Run Codex
codex_execStart a sandboxed coding agent that reads and edits files and runs commands, returning the final message and a thread ID to resume or track long-running background jobs.
Instructions
Start a new Codex agent session against a prompt. Codex can read and edit files and run commands in the sandbox. Returns the final message, the commands it ran and a thread_id you can pass to codex_resume. Long runs move to the background and return a job_id.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for the run. Must sit inside the server allowlist. Defaults to the first allowed root. | |
| model | No | Model slug, e.g. "gpt-5.5". Defaults to the Codex configuration. | |
| config | No | Raw Codex config overrides as key=value, TOML-parsed, e.g. 'model_reasoning_effort="high"'. | |
| enable | No | Codex feature flags to enable for this run. | |
| images | No | Image files to attach to the prompt. Each must be inside the allowlist. | |
| prompt | Yes | Instructions for the Codex agent. Sent over stdin, so length is unconstrained. | |
| add_dir | No | Extra directories Codex may write to, beyond the working directory. Each must be inside the allowlist. | |
| disable | No | Codex feature flags to disable for this run. | |
| profile | No | Codex config profile to layer on top of the base configuration. | |
| sandbox | No | Sandbox for commands Codex runs. "read-only" forbids writes, "workspace-write" (default) allows writes inside the workspace, "danger-full-access" removes all limits and is refused unless the server was started with CODEX_MCP_ALLOW_DANGEROUS=1. | |
| worktree | No | Run in a fresh managed git worktree instead of the working directory. | |
| ephemeral | No | Do not persist the session to disk. It cannot be resumed afterwards. | |
| output_schema | No | Path to a JSON Schema file constraining the shape of the agent final response. | |
| timeout_seconds | No | How long to wait inline before handing back a job_id and continuing in the background. 0 means return immediately. Defaults to the server setting (120s). | |
| skip_git_repo_check | No | Allow running outside a git repository. | |
| dangerously_bypass_approvals_and_sandbox | No | Remove every approval and sandbox check. Refused unless CODEX_MCP_ALLOW_DANGEROUS=1. |