Skip to main content
Glama

mcp-server-codex

Serveur MCP (Model Context Protocol) en TypeScript pour piloter le CLI Codex localement : lancer des sessions d'agent, les reprendre, les bifurquer, faire des revues de code, appliquer des diffs et générer des images — le tout depuis n'importe quel client MCP (Claude Code, Claude Desktop, Codex lui-même…).

Le code, les identifiants et les messages d'erreur sont en anglais : ils sont lus par des agents. La documentation est en français.

Ce que ça fait

Le CLI Codex est conçu pour un humain devant un terminal. Ce serveur le rend pilotable par un agent :

  • Il force --json partout et parse le flux JSONL en résultats structurés.

  • Il gère les runs longs sans faire tomber l'appel d'outil (voir Exécution hybride).

  • Il restreint ce que Codex peut toucher sur le disque.

  • Il expose la génération d'images, que Codex n'offre pas comme service appelable.

Related MCP server: codex-mcp-server

Prérequis

Outil

Rôle

Installation Windows

Codex CLI ≥ 0.154

le binaire piloté

npm i -g @openai/codex (recommandé) ou winget install OpenAI.Codex

Node.js ≥ 22.0

exécution du serveur (≥ 22.18 pour développer)

winget install OpenJS.NodeJS (fournit aussi npm)

git

codex exec refuse de tourner hors dépôt ; requis par les cibles de revue

winget install Git.Git

Vous devez être authentifié côté Codex (codex login). Le serveur n'a besoin d'aucune clé API, y compris pour les images.

⚠️ La version de Codex publiée sur winget est en retard sur celle de npm. Ce serveur est écrit contre le comportement de la 0.154 (voir Notes d'implémentation). Préférez npm. Un Codex installé par npm n'apparaît pas dans winget list : évitez de mélanger les deux voies, sous peine d'avoir deux binaires concurrents dans le PATH. En cas de doute, pointez CODEX_BIN sur le bon exécutable.

Installation

npm install
npm run build

Configuration client

Claude Code

claude mcp add codex -- node C:/chemin/vers/mcp-server-codex/dist/index.js

Claude Desktop / configuration JSON générique

{
  "mcpServers": {
    "codex": {
      "command": "node",
      "args": ["C:/chemin/vers/mcp-server-codex/dist/index.js"],
      "env": {
        "CODEX_MCP_ALLOWED_ROOTS": "C:/projets/mon-app",
        "CODEX_MCP_DEFAULT_SANDBOX": "workspace-write"
      }
    }
  }
}

Le serveur parle stdio. Tous ses diagnostics vont sur stderr : stdout transporte le protocole et écrire dedans corromprait la session.

Variables d'environnement

Variable

Défaut

Rôle

CODEX_BIN

codex

Chemin ou nom du binaire Codex.

CODEX_HOME

~/.codex

Racine Codex : sessions et images générées y sont lues.

CODEX_MCP_ALLOWED_ROOTS

cwd du serveur

Répertoires autorisés, séparés par ; (Windows) ou :. Liste exhaustive : la définir remplace le défaut, elle ne s'y ajoute pas.

CODEX_MCP_ALLOW_DANGEROUS

0

À 1, débloque danger-full-access et le contournement des approbations.

CODEX_MCP_DEFAULT_SANDBOX

workspace-write

Sandbox par défaut : read-only, workspace-write ou danger-full-access.

CODEX_MCP_DEFAULT_TIMEOUT_SECONDS

120

Attente avant bascule en arrière-plan. 0 = toujours en arrière-plan.

CODEX_MCP_MAX_EVENTS

2000

Taille du tampon d'événements par job.

CODEX_MCP_JOB_TTL_SECONDS

1800

Durée de consultation d'un job terminé.

Une valeur invalide fait échouer le démarrage (code 78) plutôt que de retomber silencieusement sur un défaut : une faute de frappe ne doit pas devenir une politique de sécurité différente de celle demandée.

Exécution hybride

Un run Codex dure de quelques secondes à plusieurs dizaines de minutes, alors que les clients MCP coupent les appels d'outil bien avant. Chaque outil d'exécution fait donc la course contre son propre timeout_seconds :

  • il finit à temps → résultat complet en un aller-retour ;

  • le délai expire → le processus continue, l'appel rend un job_id immédiatement.

Le délai n'annule jamais le run : perdre dix minutes de travail du modèle à cause d'une échéance arbitraire du client est précisément ce que ce design évite.

codex_exec { prompt: "…", timeout_seconds: 60 }
  └─ dépassement → { job_id: "job-3-a1b2", mode: "background", thread_id: "…" }
       ├─ codex_job_status { job_id }
       ├─ codex_job_logs   { job_id, since: 42 }   ← pagination par curseur
       └─ codex_job_cancel { job_id }              ← SIGTERM puis SIGKILL

Les jobs vivent le temps de la session MCP.

Outils

Outil

Rôle

codex_exec

Nouvelle session Codex sur un prompt. Rend le message final, les commandes exécutées et un thread_id.

codex_resume

Reprend une session avec tout son historique (session_id ou last: true).

codex_fork

Bifurque une session existante, l'originale reste intacte.

codex_review

Revue de code : uncommitted (défaut), base, ou commit.

codex_apply

Applique le dernier diff d'une tâche Codex (git apply).

codex_list_sessions

Liste les sessions enregistrées. Lecture disque, aucun processus lancé.

codex_generate_image

Génère une image et l'écrit sur disque.

codex_job_status

État d'un run passé en arrière-plan.

codex_job_logs

Événements JSONL paginés d'un job, filtrables par type.

codex_job_cancel

Arrête un run en cours.

Les outils d'exécution acceptent en commun : cwd, model, sandbox, images, config, enable, disable, output_schema, worktree, ephemeral, skip_git_repo_check, timeout_seconds.

Génération d'images

{
  "prompt": "un robot bleu, style plat minimaliste",
  "output_path": "assets/robot.png",
  "use_case": "logo-brand",
  "size": "1024x1024",
  "transparent": true,
  "constraints": "pas de texte, pas de watermark"
}

L'outil renvoie le chemin du fichier, pas les octets : un PNG de 850 Ko pèse ~1,1 Mo en base64 et saturerait le contexte de l'agent appelant.

Codex n'expose aucun service de génération d'images : le protocole app-server contient ImageGenerationThreadItem comme type d'événement mais aucune méthode RPC image/*, et il n'existe pas de sous-commande codex image. Le seul accès est agentique — le modèle décide d'appeler son outil interne image_gen, guidé par la skill système imagegen. Ce serveur en tire deux conséquences :

  1. Le prompt est composé, pas transmis tel quel. La skill attend une spécification étiquetée (Use case:, Primary request:, Constraints:…) ; lui donner du texte brut dégrade nettement le résultat.

  2. Le fichier doit être retrouvé. image_gen n'émet aucun item JSONL : le flux d'événements ne dit jamais où l'image a atterri. Le serveur vérifie donc output_path, puis se rabat sur $CODEX_HOME/generated_images/<thread_id>/ et y copie le fichier le plus récent. Si les deux échouent, il le dit explicitement plutôt que de renvoyer un chemin fantôme.

Sécurité

L'installation d'un serveur MCP donne à un agent la capacité d'exécuter du code sur votre machine. Les défauts sont donc restrictifs :

  • Allowlist de répertoires. Tout cwd, add_dir, images, output_schema et output_path est résolu en chemin réel — liens symboliques compris — puis vérifié comme descendant d'une racine autorisée. Un chemin refusé l'est avant tout lancement de processus : un appel rejeté n'a aucun effet de bord.

  • Sandbox par défaut workspace-write, approbations sur never (aucun humain n'est là pour répondre ; un refus revient au modèle comme un échec exploitable au lieu de bloquer le run).

  • danger-full-access et --dangerously-bypass-approvals-and-sandbox sont refusés sauf CODEX_MCP_ALLOW_DANGEROUS=1.

Le garde-fou de chemins ne protège pas contre un Codex lancé en danger-full-access : ce mode retire les limites côté Codex lui-même.

Notes d'implémentation

Trois comportements de Codex 0.154, vérifiés empiriquement, façonnent le code :

  1. Seul codex exec accepte -s/--sandbox, -C/--cd, --add-dir et -p/--profile. exec resume, exec fork et exec review ne les ont pas : le sandbox y passe par -c sandbox_mode="…".

  2. Le codex review de premier niveau n'a pas --json — seul codex exec review l'a. Toutes les revues passent donc par exec review.

  3. Codex lit stdin dès qu'il n'est pas sur un TTY (« Reading additional input from stdin… »). Le prompt est toujours passé via - sur stdin, puis stdin est refermé. Cela contourne aussi la limite de 8191 caractères de la ligne de commande Windows et tout l'échappement de quotes.

codex resume sans identifiant ouvre un sélecteur TUI, impilotable en MCP : codex_list_sessions lit donc directement $CODEX_HOME/sessions/**/rollout-*.jsonl (source de vérité) et enrichit avec $CODEX_HOME/session_index.jsonl, qui ne contient que les threads nommés. Seule la première ligne de chaque rollout est lue — ces fichiers atteignent couramment des dizaines de méga-octets.

Le parseur JSONL est délibérément tolérant : un item.type inconnu est conservé tel quel plutôt que rejeté, pour qu'une montée de version de Codex dégrade le résumé au lieu de casser le serveur.

CI/CD et publication

Deux workflows GitHub Actions, sans secret à configurer : le GITHUB_TOKEN fourni automatiquement suffit.

ci.yml — à chaque push et pull request sur main

Matrice Node 22 et 24 × Ubuntu et Windows : typecheck, tests, build. Windows n'est pas du zèle — l'allowlist de chemins, la gestion des lettres de lecteur et le contournement de la limite de 8191 caractères sont des comportements spécifiquement Windows.

Un job supplémentaire vérifie le plancher d'exécution : package.json annonce node >= 22.0, ce job construit avec une chaîne récente puis charge le dist/ sous Node 22.0. Les tests ne peuvent pas y tourner (le type stripping exige 22.18), mais la promesse est prouvée au lieu d'être supposée.

release.yml — sur un tag v*

npm version patch   # ou minor / major : met à jour package.json et crée le tag
git push --follow-tags

Le workflow rejoue typecheck, tests et build sur l'arbre exact qui va être publié — CI prouve qu'un commit est sain, la release prouve que le tag l'est —, puis publie sur npm.pkg.github.com et crée la GitHub Release avec des notes générées. Un workflow_dispatch permet de rejouer une release à partir d'un tag existant.

Garde-fou de version : si le tag et package.json divergent, la publication échoue avant le npm publish. Une version npm ne pouvant jamais être republiée, une release mal étiquetée serait définitive.

Scope dérivé à la publication. GitHub Packages n'accepte qu'un paquet scopé au compte propriétaire. Plutôt que de figer un owner dans le dépôt — ce qui casserait tout fork —, scripts/github-package.mjs réécrit le nom en @owner/mcp-server-codex au moment de publier, à partir de github.repository_owner, en le passant en minuscules (GitHub conserve la casse des comptes, npm la refuse).

Installer depuis GitHub Packages

Le registre GitHub exige une authentification, même en lecture. Dans le .npmrc du projet consommateur :

@owner:registry=https://npm.pkg.github.com
//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}

avec un token portant le scope read:packages, puis :

npm install @owner/mcp-server-codex

Développement

npm test          # 194 tests, sans lancer Codex ni consommer de tokens
npm run typecheck
npm run build

Le développement demande Node ≥ 22.18, première version où le type stripping est actif sans drapeau : la suite exécute les .ts directement. Le paquet publié, lui, n'est que du JavaScript compilé et tourne dès Node 22.0 — plancher imposé par execa, qui déclare node >=22 et utilise Set.prototype.union.

Node exécute TypeScript nativement : ni tsx ni ts-node.

L'architecture tient à une couture : toute interaction avec le système passe par CodexRunner (src/codex/runner.ts). Les tests unitaires injectent soit un faux binaire Codex scriptable (test/helpers/fake-codex.mjs, qui exerce le vrai chemin spawn/stdin/streaming/annulation), soit un runner stub piloté à la main pour les scénarios de timeout et d'annulation.

src/
  index.ts            binaire, transport stdio
  runtime.ts          racine de composition
  server.ts           enregistrement MCP des outils
  schemas.ts          schémas zod (les descriptions sont lues par l'agent appelant)
  config.ts           environnement et garde-fous
  codex/argv.ts       pur : options → argv
  codex/events.ts     pur : JSONL → événements typés → résumé
  codex/runner.ts     seule couture avec le système
  codex/sessions.ts   lecture des sessions sur disque
  jobs/store.ts       registre, tampon circulaire, TTL
  jobs/hybrid.ts      course run / timeout
  security/paths.ts   allowlist de racines
  tools/              un fichier par outil

Licence

MIT

Available Tools

10 tools
codex_applyApply a Codex diffA
Destructive

Apply the latest diff produced by a Codex task to the local working tree, as a git apply. Modifies files on disk.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoRepository to apply into. Must sit inside the server allowlist.
task_idYesCodex task id whose latest diff should be applied with git apply.
timeout_secondsNoInline wait before backgrounding. 0 returns immediately.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry destructiveHint=true and readOnlyHint=false, so the description's 'Modifies files on disk' mostly echoes structured metadata. It does add useful operational context ('as a git apply' and 'local working tree'), but it does not disclose possible failure modes like apply conflicts, dirty working trees, or whether changes are staged.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences with no filler. The core action and target are front-loaded, and the side-effect note is kept to one clause. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating tool with no output schema, the description gives the core operation but is thin on surrounding context. It does not mention what happens after apply, how failures or timeouts are surfaced, whether a missing diff is an error, or how an agent should verify the result. Structured fields cover parameters and safety, but an agent still lacks enough operational context to call this confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all parameters (cwd, task_id, timeout_seconds) are already documented in the input schema. The description does not add extra meaning beyond 'latest diff' aligning with task_id, so it stays at the baseline rather than adding new parameter-level insight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Apply'), a specific resource ('the latest diff produced by a Codex task'), and a specific target ('the local working tree... as a git apply'). It clearly distinguishes this from sibling tools like codex_exec or codex_review by focusing on applying an existing diff rather than creating or reviewing one.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives context by indicating this applies a task's latest diff to the local tree, but it never explicitly says when to use this tool versus alternatives. With siblings like codex_exec, codex_resume, and codex_review available, an agent gets no direct guidance on sequencing, such as 'use after codex_exec' or 'consider codex_review before applying.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_execRun CodexA
Destructive

Start a new Codex agent session against a prompt. Codex can read and edit files and run commands in the sandbox. Returns the final message, the commands it ran and a thread_id you can pass to codex_resume. Long runs move to the background and return a job_id.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root.
modelNoModel slug, e.g. "gpt-5.5". Defaults to the Codex configuration.
configNoRaw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'.
enableNoCodex feature flags to enable for this run.
imagesNoImage files to attach to the prompt. Each must be inside the allowlist.
promptYesInstructions for the Codex agent. Sent over stdin, so length is unconstrained.
add_dirNoExtra directories Codex may write to, beyond the working directory. Each must be inside the allowlist.
disableNoCodex feature flags to disable for this run.
profileNoCodex config profile to layer on top of the base configuration.
sandboxNoSandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1.
worktreeNoRun in a fresh managed git worktree instead of the working directory.
ephemeralNoDo not persist the session to disk. It cannot be resumed afterwards.
output_schemaNoPath to a JSON Schema file constraining the shape of the agent final response.
timeout_secondsNoHow long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s).
skip_git_repo_checkNoAllow running outside a git repository.
dangerously_bypass_approvals_and_sandboxNoRemove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already mark the tool as mutating, open-world, and destructive, so the bar is lower. The description adds useful behavioral context by explaining that Codex can read and edit files and run commands in the sandbox, and that long runs move to the background and return a job_id. It also discloses the return surface (final message, commands, thread_id), which goes beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: it opens with the core purpose, then covers capabilities, return values, and backgrounding behavior in just a few sentences. Every clause earns its place and there is no filler or restating of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 16-parameter tool with no output schema, the description supplies the essential missing pieces: what the agent can do, what it returns, and how continuation and backgrounding work. Sandbox modes, timeouts, and safety flags are left to the fully covered schema, which is a reasonable division. A short explicit caution about destructive potential would push this to 5, but the destructiveHint annotation already covers that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 16 parameters and the baseline is 3. The description adds little parameter-level meaning beyond framing the prompt as the input to the agent and mentioning the thread_id/job_id outputs. It does not need to compensate, but it also does not enrich individual parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Start a new Codex agent session') against a clearly identified resource ('a prompt'), and immediately distinguishes the tool from siblings by naming its two output tokens: thread_id (for codex_resume) and job_id (for background runs). This gives an agent a clear mental model of codex_exec as the entry-point tool rather than resume, review, or apply.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use the tool: for a brand-new session against a prompt. It also points to the follow-up tool by saying the returned thread_id can be passed to codex_resume, which helps an agent understand the workflow. It does not explicitly state when not to use it or name excluded siblings, so it falls just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_forkFork a Codex sessionA
Destructive

Branch an existing Codex session into a new one, leaving the original untouched. Useful for trying a different approach from a shared starting point.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root.
modelNoModel slug, e.g. "gpt-5.5". Defaults to the Codex configuration.
configNoRaw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'.
enableNoCodex feature flags to enable for this run.
imagesNoImage files to attach to the prompt. Each must be inside the allowlist.
promptNoMessage to send in the forked session.
disableNoCodex feature flags to disable for this run.
sandboxNoSandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1.
worktreeNoRun in a fresh managed git worktree instead of the working directory.
ephemeralNoDo not persist the session to disk. It cannot be resumed afterwards.
thread_idNoAlias for session_id, matching the thread_id returned by codex_exec.
session_idNoSession UUID or thread name to branch from. The original is left untouched.
output_schemaNoPath to a JSON Schema file constraining the shape of the agent final response.
timeout_secondsNoHow long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s).
skip_git_repo_checkNoAllow running outside a git repository.
dangerously_bypass_approvals_and_sandboxNoRemove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description usefully adds the key behavioral detail that the original session is left untouched, which is valuable and goes beyond the annotations. It does not disclose approval requirements, background execution, or the lifecycle of the new session, though the annotations already signal a non-read-only, potentially destructive operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The primary action is stated immediately, and the important safety trait 'leaving the original untouched' is front-loaded. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex 16-parameter mutation tool with no output schema and destructive annotations, the description is thin. It does not explain what is returned, how the forked session runs, or how the tool relates to codex_exec and codex_resume, though the rich schema and sibling list partially compensate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema fully documents all 16 parameters. The tool description adds no parameter-level meaning beyond what the schema already provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action and resource: branch an existing Codex session into a new one while leaving the original untouched. This distinguishes it from related operations like resume or exec, though it never names or contrasts with any sibling tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Useful for trying a different approach from a shared starting point' gives a clear use case but no explicit when-to-use versus alternatives. The agent must infer that codex_fork is the right choice over codex_exec or codex_resume from context rather than being told.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_generate_imageGenerate an image with CodexA
Destructive

Generate an image using the image_gen tool built into Codex, and save it to output_path. No API key is needed: it runs through your Codex session. Returns the path of the file written, not the image bytes.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root.
sizeNoRequested size, e.g. "1024x1024", "1536x1024", "3840x2160".
modelNoModel slug, e.g. "gpt-5.5". Defaults to the Codex configuration.
styleNoStyle or medium, e.g. "flat minimal vector", "studio product photography".
configNoRaw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'.
enableNoCodex feature flags to enable for this run.
imagesNoImage files to attach to the prompt. Each must be inside the allowlist.
promptYesWhat the image should show. Plain language; the server wraps it in the spec Codex expects.
disableNoCodex feature flags to disable for this run.
sandboxNoSandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1.
use_caseNoTaxonomy slug steering the style: product-mockup, ui-mockup, logo-brand, illustration-story, infographic-diagram, photorealistic-natural, stylized-concept, ads-marketing.
worktreeNoRun in a fresh managed git worktree instead of the working directory.
ephemeralNoDo not persist the session to disk. It cannot be resumed afterwards.
constraintsNoThings the image must avoid or preserve, e.g. "no text, no watermark".
output_pathYesWhere to write the image, e.g. "assets/hero.png". Must sit inside the server allowlist.
transparentNoAsk for a genuinely transparent background and preserve the alpha channel.
output_schemaNoPath to a JSON Schema file constraining the shape of the agent final response.
timeout_secondsNoHow long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s).
reference_imagesNoReference images for style or composition. Each must be inside the allowlist.
skip_git_repo_checkNoAllow running outside a git repository.
dangerously_bypass_approvals_and_sandboxNoRemove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true and readOnlyHint=false, which are consistent with the description's write action. The description adds useful context beyond annotations: it explains that no API key is needed and that the return is the file path, not image bytes. It does not contradict the annotations, and it adds meaningful behavioral detail without being exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (three sentences), front-loaded with the core action, and includes only high-value details (no API key, return path). There is no wasted wording or repetition, making it highly efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 21 parameters and 2 required, the schema carries the full param documentation, so the description only needs to provide overarching context. It does that, and since there is no output schema, it correctly explains the return format. It could mention background execution or job_id behavior, but that is already in the timeout_seconds parameter description. The description is adequate given the schema richness, though a note on returning a job_id would push it higher.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter has a documented description. The tool description does not add any parameter-specific information beyond that. Per the baseline guidance, when coverage is high, a score of 3 is appropriate. The description's mention of output_path and return path aligns with the schema but adds no new semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (generate an image), the mechanism (using the image_gen tool built into Codex), and the output (save to output_path). It also clarifies the return value (path, not bytes), which makes the tool's function unambiguous and distinguishes it from the non-image sibling tools like codex_exec or codex_review.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly compare to siblings, but the clear purpose and the mention that no API key is needed (it runs through your Codex session) provide enough context for when to use it. There are no explicit exclusions or alternatives named, but the tool's focused role makes usage obvious, so it earns a 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_job_cancelCancel a background Codex jobA
Destructive

Stop a run that is still going: SIGTERM first, then SIGKILL after a grace period. Reports honestly whether this call is what cancelled it.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesJob id to cancel. Sends SIGTERM, then SIGKILL after a grace period.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by revealing the exact kill mechanism (SIGTERM, then SIGKILL after a grace period) and the return semantics ('Reports honestly whether this call is what cancelled it'). This is valuable behavioral context that the destructiveHint annotation alone does not provide, and nothing contradicts the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences convey purpose, mechanism, and outcome without waste. The core action is front-loaded, and each sentence earns its place by adding essential operational detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter destructive tool with no output schema, this description is complete: it explains what is cancelled, how (signal sequence), when the tool is appropriate, and what result to expect. An agent has enough context to call it correctly and interpret the outcome.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%: the job_id parameter already has a full description including signal behavior. The tool description repeats this rather than adding new parameter-level meaning, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states an unambiguous action ('Stop a run that is still going') with a specific resource and even details the shutdown sequence (SIGTERM then SIGKILL). It clearly differentiates from siblings like codex_job_status and codex_job_logs by focusing on cancellation rather than inspection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Stop a run that is still going' conveys the primary use case: cancel an active background job. It does not explicitly name alternatives or say when not to use it, but the context is clear enough for an agent to route to this tool instead of job_status or job_logs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_job_logsRead background Codex job eventsA
Read-only

Page through the JSONL events of a background run. Pass the returned next_cursor back as "since" to read only what is new. Filter with "types" to cut the noise.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum events per page. Defaults to 200.
sinceNoCursor from a previous call. Omit to read from the start.
typesNoKeep only these event types, e.g. ["item.completed", "turn.completed"].
job_idYesJob id returned by a tool call that went to the background.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=falsecars, so safety is covered. The description adds meaningful behavioral detail beyond that: it explains cursor-based pagination semantics and the incremental-read pattern ('Pass the returned next_cursor back as "since"'), which is valuable for correct use.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each earning its place: the first states the core purpose, the second teaches cursor resumption, and the third explains filtering. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only paginated log tool, the description covers what the agent needs: how to page, how to continue from a cursor, and how to filter. The annotations cover safety, and the schema covers parameters. The absence of an output schema is mitigated by mentioning JSONL events and next_cursor.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by clarifying that 'since' is a cursor returned by a previous call and that 'types' can reduce noise, going slightly beyond the schema's bare definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: 'Page through the JSONL events of a background run.' This clearly positions the tool as an event-log reader and distinguishes it from siblings like codex_job_status and codex_job_cancel, which cover status and cancellation rather than raw event streams.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete usage context: paginate with next_cursor, resume with 'since' for new data, and reduce volume via 'types'. It does not explicitly name alternatives or state when not to use the tool, but the event-log framing makes its intended role clear against the sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_job_statusCheck a background Codex jobA
Read-only

Report the state of a run that moved to the background: whether it is still running, its exit code, how long it has taken and how many events it has produced.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesJob id returned by a tool call that went to the background.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only, non-destructive behavior. The description adds useful behavioral detail about what the status check returns: running state, exit code, elapsed time, and event count. It does not contradict annotations and supplements them with meaningful output expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single focused sentence that front-loads the core action and then lists the returned status details. Every clause adds useful information, with no redundant or filler text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, one required parameter, and no output schema, the description adequately covers input, behavior, and return contents. It tells the agent what data the call will provide, which is sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers the single parameter job_id with a clear description ('Job id returned by a tool call that went to the background'), and schema coverage is 100%. The tool description does not add additional parameter-level meaning beyond this, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Report the state of a run that moved to the background' and lists the concrete details it reports (still running, exit code, elapsed time, event count). This distinguishes it from sibling tools like codex_job_logs and codex_job_cancel, which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear context by explaining that the tool applies to backgrounded runs rather than active or cancellable jobs. It does not explicitly name alternatives or exclusion conditions, but the domain context from the sibling tools makes the intended use reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_list_sessionsList Codex sessionsA
Read-only

List recorded Codex sessions with their id, name, working directory and last update, read straight from disk. Use it to find a session_id for codex_resume or codex_fork.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoOnly sessions whose working directory matches this path.
limitNoMaximum number of sessions to return. Defaults to 20.
queryNoCase-insensitive substring match on the thread name or id.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds meaningful behavior beyond annotations by stating sessions are 'read straight from disk,' clarifying the source and implying no remote calls or state changes. This is useful context for an agent deciding whether invocation is safe and appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences, with the core action and return fields front-loaded and the usage guidance in the second sentence. No filler words and no redundancy with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, read-only list tool with three optional and fully documented parametershol, the description covers what the tool returns composites and why to use it. No output schema exists, but the description names the key return fields, making the tool safely callable without needing more context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters. The description adds little beyond the schema, except that the returned data includes fields like working directory, which maps to the cwd filter. Baseline 3 is appropriate since the schema carries the full parameter burden.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List recorded Codex sessions' and enumerates the returned fields (id, name, working directory, last update). It clearly differentiates itself from session-consuming tools like codex_resume and codex_fork by positioning itself as the way to discover a session_id.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage guidance: 'Use it to find a session_id for codex_resume or codex_fork.' This names the dependent siblings and the exact purpose, leaving no ambiguity about when to select this tool over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_resumeResume a Codex sessionA
Destructive

Continue a previous Codex session with its full history, either by session_id or with last=true for the most recent one. Use this instead of codex_exec to follow up on earlier work without re-explaining the context.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root.
lastNoContinue the most recent recorded session. Mutually exclusive with "session_id".
modelNoModel slug, e.g. "gpt-5.5". Defaults to the Codex configuration.
configNoRaw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'.
enableNoCodex feature flags to enable for this run.
imagesNoImage files to attach to the prompt. Each must be inside the allowlist.
promptNoMessage to send after resuming. Omit to just replay the session.
disableNoCodex feature flags to disable for this run.
sandboxNoSandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1.
worktreeNoRun in a fresh managed git worktree instead of the working directory.
ephemeralNoDo not persist the session to disk. It cannot be resumed afterwards.
thread_idNoAlias for session_id, matching the thread_id returned by codex_exec.
session_idNoSession UUID or thread name to continue. Mutually exclusive with "last".
output_schemaNoPath to a JSON Schema file constraining the shape of the agent final response.
timeout_secondsNoHow long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s).
skip_git_repo_checkNoAllow running outside a git repository.
dangerously_bypass_approvals_and_sandboxNoRemove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral context by noting the session includes 'full history' and that no re-explanation is needed, which characterizes stateful continuation beyond what annotations provide. Annotations already signal destructive and open-world behavior, so the tool's mutation risk is covered even though the description does not elaborate on side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two tight sentences with no filler. The core action and selection mechanism are front-loaded, and the alternative-tool guidance is condensed into the second sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having 17 parameters and no output schema, the description plus the fully documented schema and annotations provide enough context for correct invocation. The main gap is that it does not describe the return/background-job behavior, but the schema and sibling tools like codex_job_status cover much of that workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 and the schema already documents all 17 parameters. The description reinforces the role of session_id and last=true, but it does not add semantic details beyond what the parameter descriptions already specify.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly names the verb 'Continue', the resource 'previous Codex session', and the two selection modes (session_id or last=true). It also explicitly differentiates itself from codex_exec, so an agent can quickly tell when to pick this tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It says directly to 'use this instead of codex_exec to follow up on earlier work without re-explaining the context'. This gives a concrete condition for using the tool and names the relevant alternative, leaving little to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_reviewReview code with CodexA

Run a Codex code review over uncommitted changes (default), a diff against a base branch, or a specific commit. Optionally steer it with custom instructions.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root.
baseNoReview the diff against this base branch.
modelNoModel slug, e.g. "gpt-5.5". Defaults to the Codex configuration.
titleNoTitle shown in the review summary.
commitNoReview the changes introduced by this commit SHA.
configNoRaw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'.
enableNoCodex feature flags to enable for this run.
imagesNoImage files to attach to the prompt. Each must be inside the allowlist.
promptNoCustom review instructions, e.g. "focus on race conditions".
disableNoCodex feature flags to disable for this run.
sandboxNoSandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1.
worktreeNoRun in a fresh managed git worktree instead of the working directory.
ephemeralNoDo not persist the session to disk. It cannot be resumed afterwards.
uncommittedNoReview staged, unstaged and untracked changes. This is the default.
output_schemaNoPath to a JSON Schema file constraining the shape of the agent final response.
timeout_secondsNoHow long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s).
skip_git_repo_checkNoAllow running outside a git repository.
dangerously_bypass_approvals_and_sandboxNoRemove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1.

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description does not disclose important behavioral traits: a Codex review can run commands under a configurable sandbox, write to the workspace, and continue in the background after the inline timeout, but none of that appears here. The annotations do signal readOnlyHint=false and openWorldHint=true, but the description itself adds no behavioral context beyond the basic review action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no filler; the main purpose and default behavior are front-loaded, and optional customization comes second. This is appropriately concise given that the schema already carries the detailed parameter documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 18 parameters, no output schema, and asynchronous behavior implied by timeout_seconds and job_id, the short description is thin: it does not tell the agent what to expect back (inline result vs. job_id) or how the review interacts with sandbox and background execution. The rich parameter schema partially compensates, making this minimally viable but with clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 even without parameter info in the description. The description usefully summarizes the main review targets (uncommitted, base, commit) and the prompt parameter, but those map closely to the already-detailed schema fields and add grouping rather than genuinely new semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action ('Run a Codex code review') and clearly names the input scopes: uncommitted changes (default), a diff against a base branch, or a specific commit. This makes its purpose distinct from siblings like codex_exec and codex_apply even though no sibling is explicitly named.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly explains when to use the tool by describing the three review scopes and marking uncommitted changes as the default, so an agent knows what will happen if no target is specified. It also mentions optional custom instructions. However, it does not give explicit when-not-to-use guidance or name alternatives like codex_exec for broader tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.0.4
    • First observedcodex_apply
    • First observedcodex_exec
    • First observedcodex_fork
    • First observedcodex_generate_image
    • First observedcodex_job_cancel
    • First observedcodex_job_logs
    • First observedcodex_job_status
    • First observedcodex_list_sessions
    • First observedcodex_resume
    • First observedcodex_review

TDQS

A4.1/5.0

Scored across 10 tools

Disambiguation5/5

Each tool targets a distinct action: starting, resuming, forking, reviewing, applying, listing, image generation, and job management are clearly separated. The session-lifecycle tools (exec/resume/fork) and job tools (status/logs/cancel) have well-defined boundaries with explicit descriptions.

Naming Consistency4/5

All tools share the codex_ prefix and use lowercase snake_case, making the set predictable. The naming shifts slightly between verb-first (codex_exec, codex_list_sessions) and noun-first (codex_job_status, codex_job_logs), but the pattern remains readable and consistent in style.

Tool Count5/5

Ten tools is well-scoped for a Codex agent server covering session lifecycle, background jobs, code review/apply, and image generation. Each tool has a clear purpose and none feel redundant.

Completeness4/5

The core workflows are covered: start/resume/fork sessions, review and apply changes, manage background jobs, and list sessions. A few minor gaps exist, such as no explicit job listing or session deletion, but agents can work around these without major failures.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables MCP clients to spawn and control Codex CLI and Claude Code sessions on the host machine, with session management and filesystem access.
    4
    MIT
  • A
    license
    C
    quality
    D
    maintenance
    Bridges MCP clients with local Codex CLI to execute autonomous coding tasks, manage threads, and inspect history via SQLite state.
    13
    577 npm
    4
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables Grok Build to orchestrate the local Codex CLI for code reviews, adversarial reviews, task rescue, session transfer, and background job management through MCP tools.
    1
    Apache 2.0