de consultation d'un job terminé. |
Une valeur invalide fait échouer le démarrage (code 78) plutôt que de retomber silencieusement sur un défaut : une faute de frappe ne doit pas devenir une politique de sécurité différente de celle demandée.
Exécution hybride
Un run Codex dure de quelques secondes à plusieurs dizaines de minutes, alors que les clients MCP coupent les appels d'outil bien avant. Chaque outil d'exécution fait donc la course contre son propre timeout_seconds :
il finit à temps → résultat complet en un aller-retour ;
le délai expire → le processus continue, l'appel rend un
job_idimmédiatement.
Le délai n'annule jamais le run : perdre dix minutes de travail du modèle à cause d'une échéance arbitraire du client est précisément ce que ce design évite.
codex_exec { prompt: "…", timeout_seconds: 60 }
└─ dépassement → { job_id: "job-3-a1b2", mode: "background", thread_id: "…" }
├─ codex_job_status { job_id }
├─ codex_job_logs { job_id, since: 42 } ← pagination par curseur
└─ codex_job_cancel { job_id } ← SIGTERM puis SIGKILLLes jobs vivent le temps de la session MCP.
Outils
Outil | Rôle |
| Nouvelle session Codex sur un prompt. Rend le message final, les commandes exécutées et un |
| Reprend une session avec tout son historique ( |
| Bifurque une session existante, l'originale reste intacte. |
| Revue de code : |
| Applique le dernier diff d'une tâche Codex ( |
| Liste les sessions enregistrées. Lecture disque, aucun processus lancé. |
| Génère une image et l'écrit sur disque. |
| État d'un run passé en arrière-plan. |
| Événements JSONL paginés d'un job, filtrables par type. |
| Arrête un run en cours. |
Les outils d'exécution acceptent en commun : cwd, model, sandbox, images, config, enable, disable, output_schema, worktree, ephemeral, skip_git_repo_check, timeout_seconds.
Génération d'images
{
"prompt": "un robot bleu, style plat minimaliste",
"output_path": "assets/robot.png",
"use_case": "logo-brand",
"size": "1024x1024",
"transparent": true,
"constraints": "pas de texte, pas de watermark"
}L'outil renvoie le chemin du fichier, pas les octets : un PNG de 850 Ko pèse ~1,1 Mo en base64 et saturerait le contexte de l'agent appelant.
Codex n'expose aucun service de génération d'images : le protocole app-server contient ImageGenerationThreadItem comme type d'événement mais aucune méthode RPC image/*, et il n'existe pas de sous-commande codex image. Le seul accès est agentique — le modèle décide d'appeler son outil interne image_gen, guidé par la skill système imagegen. Ce serveur en tire deux conséquences :
Le prompt est composé, pas transmis tel quel. La skill attend une spécification étiquetée (
Use case:,Primary request:,Constraints:…) ; lui donner du texte brut dégrade nettement le résultat.Le fichier doit être retrouvé.
image_genn'émet aucun item JSONL : le flux d'événements ne dit jamais où l'image a atterri. Le serveur vérifie doncoutput_path, puis se rabat sur$CODEX_HOME/generated_images/<thread_id>/et y copie le fichier le plus récent. Si les deux échouent, il le dit explicitement plutôt que de renvoyer un chemin fantôme.
Sécurité
L'installation d'un serveur MCP donne à un agent la capacité d'exécuter du code sur votre machine. Les défauts sont donc restrictifs :
Allowlist de répertoires. Tout
cwd,add_dir,images,output_schemaetoutput_pathest résolu en chemin réel — liens symboliques compris — puis vérifié comme descendant d'une racine autorisée. Un chemin refusé l'est avant tout lancement de processus : un appel rejeté n'a aucun effet de bord.Sandbox par défaut
workspace-write, approbations surnever(aucun humain n'est là pour répondre ; un refus revient au modèle comme un échec exploitable au lieu de bloquer le run).danger-full-accesset--dangerously-bypass-approvals-and-sandboxsont refusés saufCODEX_MCP_ALLOW_DANGEROUS=1.
Le garde-fou de chemins ne protège pas contre un Codex lancé en danger-full-access : ce mode retire les limites côté Codex lui-même.
Notes d'implémentation
Trois comportements de Codex 0.154, vérifiés empiriquement, façonnent le code :
Seul
codex execaccepte-s/--sandbox,-C/--cd,--add-diret-p/--profile.exec resume,exec forketexec reviewne les ont pas : le sandbox y passe par-c sandbox_mode="…".Le
codex reviewde premier niveau n'a pas--json— seulcodex exec reviewl'a. Toutes les revues passent donc parexec review.Codex lit stdin dès qu'il n'est pas sur un TTY (« Reading additional input from stdin… »). Le prompt est toujours passé via
-sur stdin, puis stdin est refermé. Cela contourne aussi la limite de 8191 caractères de la ligne de commande Windows et tout l'échappement de quotes.
codex resume sans identifiant ouvre un sélecteur TUI, impilotable en MCP : codex_list_sessions lit donc directement $CODEX_HOME/sessions/**/rollout-*.jsonl (source de vérité) et enrichit avec $CODEX_HOME/session_index.jsonl, qui ne contient que les threads nommés. Seule la première ligne de chaque rollout est lue — ces fichiers atteignent couramment des dizaines de méga-octets.
Le parseur JSONL est délibérément tolérant : un item.type inconnu est conservé tel quel plutôt que rejeté, pour qu'une montée de version de Codex dégrade le résumé au lieu de casser le serveur.
CI/CD et publication
Deux workflows GitHub Actions, sans secret à configurer : le GITHUB_TOKEN fourni automatiquement suffit.
ci.yml — à chaque push et pull request sur main
Matrice Node 22 et 24 × Ubuntu et Windows : typecheck, tests, build. Windows n'est pas du zèle — l'allowlist de chemins, la gestion des lettres de lecteur et le contournement de la limite de 8191 caractères sont des comportements spécifiquement Windows.
Un job supplémentaire vérifie le plancher d'exécution : package.json annonce node >= 22.0, ce job construit avec une chaîne récente puis charge le dist/ sous Node 22.0. Les tests ne peuvent pas y tourner (le type stripping exige 22.18), mais la promesse est prouvée au lieu d'être supposée.
release.yml — sur un tag v*
npm version patch # ou minor / major : met à jour package.json et crée le tag
git push --follow-tagsLe workflow rejoue typecheck, tests et build sur l'arbre exact qui va être publié — CI prouve qu'un commit est sain, la release prouve que le tag l'est —, puis publie sur npm.pkg.github.com et crée la GitHub Release avec des notes générées. Un workflow_dispatch permet de rejouer une release à partir d'un tag existant.
Garde-fou de version : si le tag et package.json divergent, la publication échoue avant le npm publish. Une version npm ne pouvant jamais être republiée, une release mal étiquetée serait définitive.
Scope dérivé à la publication. GitHub Packages n'accepte qu'un paquet scopé au compte propriétaire. Plutôt que de figer un owner dans le dépôt — ce qui casserait tout fork —, scripts/github-package.mjs réécrit le nom en @owner/mcp-server-codex au moment de publier, à partir de github.repository_owner, en le passant en minuscules (GitHub conserve la casse des comptes, npm la refuse).
Installer depuis GitHub Packages
Le registre GitHub exige une authentification, même en lecture. Dans le .npmrc du projet consommateur :
@owner:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}avec un token portant le scope read:packages, puis :
npm install @owner/mcp-server-codexDéveloppement
npm test # 194 tests, sans lancer Codex ni consommer de tokens
npm run typecheck
npm run buildLe développement demande Node ≥ 22.18, première version où le type stripping est actif sans drapeau : la suite exécute les .ts directement. Le paquet publié, lui, n'est que du JavaScript compilé et tourne dès Node 22.0 — plancher imposé par execa, qui déclare node >=22 et utilise Set.prototype.union.
Node exécute TypeScript nativement : ni tsx ni ts-node.
L'architecture tient à une couture : toute interaction avec le système passe par CodexRunner (src/codex/runner.ts). Les tests unitaires injectent soit un faux binaire Codex scriptable (test/helpers/fake-codex.mjs, qui exerce le vrai chemin spawn/stdin/streaming/annulation), soit un runner stub piloté à la main pour les scénarios de timeout et d'annulation.
src/
index.ts binaire, transport stdio
runtime.ts racine de composition
server.ts enregistrement MCP des outils
schemas.ts schémas zod (les descriptions sont lues par l'agent appelant)
config.ts environnement et garde-fous
codex/argv.ts pur : options → argv
codex/events.ts pur : JSONL → événements typés → résumé
codex/runner.ts seule couture avec le système
codex/sessions.ts lecture des sessions sur disque
jobs/store.ts registre, tampon circulaire, TTL
jobs/hybrid.ts course run / timeout
security/paths.ts allowlist de racines
tools/ un fichier par outilLicence
MIT
Available Tools
10 toolscodex_applyApply a Codex diffADestructive
Apply the latest diff produced by a Codex task to the local working tree, as a git apply. Modifies files on disk.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Repository to apply into. Must sit inside the server allowlist. | |
| task_id | Yes | Codex task id whose latest diff should be applied with git apply. | |
| timeout_seconds | No | Inline wait before backgrounding. 0 returns immediately. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry destructiveHint=true and readOnlyHint=false, so the description's 'Modifies files on disk' mostly echoes structured metadata. It does add useful operational context ('as a git apply' and 'local working tree'), but it does not disclose possible failure modes like apply conflicts, dirty working trees, or whether changes are staged.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The core action and target are front-loaded, and the side-effect note is kept to one clause. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating tool with no output schema, the description gives the core operation but is thin on surrounding context. It does not mention what happens after apply, how failures or timeouts are surfaced, whether a missing diff is an error, or how an agent should verify the result. Structured fields cover parameters and safety, but an agent still lacks enough operational context to call this confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters (cwd, task_id, timeout_seconds) are already documented in the input schema. The description does not add extra meaning beyond 'latest diff' aligning with task_id, so it stays at the baseline rather than adding new parameter-level insight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Apply'), a specific resource ('the latest diff produced by a Codex task'), and a specific target ('the local working tree... as a git apply'). It clearly distinguishes this from sibling tools like codex_exec or codex_review by focusing on applying an existing diff rather than creating or reviewing one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives context by indicating this applies a task's latest diff to the local tree, but it never explicitly says when to use this tool versus alternatives. With siblings like codex_exec, codex_resume, and codex_review available, an agent gets no direct guidance on sequencing, such as 'use after codex_exec' or 'consider codex_review before applying.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_execRun CodexADestructive
Start a new Codex agent session against a prompt. Codex can read and edit files and run commands in the sandbox. Returns the final message, the commands it ran and a thread_id you can pass to codex_resume. Long runs move to the background and return a job_id.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root. | |
| model | No | Model slug, e.g. "gpt-5.5". Defaults to the Codex configuration. | |
| config | No | Raw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'. | |
| enable | No | Codex feature flags to enable for this run. | |
| images | No | Image files to attach to the prompt. Each must be inside the allowlist. | |
| prompt | Yes | Instructions for the Codex agent. Sent over stdin, so length is unconstrained. | |
| add_dir | No | Extra directories Codex may write to, beyond the working directory. Each must be inside the allowlist. | |
| disable | No | Codex feature flags to disable for this run. | |
| profile | No | Codex config profile to layer on top of the base configuration. | |
| sandbox | No | Sandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1. | |
| worktree | No | Run in a fresh managed git worktree instead of the working directory. | |
| ephemeral | No | Do not persist the session to disk. It cannot be resumed afterwards. | |
| output_schema | No | Path to a JSON Schema file constraining the shape of the agent final response. | |
| timeout_seconds | No | How long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s). | |
| skip_git_repo_check | No | Allow running outside a git repository. | |
| dangerously_bypass_approvals_and_sandbox | No | Remove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already mark the tool as mutating, open-world, and destructive, so the bar is lower. The description adds useful behavioral context by explaining that Codex can read and edit files and run commands in the sandbox, and that long runs move to the background and return a job_id. It also discloses the return surface (final message, commands, thread_id), which goes beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: it opens with the core purpose, then covers capabilities, return values, and backgrounding behavior in just a few sentences. Every clause earns its place and there is no filler or restating of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 16-parameter tool with no output schema, the description supplies the essential missing pieces: what the agent can do, what it returns, and how continuation and backgrounding work. Sandbox modes, timeouts, and safety flags are left to the fully covered schema, which is a reasonable division. A short explicit caution about destructive potential would push this to 5, but the destructiveHint annotation already covers that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 16 parameters and the baseline is 3. The description adds little parameter-level meaning beyond framing the prompt as the input to the agent and mentioning the thread_id/job_id outputs. It does not need to compensate, but it also does not enrich individual parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Start a new Codex agent session') against a clearly identified resource ('a prompt'), and immediately distinguishes the tool from siblings by naming its two output tokens: thread_id (for codex_resume) and job_id (for background runs). This gives an agent a clear mental model of codex_exec as the entry-point tool rather than resume, review, or apply.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use the tool: for a brand-new session against a prompt. It also points to the follow-up tool by saying the returned thread_id can be passed to codex_resume, which helps an agent understand the workflow. It does not explicitly state when not to use it or name excluded siblings, so it falls just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_forkFork a Codex sessionADestructive
Branch an existing Codex session into a new one, leaving the original untouched. Useful for trying a different approach from a shared starting point.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root. | |
| model | No | Model slug, e.g. "gpt-5.5". Defaults to the Codex configuration. | |
| config | No | Raw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'. | |
| enable | No | Codex feature flags to enable for this run. | |
| images | No | Image files to attach to the prompt. Each must be inside the allowlist. | |
| prompt | No | Message to send in the forked session. | |
| disable | No | Codex feature flags to disable for this run. | |
| sandbox | No | Sandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1. | |
| worktree | No | Run in a fresh managed git worktree instead of the working directory. | |
| ephemeral | No | Do not persist the session to disk. It cannot be resumed afterwards. | |
| thread_id | No | Alias for session_id, matching the thread_id returned by codex_exec. | |
| session_id | No | Session UUID or thread name to branch from. The original is left untouched. | |
| output_schema | No | Path to a JSON Schema file constraining the shape of the agent final response. | |
| timeout_seconds | No | How long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s). | |
| skip_git_repo_check | No | Allow running outside a git repository. | |
| dangerously_bypass_approvals_and_sandbox | No | Remove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description usefully adds the key behavioral detail that the original session is left untouched, which is valuable and goes beyond the annotations. It does not disclose approval requirements, background execution, or the lifecycle of the new session, though the annotations already signal a non-read-only, potentially destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The primary action is stated immediately, and the important safety trait 'leaving the original untouched' is front-loaded. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 16-parameter mutation tool with no output schema and destructive annotations, the description is thin. It does not explain what is returned, how the forked session runs, or how the tool relates to codex_exec and codex_resume, though the rich schema and sibling list partially compensate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema fully documents all 16 parameters. The tool description adds no parameter-level meaning beyond what the schema already provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action and resource: branch an existing Codex session into a new one while leaving the original untouched. This distinguishes it from related operations like resume or exec, though it never names or contrasts with any sibling tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Useful for trying a different approach from a shared starting point' gives a clear use case but no explicit when-to-use versus alternatives. The agent must infer that codex_fork is the right choice over codex_exec or codex_resume from context rather than being told.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_generate_imageGenerate an image with CodexADestructive
Generate an image using the image_gen tool built into Codex, and save it to output_path. No API key is needed: it runs through your Codex session. Returns the path of the file written, not the image bytes.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root. | |
| size | No | Requested size, e.g. "1024x1024", "1536x1024", "3840x2160". | |
| model | No | Model slug, e.g. "gpt-5.5". Defaults to the Codex configuration. | |
| style | No | Style or medium, e.g. "flat minimal vector", "studio product photography". | |
| config | No | Raw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'. | |
| enable | No | Codex feature flags to enable for this run. | |
| images | No | Image files to attach to the prompt. Each must be inside the allowlist. | |
| prompt | Yes | What the image should show. Plain language; the server wraps it in the spec Codex expects. | |
| disable | No | Codex feature flags to disable for this run. | |
| sandbox | No | Sandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1. | |
| use_case | No | Taxonomy slug steering the style: product-mockup, ui-mockup, logo-brand, illustration-story, infographic-diagram, photorealistic-natural, stylized-concept, ads-marketing. | |
| worktree | No | Run in a fresh managed git worktree instead of the working directory. | |
| ephemeral | No | Do not persist the session to disk. It cannot be resumed afterwards. | |
| constraints | No | Things the image must avoid or preserve, e.g. "no text, no watermark". | |
| output_path | Yes | Where to write the image, e.g. "assets/hero.png". Must sit inside the server allowlist. | |
| transparent | No | Ask for a genuinely transparent background and preserve the alpha channel. | |
| output_schema | No | Path to a JSON Schema file constraining the shape of the agent final response. | |
| timeout_seconds | No | How long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s). | |
| reference_images | No | Reference images for style or composition. Each must be inside the allowlist. | |
| skip_git_repo_check | No | Allow running outside a git repository. | |
| dangerously_bypass_approvals_and_sandbox | No | Remove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=true and readOnlyHint=false, which are consistent with the description's write action. The description adds useful context beyond annotations: it explains that no API key is needed and that the return is the file path, not image bytes. It does not contradict the annotations, and it adds meaningful behavioral detail without being exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (three sentences), front-loaded with the core action, and includes only high-value details (no API key, return path). There is no wasted wording or repetition, making it highly efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 21 parameters and 2 required, the schema carries the full param documentation, so the description only needs to provide overarching context. It does that, and since there is no output schema, it correctly explains the return format. It could mention background execution or job_id behavior, but that is already in the timeout_seconds parameter description. The description is adequate given the schema richness, though a note on returning a job_id would push it higher.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter has a documented description. The tool description does not add any parameter-specific information beyond that. Per the baseline guidance, when coverage is high, a score of 3 is appropriate. The description's mention of output_path and return path aligns with the schema but adds no new semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (generate an image), the mechanism (using the image_gen tool built into Codex), and the output (save to output_path). It also clarifies the return value (path, not bytes), which makes the tool's function unambiguous and distinguishes it from the non-image sibling tools like codex_exec or codex_review.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly compare to siblings, but the clear purpose and the mention that no API key is needed (it runs through your Codex session) provide enough context for when to use it. There are no explicit exclusions or alternatives named, but the tool's focused role makes usage obvious, so it earns a 4 rather than a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_cancelCancel a background Codex jobADestructive
Stop a run that is still going: SIGTERM first, then SIGKILL after a grace period. Reports honestly whether this call is what cancelled it.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | Job id to cancel. Sends SIGTERM, then SIGKILL after a grace period. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the annotations by revealing the exact kill mechanism (SIGTERM, then SIGKILL after a grace period) and the return semantics ('Reports honestly whether this call is what cancelled it'). This is valuable behavioral context that the destructiveHint annotation alone does not provide, and nothing contradicts the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences convey purpose, mechanism, and outcome without waste. The core action is front-loaded, and each sentence earns its place by adding essential operational detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter destructive tool with no output schema, this description is complete: it explains what is cancelled, how (signal sequence), when the tool is appropriate, and what result to expect. An agent has enough context to call it correctly and interpret the outcome.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: the job_id parameter already has a full description including signal behavior. The tool description repeats this rather than adding new parameter-level meaning, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states an unambiguous action ('Stop a run that is still going') with a specific resource and even details the shutdown sequence (SIGTERM then SIGKILL). It clearly differentiates from siblings like codex_job_status and codex_job_logs by focusing on cancellation rather than inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Stop a run that is still going' conveys the primary use case: cancel an active background job. It does not explicitly name alternatives or say when not to use it, but the context is clear enough for an agent to route to this tool instead of job_status or job_logs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_logsRead background Codex job eventsARead-only
Page through the JSONL events of a background run. Pass the returned next_cursor back as "since" to read only what is new. Filter with "types" to cut the noise.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum events per page. Defaults to 200. | |
| since | No | Cursor from a previous call. Omit to read from the start. | |
| types | No | Keep only these event types, e.g. ["item.completed", "turn.completed"]. | |
| job_id | Yes | Job id returned by a tool call that went to the background. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=falsecars, so safety is covered. The description adds meaningful behavioral detail beyond that: it explains cursor-based pagination semantics and the incremental-read pattern ('Pass the returned next_cursor back as "since"'), which is valuable for correct use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: the first states the core purpose, the second teaches cursor resumption, and the third explains filtering. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only paginated log tool, the description covers what the agent needs: how to page, how to continue from a cursor, and how to filter. The annotations cover safety, and the schema covers parameters. The absence of an output schema is mitigated by mentioning JSONL events and next_cursor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by clarifying that 'since' is a cursor returned by a previous call and that 'types' can reduce noise, going slightly beyond the schema's bare definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: 'Page through the JSONL events of a background run.' This clearly positions the tool as an event-log reader and distinguishes it from siblings like codex_job_status and codex_job_cancel, which cover status and cancellation rather than raw event streams.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides concrete usage context: paginate with next_cursor, resume with 'since' for new data, and reduce volume via 'types'. It does not explicitly name alternatives or state when not to use the tool, but the event-log framing makes its intended role clear against the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_statusCheck a background Codex jobARead-only
Report the state of a run that moved to the background: whether it is still running, its exit code, how long it has taken and how many events it has produced.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | Job id returned by a tool call that went to the background. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only, non-destructive behavior. The description adds useful behavioral detail about what the status check returns: running state, exit code, elapsed time, and event count. It does not contradict annotations and supplements them with meaningful output expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence that front-loads the core action and then lists the returned status details. Every clause adds useful information, with no redundant or filler text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, one required parameter, and no output schema, the description adequately covers input, behavior, and return contents. It tells the agent what data the call will provide, which is sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers the single parameter job_id with a clear description ('Job id returned by a tool call that went to the background'), and schema coverage is 100%. The tool description does not add additional parameter-level meaning beyond this, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Report the state of a run that moved to the background' and lists the concrete details it reports (still running, exit code, elapsed time, event count). This distinguishes it from sibling tools like codex_job_logs and codex_job_cancel, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear context by explaining that the tool applies to backgrounded runs rather than active or cancellable jobs. It does not explicitly name alternatives or exclusion conditions, but the domain context from the sibling tools makes the intended use reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_list_sessionsList Codex sessionsARead-only
List recorded Codex sessions with their id, name, working directory and last update, read straight from disk. Use it to find a session_id for codex_resume or codex_fork.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Only sessions whose working directory matches this path. | |
| limit | No | Maximum number of sessions to return. Defaults to 20. | |
| query | No | Case-insensitive substring match on the thread name or id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds meaningful behavior beyond annotations by stating sessions are 'read straight from disk,' clarifying the source and implying no remote calls or state changes. This is useful context for an agent deciding whether invocation is safe and appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, with the core action and return fields front-loaded and the usage guidance in the second sentence. No filler words and no redundancy with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, read-only list tool with three optional and fully documented parametershol, the description covers what the tool returns composites and why to use it. No output schema exists, but the description names the key return fields, making the tool safely callable without needing more context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters. The description adds little beyond the schema, except that the returned data includes fields like working directory, which maps to the cwd filter. Baseline 3 is appropriate since the schema carries the full parameter burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List recorded Codex sessions' and enumerates the returned fields (id, name, working directory, last update). It clearly differentiates itself from session-consuming tools like codex_resume and codex_fork by positioning itself as the way to discover a session_id.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit usage guidance: 'Use it to find a session_id for codex_resume or codex_fork.' This names the dependent siblings and the exact purpose, leaving no ambiguity about when to select this tool over alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_resumeResume a Codex sessionADestructive
Continue a previous Codex session with its full history, either by session_id or with last=true for the most recent one. Use this instead of codex_exec to follow up on earlier work without re-explaining the context.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root. | |
| last | No | Continue the most recent recorded session. Mutually exclusive with "session_id". | |
| model | No | Model slug, e.g. "gpt-5.5". Defaults to the Codex configuration. | |
| config | No | Raw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'. | |
| enable | No | Codex feature flags to enable for this run. | |
| images | No | Image files to attach to the prompt. Each must be inside the allowlist. | |
| prompt | No | Message to send after resuming. Omit to just replay the session. | |
| disable | No | Codex feature flags to disable for this run. | |
| sandbox | No | Sandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1. | |
| worktree | No | Run in a fresh managed git worktree instead of the working directory. | |
| ephemeral | No | Do not persist the session to disk. It cannot be resumed afterwards. | |
| thread_id | No | Alias for session_id, matching the thread_id returned by codex_exec. | |
| session_id | No | Session UUID or thread name to continue. Mutually exclusive with "last". | |
| output_schema | No | Path to a JSON Schema file constraining the shape of the agent final response. | |
| timeout_seconds | No | How long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s). | |
| skip_git_repo_check | No | Allow running outside a git repository. | |
| dangerously_bypass_approvals_and_sandbox | No | Remove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context by noting the session includes 'full history' and that no re-explanation is needed, which characterizes stateful continuation beyond what annotations provide. Annotations already signal destructive and open-world behavior, so the tool's mutation risk is covered even though the description does not elaborate on side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences with no filler. The core action and selection mechanism are front-loaded, and the alternative-tool guidance is condensed into the second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 17 parameters and no output schema, the description plus the fully documented schema and annotations provide enough context for correct invocation. The main gap is that it does not describe the return/background-job behavior, but the schema and sibling tools like codex_job_status cover much of that workflow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 and the schema already documents all 17 parameters. The description reinforces the role of session_id and last=true, but it does not add semantic details beyond what the parameter descriptions already specify.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly names the verb 'Continue', the resource 'previous Codex session', and the two selection modes (session_id or last=true). It also explicitly differentiates itself from codex_exec, so an agent can quickly tell when to pick this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It says directly to 'use this instead of codex_exec to follow up on earlier work without re-explaining the context'. This gives a concrete condition for using the tool and names the relevant alternative, leaving little to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_reviewReview code with CodexA
Run a Codex code review over uncommitted changes (default), a diff against a base branch, or a specific commit. Optionally steer it with custom instructions.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root. | |
| base | No | Review the diff against this base branch. | |
| model | No | Model slug, e.g. "gpt-5.5". Defaults to the Codex configuration. | |
| title | No | Title shown in the review summary. | |
| commit | No | Review the changes introduced by this commit SHA. | |
| config | No | Raw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'. | |
| enable | No | Codex feature flags to enable for this run. | |
| images | No | Image files to attach to the prompt. Each must be inside the allowlist. | |
| prompt | No | Custom review instructions, e.g. "focus on race conditions". | |
| disable | No | Codex feature flags to disable for this run. | |
| sandbox | No | Sandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1. | |
| worktree | No | Run in a fresh managed git worktree instead of the working directory. | |
| ephemeral | No | Do not persist the session to disk. It cannot be resumed afterwards. | |
| uncommitted | No | Review staged, unstaged and untracked changes. This is the default. | |
| output_schema | No | Path to a JSON Schema file constraining the shape of the agent final response. | |
| timeout_seconds | No | How long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s). | |
| skip_git_repo_check | No | Allow running outside a git repository. | |
| dangerously_bypass_approvals_and_sandbox | No | Remove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description does not disclose important behavioral traits: a Codex review can run commands under a configurable sandbox, write to the workspace, and continue in the background after the inline timeout, but none of that appears here. The annotations do signal readOnlyHint=false and openWorldHint=true, but the description itself adds no behavioral context beyond the basic review action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler; the main purpose and default behavior are front-loaded, and optional customization comes second. This is appropriately concise given that the schema already carries the detailed parameter documentation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 18 parameters, no output schema, and asynchronous behavior implied by timeout_seconds and job_id, the short description is thin: it does not tell the agent what to expect back (inline result vs. job_id) or how the review interacts with sandbox and background execution. The rich parameter schema partially compensates, making this minimally viable but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 even without parameter info in the description. The description usefully summarizes the main review targets (uncommitted, base, commit) and the prompt parameter, but those map closely to the already-detailed schema fields and add grouping rather than genuinely new semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action ('Run a Codex code review') and clearly names the input scopes: uncommitted changes (default), a diff against a base branch, or a specific commit. This makes its purpose distinct from siblings like codex_exec and codex_apply even though no sibling is explicitly named.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly explains when to use the tool by describing the three review scopes and marking uncommitted changes as the default, so an agent knows what will happen if no target is specified. It also mentions optional custom instructions. However, it does not give explicit when-not-to-use guidance or name alternatives like codex_exec for broader tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.0.4- First observed
codex_apply - First observed
codex_exec - First observed
codex_fork - First observed
codex_generate_image - First observed
codex_job_cancel - First observed
codex_job_logs - First observed
codex_job_status - First observed
codex_list_sessions - First observed
codex_resume - First observed
codex_review
TDQS
Scored across 10 tools
Each tool targets a distinct action: starting, resuming, forking, reviewing, applying, listing, image generation, and job management are clearly separated. The session-lifecycle tools (exec/resume/fork) and job tools (status/logs/cancel) have well-defined boundaries with explicit descriptions.
All tools share the codex_ prefix and use lowercase snake_case, making the set predictable. The naming shifts slightly between verb-first (codex_exec, codex_list_sessions) and noun-first (codex_job_status, codex_job_logs), but the pattern remains readable and consistent in style.
Ten tools is well-scoped for a Codex agent server covering session lifecycle, background jobs, code review/apply, and image generation. Each tool has a clear purpose and none feel redundant.
The core workflows are covered: start/resume/fork sessions, review and apply changes, manage background jobs, and list sessions. A few minor gaps exist, such as no explicit job listing or session deletion, but agents can work around these without major failures.
Maintenance
Related MCP Connectors
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Develop, manage, and debug Railway projects, services, and deployments from within agents.
Remote MCP server to read and manage your Atako AI agents, messages, files, and integrations.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to spawn and control Codex CLI and Claude Code sessions on the host machine, with session management and filesystem access.4MIT
- AlicenseCqualityDmaintenanceBridges MCP clients with local Codex CLI to execute autonomous coding tasks, manage threads, and inspect history via SQLite state.13577 npm4Apache 2.0
- AlicenseAqualityBmaintenanceLocal MCP bridge that lets Codex operate local Claude Code sessions, including listing, starting, resuming, forking, prompting, and stopping conversations via the Remote Control CLI.14MIT
- AlicenseNot gradedqualityCmaintenanceEnables Grok Build to orchestrate the local Codex CLI for code reviews, adversarial reviews, task rescue, session transfer, and background job management through MCP tools.1Apache 2.0