codex-subagent-mcp
Summary: An MCP server that lets Claude delegate coding tasks to a local, already-signed-in Codex CLI, choosing the model and reasoning effort per task, read-only by default.
Check the setup —
codex_doctorverifies the Codex CLI is installed, recent enough, signed in and able to load config, and reports fixes (never installs or changes anything);extended: trueadds a slow, networked config report.See the models —
list_codex_modelsreads the live catalog from the installed CLI and lists each model's supported reasoning-effort levels, with a warned static fallback.Get advice —
codex_recommendsuggests a model and effort for a described task (optionally biased by quality/balanced/latency/cost) without making any model call.Delegate work —
codex_delegateruns a task, blocking (with progress) or in the background, passing prompt, context, target files, acceptance criteria and system instructions.Control the run — per-call model, reasoning effort (none→ultra), sandbox (
read-only,workspace-write,danger-full-access), extra writable dirs, working dir, timeout, web search, auto-approve and git-repo checks.Get structured output — an optional
output_schemamakes Codex return JSON matching your schema (up to 64 KiB) that Claude can act on directly.Isolate writes —
use_worktreesends edits to a managed git worktree, and results list the files changed and where each landed.Continue sessions —
codex_follow_upresumes a prior delegation bythread_id, reusing Codex's context, with per-turn model/effort/sandbox overrides.Manage background jobs —
codex_job_status(list all or inspect one, with activity log),codex_job_result(full output of a finished job),codex_job_cancel(terminate a running job).Know what happened — every result reports the model, effort, sandbox, working dir, applied status, duration, token usage and thread ID.
Stay bounded — env vars set defaults and ceilings (default/allowed models, default/max sandbox, default/max effort, hourly delegation cap, background job cap) plus which Codex MCP servers, plugins and apps a delegation may inherit.
Delegates coding tasks from Claude to OpenAI's Codex CLI running on the same machine, driving the installed CLI as a subagent. Supports choosing a Codex model (e.g. gpt-6-astra, gpt-5.6-terra) and reasoning effort per task, read-only investigation by default or explicitly allowed file edits, capturing the list of changed files, running long jobs in the background with job status polling, continuing a delegated thread, and confining writes to a managed git worktree. Also exposes a doctor check reporting whether the Codex CLI is installed and signed in.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codex-subagent-mcphave codex investigate why the auth tests are flaky and report back"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
codex-subagent-mcp
An MCP server that lets Claude Code delegate coding tasks to OpenAI's Codex CLI running on the same machine, with the model and reasoning depth chosen per task. Claude stays the orchestrator. Codex becomes a subagent it can call.
An independent project. Not affiliated with, endorsed by, or supported by OpenAI or Anthropic.
Quick start
Requires Node.js 22+ and the Codex CLI installed,
on PATH, and signed in.
claude mcp add codex-subagent -- npx -y codex-subagent-mcpAsk Claude to run codex_doctor if anything is missing. See docs/INSTALL.md
for platform setup, Claude Desktop and other installation options, and Safety before
enabling writes.
Related MCP server: Hydra
What you get
You pick the model and the reasoning effort per task, from the catalog your Codex CLI reports live.
Read-only by default, with a sandbox ceiling no tool call can exceed.
Every finished delegation checks the model, effort, sandbox and directory it asked for against what Codex recorded for the run, and says when they differ or could not be confirmed.
Optional
output_schemareturns JSON that matches your schema, for results Claude can act on directly.Cancelling, timing out or shutting down stops Codex and the commands it started that the server can still find; a command that detached from that process tree can outlive it.
A real read-only delegation asking for the package name, captured 2026-09-30:
codex-subagent-mcp
Commands run (1 total):
- [exit 0] /bin/zsh -lc "sed -n '1,80p' package.json"
model=gpt-5.6-luna | effort=low | sandbox=read-only | working_dir=/Users/you/project | applied=confirmed | duration=8s | tokens=in 35701 (cached 28160, uncached 7541) / out 88 (reasoning 9) | thread_id=01a0f419-9fd2-79e2-8248-91436f04e297Why this exists
A single model doing everything has three recurring problems, and delegation solves each one:
Your context window is finite. Having Claude read forty files to answer one question spends context you need for the actual work. Delegating the investigation returns the answer instead of the forty files.
One model has one set of blind spots. A second opinion is worth most when it comes from a different model family — different training, different failure modes. Asking the same model twice mostly gets you the same answer twice.
Not every task deserves the same reasoning budget. Renaming a variable and diagnosing a race condition are not the same job. Here they are separate dials: the model sets raw capability, the reasoning effort sets how long it deliberates. Cheap work goes to a fast model; a hard problem gets the capable one thinking for as long as it needs.
The server runs on your machine and drives the Codex CLI you already have installed; it holds no
credentials of its own. Prompts reach OpenAI through Codex, exactly as when you run codex
yourself.
See How it compares for a versioned comparison with other Codex MCP servers.
Using it
Write a bounded delegation
A delegation gets expensive when repeated commands keep adding output to the context carried into
later requests. Name the exact question, likely files, stopping condition and evidence the answer
must contain; choose higher effort for ambiguity rather than by habit.
Writing a delegation gives the measured cost model, ranked rules and
weak-versus-strong examples using the real tool parameters. Background goes in context and a
persona or extra rules in system_instructions, both layered on the built-in quality contract; see
the tool reference.
Get a second opinion from a different model family
The value here is not a second run — it is a different set of blind spots.
Ask Codex to review
src/server.tsfor correctness problems, focusing on error paths. Use a high reasoning effort and tell it to report each finding with the line and why it matters.
A delegated review like this found the terminate() defect in this repository's own runner: two
code paths could each arm a timer while only one was ever cleared.
Investigate without spending your context
Forty files go into the delegation; one answer comes back. Codex runs its own searches and reads whatever it needs; your conversation receives the conclusion.
Have Codex trace how a reasoning effort travels from the MCP tool call down to the arguments handed to the Codex CLI, and report just the call chain.
Run long work in the background while you keep going
Kick off a Codex run in the background that writes unit tests for
src/jobs.ts, then keep helping me with the API layer.
You get a job_id immediately. Ask for the status whenever you want, and read the result when it is
done. Up to eight can run at once; CODEX_SUBAGENT_MAX_BACKGROUND_JOBS can lower that cap.
A background request cancelled before its job is created starts nothing.
Buy deep reasoning for one hard problem
Raising the reasoning effort for the whole conversation is expensive. Raising it for one delegation is not.
This intermittent test failure has beaten me twice. Ask Codex to work out the root cause at maximum reasoning effort, give it
test/runner.test.tsand the CI log, and tell it not to change anything — I want the diagnosis first.
Keep the thread going
Ask Codex to expand on its second finding.
Follow-ups reuse Codex's context, so they cost a fraction of the original. The server restates the same model, effort and directory on every follow-up because Codex itself does not keep them on resume.
Let it write, when you mean it
Have Codex apply its first two suggestions. Let it edit files, but keep it inside a git worktree so my working tree stays clean.
use_worktree sends the run's edits to ~/.codex/worktrees/; results list the file changes Codex
reported and where each landed, up to a thousand distinct entries, then report the omitted count, and a line names
the worktree and the commit it was made from. Codex is told beforehand that uncommitted changes,
untracked files and ignored files such as installed dependencies are not in it. The server does
not clean worktrees up: they may hold unapplied work. The experimental feature is enabled only for
that invocation; your Codex configuration is unchanged. A follow-up continues in the same worktree;
when Codex's session file could not confirm where that was, the follow-up asks for working_dir
rather than resume in your working tree. See Safety for the write boundary.
Whatever the sandbox, a delegation that writes reports the file changes Codex recorded. It is Codex's account, not a diff of the disk:
Files changed (2):
- [edit] src/codex/runner.ts
- [add] test/runner.test.tsSafety
This server runs another program on your machine, so it is worth two minutes before you enable writes.
What protects you
Delegations are read-only by default. Writing requires an explicit sandbox: "workspace-write"
or a user-set default. use_worktree sends edits to a managed git worktree instead of your
checkout; the sandbox and add_dirs bound where it can write at all. Unsandboxed runs are
unavailable unless you explicitly opt into that ceiling.
The confinement is the operating system's own sandbox: Seatbelt on macOS, bubblewrap on Linux and
WSL2, and a native sandbox on Windows. The table was measured on macOS;
SECURITY.md records the measurement details.
Linux and Windows have not been measured here, and OpenAI's Windows documentation notes that
sandboxed commands can fail to read some directories, so reads may be stricter there:
|
|
| |
Write inside the working directory | no | yes | yes |
Write outside it (your home) | no | no | yes |
Network access | no | no | yes |
Read outside the working directory | yes | yes | yes |
The server chooses the sandbox mode on every run; Codex's own sandbox_workspace_write settings, such
as network access or extra writable roots, are not overridden and still apply under
workspace-write. The table reflects Codex's defaults.
The sandbox confines the commands Codex runs in its shell. It does not confine MCP or plugin tools:
those run as their own processes with your account's full permissions, network included, and under
read-only a tool that declares itself read-only runs without approval (measured on codex-cli
0.159.2; ADR 16). So a delegation inherits no MCP
server, plugin or app from your Codex setup unless you allow it in the server configuration, and
every delegation result includes a line saying what the run was allowed.
There is no shell in the server's invocation path: the CLI is spawned with an argv array and the prompt is written to its stdin, never interpolated into a command string. Shell metacharacters in a prompt are inert.
What does not protect you
Reads are not confined. Codex can read anything your user account can, in every mode — your SSH keys, your cloud credentials. That was measured on macOS, and it is the safe assumption on every platform. Sandboxed network access is blocked so it cannot send them anywhere, but its report comes back to you, and that is a channel.
A prompt is untrusted input, and Codex acts on it. Content you did not write — an issue body, a
web page, a log, a file from someone else's repository — can carry instructions. With
workspace-write it can direct Codex to modify your repository; even read-only it can direct Codex
to read something sensitive and put it in the answer. The sandbox bounds where Codex can write. It
does not judge what it should write, or why it was asked. This is prompt injection, and it is the
risk that matters here.
The result is not sanitised. What comes back is text from a model that just read your files. Treat it as data, not as instructions; review what a delegation did rather than assuming it did what you asked.
Reducing the risk
Leave the built-in default alone. Read-only handles investigation, review and diagnosis, which is most delegation.
If you never want writes, cap it:
CODEX_SUBAGENT_MAX_SANDBOX=read-only. No conversation can argue past a ceiling. Register it outside the repository (Claude Code's defaultlocalscope,--scope user, or Claude Desktop's config), not in a project.mcp.jsonthat a write-enabled delegation could edit. See Configuration.When you enable writes, add
use_worktreeso changes land somewhere you can inspect before they touch your branch.Allow MCP servers, plugins or apps in delegations only when a task needs them, and by name. An allowed one runs outside the sandbox, and with
auto_approveits tools need no approval at all.Do not assemble delegation prompts from untrusted content when you intend to act on the answer.
If this threat matters seriously to you, run Codex under an account or container with no access to your secrets. That solves it at the root instead of bounding it.
SECURITY.md has the full threat model, what a deny_read policy could add, and how
to report a vulnerability.
Configuration
Everything is optional, and set through environment variables on the MCP server:
Variable | Values | Default | Effect |
| Slug from | The only entry of a single-entry | Model when a call specifies none. |
|
| Model's default | Effort when a call specifies none. |
| Comma-separated slugs from | Unrestricted | Anything else is refused; a single entry acts as the default model. An empty entry ( |
|
|
| Sandbox when a call specifies none; cannot exceed the ceiling. |
|
|
| Calls above it are refused; |
|
| Unrestricted | Higher effort is lowered to a supported level, or refused if none fits. |
| Decimal integer from 1 to 9007199254740991 | Unrestricted | Bounds spawned delegation and follow-up processes per rolling hour, per server process; probes never count. |
| Decimal integer from 1 to 8 |
| Lowers the cap on running background jobs; blocking calls do not use it. |
|
|
| MCP servers from Codex's config a delegation keeps. The recursion guard turns this server off for each delegation. If the MCP listing fails under |
|
|
| Installed Codex plugins a delegation keeps, with the MCP servers they provide. |
|
|
| Whether a delegation keeps Codex's apps (connectors to external services). |
|
|
| Append local usage counts for spawned delegations; read them with |
| Executable name or path; on Windows a directly executable file, not a |
| Override CLI resolution; see Installation. |
A model supports a subset of efforts; an unsupported effort is adjusted to the closest supported one with a note. See docs/TOOLS.md#configuration for full semantics and Safety for the sandbox boundary.
Every CODEX_SUBAGENT_* value is trimmed and case-sensitive, and an empty value means unset; a
value that conflicts with its ceiling or allow-list is a configuration error. Both numeric bounds
accept only ASCII digits, with leading zeros allowed. Invalid values refuse delegations and are listed by codex_doctor. Only you can raise
these limits. The hourly window is kept in memory, resets on restart and is independent of the
usage log. Every spawned run counts for sixty minutes, including failures, timeouts and cancellations.
Pending calls reserve slots before any probe and release them if nothing spawns. A refusal gives
the oldest counted process's expiry in UTC and minutes left, or asks the caller to wait for admitted
calls' results when none has spawned yet. codex_doctor reports both bounds, spawned processes in
the current window and calls still holding slots before spawning.
Claude decides when to delegate; each run sends its prompt to OpenAI and spends your Codex usage, in
any conversation where the server is available. docs/CONTROL.md covers client
permission prompts, server ceilings, version ranges and your own CLAUDE.md escalation rules. Those
rules stay yours; see ADR 12 and
ADR 14 for the policy split.
At connection time, the server instructions identify that registration's sandbox ceiling and
default, configured model and effort defaults, and the kinds of inherited tools a delegation may
keep. An orchestrator can therefore distinguish registrations with different policies before it
loads their tool descriptions. A misconfigured registration states that its delegation tools
refuse and points to codex_doctor, without advertising fallback values.
Choosing a model
Use list_codex_models for the live catalog from your installed CLI. Model and reasoning effort are
independent: the model sets raw capability; the effort sets how long it deliberates. ultra
additionally delegates subtasks automatically.
The server does not choose for you. A task's model depends on your budget and how costly a wrong answer is. Without a model in the call or configuration, it refuses with a recommendation for you to decide on.
With no configured or implied default, the codex_delegate description tells Claude to call
codex_recommend first, announce the suggested model and effort, then delegate with both explicit.
When CODEX_SUBAGENT_DEFAULT_MODEL is set, or CODEX_SUBAGENT_ALLOWED_MODELS contains exactly one
model, it instead tells Claude to omit model so the default applies. A configuration error keeps
the recommendation guidance. This is guidance to a model, not enforcement. For advice, ask: “Which
Codex model should handle migrating this repo's tests to vitest?” The suggestion respects your model
allow-list and effort ceiling; see the recommendation reference.
To skip that step on later delegations, set a default from list_codex_models once:
claude mcp add codex-subagent -e CODEX_SUBAGENT_DEFAULT_MODEL=gpt-5.6-terra -- npx -y codex-subagent-mcpTools
Tool | What it does |
| Check the Codex CLI installation and report how to fix it; opt in with |
| List available models and their reasoning-effort levels. |
| Suggest a model and effort for a described task. |
| Run a task, blocking or in the background, optionally returning JSON that matches a schema. |
| Continue a previous delegation using its |
| Check a background delegation. |
| Read a finished background delegation's output. |
| Stop a running background delegation. |
| Summarise the opt-in local usage log over a window, grouped by model, label, outcome or kind. |
Full parameter reference: docs/TOOLS.md.
FAQ
Does this cost money?
It uses your existing Codex quota, as running codex yourself does. This server adds nothing and
has no visibility into the cost. Higher efforts consume more, and ultra also delegates subtasks;
codex_recommend helps avoid spending ultra on low work.
Why drive the CLI instead of calling the OpenAI API? Delegated coding is not a single completion — it is an agentic loop with a sandbox, an approval model, session persistence and project instruction files. All of that lives in the Codex client, not in the model endpoint. See ADR 1.
Do I need Claude Code, or does Claude Desktop work? Either. Claude Code gets a one-line install; Claude Desktop needs a manual config entry.
It says Codex is not installed, but codex works in my terminal.
Most likely Windows with a global npm install, which produces a codex.cmd batch shim that cannot
be launched without a command shell. codex_doctor reports this as unsupported-shim and offers
two fixes. On macOS and Linux, check whether a Node version manager moved codex off PATH.
Does it work on Windows and Linux?
CI builds, tests and starts the server on Windows, macOS and Linux on every change, and checks that
the Codex CLI is resolved correctly on each. A real delegation has only been verified on macOS — the
CI runners have no Codex installation or credentials. Reports from Windows and Linux are welcome.
On Windows, install the Codex CLI with the PowerShell installer rather than npm; on Linux, install
bubblewrap for Codex's sandbox. See Installation.
Documentation
docs/INSTALL.md — installation, platform notes and troubleshooting.
docs/CONTROL.md — permissions, ceilings and when Claude delegates.
docs/DELEGATING.md — how to scope a delegation, with measured costs and worked prompts.
docs/TOOLS.md — every tool and parameter.
docs/COMPARISON.md — versioned comparisons with other Codex MCP servers.
docs/adr/ — why the design is what it is, decision by decision.
docs/ROADMAP.md — what is planned, and what is deliberately out of scope.
Issues — what is actually open right now.
docs/VERSIONING.md — what counts as a breaking change here.
CHANGELOG.md — what changed in each release, and the Codex CLI version it was verified against.
CONTRIBUTING.md — setup, and the rules that are not negotiable.
Disclaimer
Not an official product. This is an independent, community project. It is not affiliated with, endorsed by, sponsored by or supported by OpenAI or Anthropic. "Codex", "ChatGPT" and "OpenAI" are trademarks of OpenAI; "Claude" and "Claude Code" are trademarks of Anthropic. They are used here only to describe what this software interoperates with, which is nominative use — no claim is made to any of them. Neither company is responsible for this software, and problems with it should be reported here rather than to them.
No warranty. The software is provided "as is", without warranty of any kind, as stated in LICENSE. You use it at your own risk.
Read Safety before enabling writes; delegations spend your own Codex usage.
License
MIT. See LICENSE.
Available Tools
9 toolscodex_delegateDelegate a task to CodexA
Delegate a task to the local Codex CLI (OpenAI's coding agent), choosing model and reasoning effort. Use it when the user asks for Codex, or when handing work off clearly serves their request: a second opinion from a different model family, or an investigation that would otherwise flood this conversation. When the user has not named a model, call codex_recommend first and present its suggested model and effort to the user in the same message in which you say you are going to delegate, then pass both explicitly here. That recommendation is advice for an already-authorised delegation, not a replacement for the user's own preference. Everything passed in prompt, context and target_files is sent to OpenAI, and every run spends the user's own Codex usage, so do not delegate what you can answer directly, and tell the user when you delegate. Codex runs read-only unless a different default sandbox is configured. Set sandbox to workspace-write to let it edit files, if this server's sandbox ceiling allows it: a correctly configured server states the ceiling in its instructions, and a call above it is refused. Codex cannot see this conversation, so pass everything it needs in prompt, context, and target_files.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | blocking (default) waits and streams progress; background returns a job_id immediately. | |
| label | No | Your own short name for this kind of task, stored verbatim in the local usage log and never sent to Codex: 1 to 64 characters, no control or bidirectional-control characters. A follow-up without one keeps its thread's label. | |
| model | No | Catalog slug from list_codex_models. If omitted, the configured default is used; with no default configured the call is refused and the recommended model is returned. | |
| prompt | Yes | The task for Codex. Be specific and self-contained: Codex cannot see this conversation. | |
| context | No | Background Codex needs: prior findings, constraints, relevant excerpts. | |
| sandbox | No | Sandbox policy. Uses the configured default when omitted; without one, Codex runs read-only. | |
| add_dirs | No | Additional absolute directories that should be writable alongside working_dir. | |
| web_search | No | Enable Codex's API-backed live web-search tool for this run. In a read-only sandbox, shell commands have no network access, so this is the route to current external information. When omitted, Codex's own configured web_search mode applies. | |
| working_dir | No | Absolute path Codex uses as its working root. | |
| auto_approve | No | Adds --approve-for-me so Codex auto-approves its own commands. Only applies when sandbox is workspace-write. | |
| target_files | No | Paths Codex should focus on, relative to working_dir. | |
| use_worktree | No | Run in a managed git worktree. Writes outside it remain subject to the sandbox policy and add_dirs. | |
| output_schema | No | A JSON Schema object for this turn's final message, which then comes back as JSON in a delimited block. OpenAI's structured outputs apply: every object needs "additionalProperties": false and every property listed in "required". At most 64 KiB serialised. | |
| timeout_seconds | No | Wall-clock budget. Defaults to 1800s. | |
| reasoning_effort | No | Reasoning depth, independent of model choice. Uses the configured default or the model's default when omitted. Clamped to supported levels within the configured ceiling; refused if none qualify. | |
| acceptance_criteria | No | Concrete conditions that must hold for the task to be considered done. | |
| skip_git_repo_check | No | Allow running outside a git repository. | |
| system_instructions | No | Persona or extra rules inherited from the orchestrator, layered on the built-in quality contract. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=false and openWorldHint=true; the description goes far beyond them, disclosing data egress ("Everything passed in prompt, context and target_files is sent to OpenAI"), cost (spends the user's own Codex usage), the read-only default sandbox, the server-level sandbox ceiling that can refuse a call, and the read-only-context limitation. It also prescribes user-facing behavior (tell the user when you delegate). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and routing are front-loaded, then cost/privacy, then sandbox, which is the right order. It is a single very dense block with minor redundancy (the prompt/context/target_files data-egress point and the "Codex cannot see this conversation" point are made twice in different framings).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 18-parameter, open-world, mutating delegation tool with no output schema, the description covers the gaps the schema cannot: cost, data egress, permission ceiling, defaults, and user communication. It never explains how to collect results from a background run (codex_job_status/codex_job_result), but the mode parameter's schema text covers the job_id return.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description adds meaning on top by explaining that everything in prompt, context and target_files leaves the machine, and that sandbox escalation to workspace-write depends on a server ceiling that must be stated in the server's instructions. It does not touch mode/background vs blocking behavior or how jobs are retrieved, leaving the rest to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Delegate a task to the local Codex CLI (OpenAI's coding agent)") plus the two knobs it exposes, model and reasoning effort. It is clearly distinguishable from siblings like codex_recommend (advice only) and codex_follow_up (continuation), which are named with different roles.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it (user asks for Codex, second opinion from a different model family, investigation that would flood the conversation) and when not to ("do not delegate what you can answer directly"). It also gives an ordered prerequisite: if no model was named, call codex_recommend first and present the suggestion in the same message.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_doctorCheck the Codex CLI installationARead-only
Check whether the local Codex CLI is installed, recent enough, signed in and able to load its configuration, and report the exact steps to fix it if not. Run this when any other tool reports the CLI is unavailable, or before relying on delegation for the first time. It only inspects the installation; it never installs or repairs anything. Opt in with extended for a slow, networked config.load report from codex doctor --json.
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No | Re-probe the CLI instead of reusing the cached diagnosis. | |
| extended | No | Run the slow, networked Codex doctor report in addition to the cheap diagnosis. | |
| working_dir | No | Absolute directory to run the check in. Codex loads the configuration of the directory it runs in, so pass the one a delegation would use. Defaults to this server's own. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, and the description adds useful context beyond them: it explicitly guarantees that this tool never installs or repairs anything, warns that extended triggers a slow networked config.load report, and notes caching behavior through refresh in the schema. This is exactly the kind of extra behavioral detail that annotations alone cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the purpose, then the usage triggers, then the behavioral constraint and the opt-in cost. No sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a diagnostic tool with no output schema, the definition covers what is checked, when to run it, and the safety stance. The return format is only loosely described (exact fix steps, codex doctor --json report), which is a minor gap but not enough to block correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all three parameters are documented in the schema. The description only implicitly explains the effect of extended (slow networked config.load report); refresh and working_dir add nothing beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: checks whether the local Codex CLI is installed, recent enough, signed in, and able to load configuration. It also covers the failure path (report fix steps), and it is clearly distinguishable from siblings such as codex_delegate, which actually uses the CLI or relies on it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit triggers are given: run it when any other tool reports the CLI is unavailable, or before relying on delegation for the first time. It also sets a clear boundary, saying it only inspects the installation and never installs or repairs anything, so the agent knows this is not a repair tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_follow_upContinue a Codex sessionA
Send a follow-up message to a previous delegation using its thread_id. Codex retains the earlier context, so only the new instruction needs to be sent. Like a delegation, it is sent to OpenAI and spends the user's Codex usage.
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | Your own short name for this kind of task, stored verbatim in the local usage log and never sent to Codex: 1 to 64 characters, no control or bidirectional-control characters. A follow-up without one keeps its thread's label. | |
| model | No | Override the model for this turn. Defaults to the thread's last model from memory or, on a registry miss, Codex's session file; if neither has it, the configured default, else the call is refused. | |
| prompt | Yes | The follow-up instruction. | |
| sandbox | No | Sandbox policy for this turn. Uses the configured default when omitted; read-only when unset. | |
| thread_id | Yes | The thread_id reported by a previous codex_delegate call. | |
| working_dir | No | Absolute directory to resume in. Defaults to the directory the thread last ran in. | |
| auto_approve | No | Not supported on follow-ups: true is refused and nothing runs. | |
| output_schema | No | A JSON Schema object for this turn's final message, which then comes back as JSON in a delimited block. OpenAI's structured outputs apply: every object needs "additionalProperties": false and every property listed in "required". At most 64 KiB serialised. | |
| timeout_seconds | No | ||
| reasoning_effort | No | Override the reasoning effort for this turn. Defaults to the thread's last effort when the model is unchanged, otherwise to the configured or model default. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag openWorldHint and readOnlyHint=false; the description adds genuinely non-structured behavior: Codex retains prior context, the call leaves the local machine for OpenAI, and it consumes the user's Codex usage quota. It stops short of saying whether the call blocks or hands back a job handle.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: mechanism first, then the context-retention insight that explains why the prompt can be short, then the cost warning. Nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 10 parameters, no output schema, and an open-world external dependency, the description should say what comes back — a result, a job id for codex_job_status, or a streamed block (the output_schema parameter implies JSON returns but this isn't stated). Cost and context are covered; return and blocking behavior are not.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 90%, so parameters like thread_id, model, sandbox and output_schema are already documented. The description only reinforces thread_id's provenance and adds nothing about the optional overrides — baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — send a follow-up message to a previous delegation — and pins it to a thread_id, which immediately separates it from codex_delegate (new task) and the codex_job_* tools (polling). An agent can pick it without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Makes the precondition explicit: you must already have a thread_id from a prior delegation, and only the new instruction needs sending. It does not say when to abandon the thread and start a fresh codex_delegate instead, so there is no exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_cancelCancel a background delegationBDestructive
Terminate a running background delegation.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | The job_id returned by codex_delegate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, clearly indicating a destructive operation. The description adds 'running' as a state constraint, which is useful. However, it omits key behavioral details like whether the job is killed immediately or gracefully, whether it can be undone, or what happens to any partial results. With annotations covering the safety profile, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It is front-loaded with the action, though it is extremely terse, which might leave some ambiguity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema) and the annotations covering destructiveness, the description is minimally adequate but lacks important context about side effects, job state requirements, and the return value or confirmation. It should do more to help an agent understand when and how to use it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the single parameter job_id is fully documented in the schema, including that it comes from codex_delegate. The description adds no additional parameter meaning beyond what the schema provides, making the baseline 3 correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Terminate) and resource (running background delegation), which is clearer than the title. However, it does not distinguish itself from siblings like codex_job_status or codex_job_result, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, or when not to use it. The description gives no context about the conditions under which cancellation is appropriate, such as whether the job must be running or what happens if it has already completed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_resultRead a background delegation's resultARead-only
Return the full output of a finished background delegation. Errors if the job is still running.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | The job_id returned by codex_delegate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds a meaningful behavioral constraint: it errors when the job is still running, telling the agent this is a post-completion read with a specific failure mode. It does not discuss output truncation or pagination, so 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, and the completion precondition is front-loaded. The error condition follows immediately after the main action, keeping the most important routing information prominent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with full schema coverage and annotations covering safety, the description supplies the necessary completion precondition and output scope. No output schema exists, so describing the return as 'full output' is appropriately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the only parameter 'job_id' is documented as 'returned by codex_delegate'. The description adds no additional syntax, format, or constraint beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Return') and resource ('full output of a finished background delegation'), and the error condition distinguishes it from a status check. It does not explicitly name sibling codex_job_status as the alternative, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies use only after completion via 'finished background delegation' and 'Errors if the job is still running'. However, it does not explicitly tell the agent to call codex_job_status first or name alternatives, so usage is inferable but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_statusCheck a background delegationARead-only
Report the state and recent activity of a background delegation started with mode=background. Call it with no job_id to list every known job.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | No | Omit to list all jobs. | |
| include_activity | No | Include the recent progress log for the job. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds that it reports state plus recent activity and that omitting job_id enumerates all jobs, but says nothing about pagination, log volume, or failure modes for unknown job ids.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core purpose and with the no-arg listing behavior second; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-param, read-only status tool with no output schema, the description covers what is queried (state and activity) and the two calling modes. It is nearly complete, with only return-shape hints and error handling left unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are already documented in the schema; the description's note about omitting job_id restates that documentation rather than adding format or constraint detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (report) plus resource (state and recent activity of a background delegation) and scopes it to delegations started with mode=background, which links it to codex_delegate and separates it from codex_job_result.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives one concrete usage rule — call with no job_id to list every known job — but never says when to prefer this over codex_job_result, codex_follow_up, or codex_job_cancel, so the sibling routing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_recommendRecommend a Codex model and effortARead-only
Given a task description, recommend which Codex model and reasoning effort to delegate it with. Runs no model call; applies a documented matrix reconciled against the installed catalog.
| Name | Required | Description | Default |
|---|---|---|---|
| priority | No | Bias the reasoning effort: quality raises it, latency and cost lower it. Default balanced. | |
| working_dir | No | Absolute directory whose Codex configuration and model catalog should be used. Defaults to this server's own. | |
| task_description | Yes | What the delegated task involves, in one or two sentences. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint and openWorldHint annotations, the description discloses that the tool executes no model call and applies a documented matrix reconciled against the installed catalog. This adds meaningful context about how the recommendation is derived (deterministically, not by running a model) without conflicting with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The two-sentence description is compact and front-loaded: it immediately states the input ('Given a task description') and the output ('recommend which Codex model and reasoning effort'). The second sentence clarifies a key behavioral trait without waste. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with 3 parameters (1 required) and no output schema, the description is adequately complete. It specifies the recommendation output (model and effort) but does not detail the exact return structure (e.g., object or string). Given the low complexity and clear sibling context (codex_delegate, list_codex_models), this is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters are fully described in the input schema (100% coverage), so the description adds no parameter-specific detail beyond the schema. With full schema coverage, the baseline of 3 is appropriate; the description does not compensate with extra parameter guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'recommend which Codex model and reasoning effort to delegate it with.' It also notes 'Runs no model call,' which clearly differentiates this advisory tool from execution tools like codex_delegate. The purpose is unambiguous and distinct from siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage ('Given a task description... recommend') but does not explicitly say when to use this tool versus alternatives like codex_delegate or list_codex_models. The phrase 'Runs no model call' hints it is not for execution, but there is no explicit 'Use this before delegating' or 'For execution, use codex_delegate.' Guidance is implied, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_usageSummarise the local usage logARead-only
Summarise this server's local usage log (CODEX_SUBAGENT_USAGE_LOG) over a window: per group, the number of delegation processes, their outcomes, commands, durations and the tokens the Codex CLI reported. Reads local files only and runs no Codex process. It never reports quota, credits or remaining allowance.
| Name | Required | Description | Default |
|---|---|---|---|
| group_by | No | Group by the applied model and effort (default), the caller's label, the outcome, or the kind. | |
| since_hours | No | How far back to look, in hours: greater than 0 and at most 8,760. Defaults to 168 (one week). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false; the description adds real context beyond them by naming the data source, saying it 'reads local files only and runs no Codex process', and bounding what the result can contain. It stops short of stating behaviour when the log is absent or empty, or how much data a large window returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and payload, with the scope caveats following immediately. Every clause (source file, windowing, reported fields, local-only, no quota) carries distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only two fully-documented optional parameters and no output schema, the description does the right extra work by listing the reported fields, which stands in for a return-value spec. The remaining gap is edge-case behaviour (empty or missing log, size of output for long windows) for a tool the agent will likely call with defaults.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters (including the enum and its default) are already fully documented in the schema. The description's 'over a window' and 'per group' merely gesture at the same two parameters without adding syntax, bounds or examples, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Summarise this server's local usage log (CODEX_SUBAGENT_USAGE_LOG)') and enumerates exactly what the summary contains: process counts, outcomes, commands, durations and reported tokens. That combination is unmistakable against every sibling, none of which summarise usage history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear usage context (summarising the local log over a window) and an explicit exclusion ('It never reports quota, credits or remaining allowance'), which steers an agent away from asking it about allowance. It does not name an alternative tool for quota-style questions, so it falls short of full when/when-not routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_codex_modelsList Codex modelsARead-only
List the Codex models available on this machine, with the reasoning-effort levels each one supports. Read from the installed Codex CLI, with a warned static fallback if its catalog cannot be read. Call this before codex_delegate when choosing a model explicitly.
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No | Bypass the cache and re-read the catalog from the CLI. | |
| working_dir | No | Absolute directory to read the catalog in. A project you have trusted in Codex can set its own catalog, so pass the directory a delegation would use. Defaults to this server's own. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool read-only, and the description adds useful behavioral context: it reads from the installed Codex CLI and has a 'warned static fallback' if the catalog cannot be read. This goes beyond the annotation in a meaningful way, though caching behavior is left to the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: the core purpose, the fallback behavior, and the usage guidance. It is front-loaded with the essential information and contains no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool, the description covers the key context: what is listed, where it is read from, the fallback behavior, and when to call it. It does not describe the return format, but no output schema exists and the purpose makes the return shape largely predictable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents both parameters. The description does not add parameter-level meaning beyond the schema, which makes the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('List'), a precise resource ('Codex models available on this machine'), and additional detail ('reasoning-effort levels each one supports'). It also distinguishes itself from a sibling by pointing to codex_delegate, so an agent can tell why this tool exists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage context: 'Call this before codex_delegate when choosing a model explicitly.' It clearly states when the tool should be used, though it does not name alternatives to avoid or describe when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
4 tool updates
v0.6.0- Changed
codex_delegate1 field changed- added
Input schema / properties / labelAdded value: +{ + "description": "Your own short name for this kind of task, stored verbatim in the local usage log and never sent to Codex: 1 to 64 characters, no control or bidirectional-control characters. A follow-up without one keeps its thread's label.", + "type": "string" +}
- Changed
codex_doctor1 field changed- added
Input schema / properties / extendedAdded value: +{ + "default": false, + "description": "Run the slow, networked Codex doctor report in addition to the cheap diagnosis.", + "type": "boolean" +}
- Changed
codex_follow_up1 field changed- added
Input schema / properties / labelAdded value: +{ + "description": "Your own short name for this kind of task, stored verbatim in the local usage log and never sent to Codex: 1 to 64 characters, no control or bidirectional-control characters. A follow-up without one keeps its thread's label.", + "type": "string" +}
- Added
codex_usage
2 tool updates
v0.4.0- Changed
codex_delegate1 field changed- added
Input schema / properties / output_schemaAdded value: +{ + "additionalProperties": {}, + "description": "A JSON Schema object for this turn's final message, which then comes back as JSON in a delimited block. OpenAI's structured outputs apply: every object needs \"additionalProperties\": false and every property listed in \"required\". At most 64 KiB serialised.", + "propertyNames": { + "type": "string" + }, + "type": "object" +}
- Changed
codex_follow_up1 field changed- added
Input schema / properties / output_schemaAdded value: +{ + "additionalProperties": {}, + "description": "A JSON Schema object for this turn's final message, which then comes back as JSON in a delimited block. OpenAI's structured outputs apply: every object needs \"additionalProperties\": false and every property listed in \"required\". At most 64 KiB serialised.", + "propertyNames": { + "type": "string" + }, + "type": "object" +}
5 tool updates
v0.3.0- Changed
codex_delegate2 fields changed- changed
Input schema / properties / sandbox / descriptionPrevious value: -"Sandbox policy. Defaults to read-only: Codex analyses and reports but cannot modify files."New value: +"Sandbox policy. Uses the configured default when omitted; without one, Codex runs read-only." - changed
Input schema / properties / web_search / descriptionPrevious value: -"Enable live web search for this run, through Codex's web_search = \"live\" setting. When omitted, Codex's own configured web_search mode applies."New value: +"Enable Codex's API-backed live web-search tool for this run. In a read-only sandbox, shell commands have no network access, so this is the route to current external information. When omitted, Codex's own configured web_search mode applies."
- Changed
codex_doctor1 field changed- added
Input schema / properties / working_dirAdded value: +{ + "description": "Absolute directory to run the check in. Codex loads the configuration of the directory it runs in, so pass the one a delegation would use. Defaults to this server's own.", + "type": "string" +}
- Changed
codex_follow_up2 fields changed- changed
Input schema / properties / model / descriptionPrevious value: -"Override the model for this turn. Defaults to the model the thread last ran with on this server; for a thread this server has no record of, the configured default, else the call is refused."New value: +"Override the model for this turn. Defaults to the thread's last model from memory or, on a registry miss, Codex's session file; if neither has it, the configured default, else the call is refused." - changed
Input schema / properties / sandbox / descriptionPrevious value: -"Sandbox policy for this turn. Defaults to read-only."New value: +"Sandbox policy for this turn. Uses the configured default when omitted; read-only when unset."
- Changed
codex_recommend1 field changed- added
Input schema / properties / working_dirAdded value: +{ + "description": "Absolute directory whose Codex configuration and model catalog should be used. Defaults to this server's own.", + "type": "string" +}
- Changed
list_codex_models1 field changed- added
Input schema / properties / working_dirAdded value: +{ + "description": "Absolute directory to read the catalog in. A project you have trusted in Codex can set its own catalog, so pass the directory a delegation would use. Defaults to this server's own.", + "type": "string" +}
2 tool updates
v0.2.0- Changed
codex_delegate5 fields changed- changed
Input schema / properties / auto_approve / descriptionPrevious value: -"Adds --approve-for-me so Codex auto-approves its own commands. Only applies when sandbox allows writes."New value: +"Adds --approve-for-me so Codex auto-approves its own commands. Only applies when sandbox is workspace-write." - changed
Input schema / properties / model / descriptionPrevious value: -"Catalog slug from list_codex_models. Omitted means the recommendation matrix picks one."New value: +"Catalog slug from list_codex_models. If omitted, the configured default is used; with no default configured the call is refused and the recommended model is returned." - changed
Input schema / properties / reasoning_effort / descriptionPrevious value: -"Reasoning depth, independent of model choice. Clamped to what the chosen model supports."New value: +"Reasoning depth, independent of model choice. Uses the configured default or the model's default when omitted. Clamped to supported levels within the configured ceiling; refused if none qualify." - changed
Input schema / properties / use_worktree / descriptionPrevious value: -"Run in a managed git worktree so changes never touch the current working tree."New value: +"Run in a managed git worktree. Writes outside it remain subject to the sandbox policy and add_dirs." - changed
Input schema / properties / web_search / descriptionPrevious value: -"Enable Codex's native web search tool."New value: +"Enable live web search for this run, through Codex's web_search = \"live\" setting. When omitted, Codex's own configured web_search mode applies."
- Changed
codex_follow_up4 fields changed- added
Input schema / properties / auto_approve / descriptionAdded value: +"Not supported on follow-ups: true is refused and nothing runs." - changed
Input schema / properties / model / descriptionPrevious value: -"Override the model for this turn."New value: +"Override the model for this turn. Defaults to the model the thread last ran with on this server; for a thread this server has no record of, the configured default, else the call is refused." - changed
Input schema / properties / reasoning_effort / descriptionPrevious value: -"Override the reasoning effort for this turn."New value: +"Override the reasoning effort for this turn. Defaults to the thread's last effort when the model is unchanged, otherwise to the configured or model default." - added
Input schema / properties / working_dir / descriptionAdded value: +"Absolute directory to resume in. Defaults to the directory the thread last ran in."
1 tool update
- Changed
codex_follow_up1 field changed- added
Input schema / properties / thread_id / patternAdded value: +"^[A-Za-z0-9][A-Za-z0-9_-]{0,199}$"
8 tool updates
v0.1.0- First observed
codex_delegate - First observed
codex_doctor - First observed
codex_follow_up - First observed
codex_job_cancel - First observed
codex_job_result - First observed
codex_job_status - First observed
codex_recommend - First observed
list_codex_models
TDQS
Scored across 9 tools
Each tool targets a distinct phase of the delegation workflow: model discovery, recommendation, delegation, follow-up, and job lifecycle. The only mild overlap is between codex_recommend and list_codex_models, but the descriptions clearly separate 'advise a choice' from 'enumerate the catalog'. codex_usage versus codex_job_status is also close but distinguishable (aggregate log vs. live job state).
All names use snake_case and a shared codex_ prefix, which helps. However, the verb placement and part of speech vary: codex_delegate (verb-first) vs codex_job_cancel (noun-then-verb), and noun-style names like codex_doctor and codex_usage break any verb_noun pattern. Readable, but not predictable.
Nine tools is well within the sweet spot and each maps to a concrete need: discovery, advice, execution, follow-up, observability, and three background-job controls. No tool looks redundant or padded.
The surface covers the full lifecycle from install diagnosis through model selection, delegation, follow-up, usage accounting, and background job status/result/cancel. Minor gaps exist, such as no explicit way to enumerate past threads or clean up finished jobs, but agents can work around these via thread_id and status listing.
Maintenance
Related MCP Connectors
No-data MCP handoff for local Claude Code to Codex harness moves. $49 lifetime.
Source-checked CLI guides and model-aware planning for Claude Code, Codex, and Grok Build.
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Use your Mac, Windows or Linux computer from ChatGPT, Claude or Codex: files, commands, documents.
Related MCP Servers
- AlicenseAqualityDmaintenanceEnables Claude Code to delegate tasks to OpenAI's Codex CLI (GPT-5.4) with structured execution traces, parallel execution, session persistence, and adversarial code review.15MIT
- AlicenseNot gradedqualityFmaintenanceEnables Codex to delegate bounded engineering jobs to Claude Code CLI in isolated Git worktrees with strict security and allowance pacing.MIT
- AlicenseNot gradedqualityAmaintenanceLets Codex delegate coding and repository work to an installed Claude Code CLI with permission-aware inspect/write access, model and effort selection, resumable and cloud-attached sessions, and durable synchronous or asynchronous jobs.MIT
- AlicenseNot gradedqualityBmaintenanceEnables Claude Code to delegate bounded, read-only analysis and isolated patch proposals to the locally installed Codex CLI over MCP, with sanitized live status, revision-aware polling, and reviewable results.1MIT