codex-subagent-mcp
Summary: codex-subagent-mcp lets Claude delegate coding and analysis tasks to a locally installed OpenAI Codex CLI, with per-task control over model, reasoning effort, and sandbox permissions.
Check that the Codex CLI is installed, recent enough, and signed in (
codex_doctor)List the Codex models available on your machine and the reasoning-effort levels each supports (
list_codex_models)Get a recommendation for which model and effort to use for a described task (
codex_recommend)Delegate a self-contained coding or analysis task to Codex, blocking or in the background (
codex_delegate)Choose the model slug and reasoning effort per delegation (
lowthroughultra), clamped to what the model supportsRun delegations read-only by default, or allow writes via
workspace-writeordanger-full-accesssandbox policiesConfine writes to a managed git worktree so changes stay out of your working tree (
use_worktree)Focus Codex on specific files and directories (
target_files,working_dir,add_dirs)Enable Codex's native web search, auto-approval, and custom acceptance criteria or system instructions
Set a wall-clock timeout up to 7200 seconds (default 1800s)
Continue a previous delegation cheaply using its
thread_id(codex_follow_up)Run up to eight background jobs at once and keep working while they proceed
Check the state and recent activity of a background job, or list all known jobs (
codex_job_status)Read the full output of a finished background delegation (
codex_job_result)Terminate a running background delegation (
codex_job_cancel)Restrict server behavior via environment variables: default model/effort, allowed models, maximum sandbox, maximum effort, and custom Codex binary path
Delegates coding tasks from Claude to OpenAI's Codex CLI running on the same machine, driving the installed CLI as a subagent. Supports choosing a Codex model (e.g. gpt-6-astra, gpt-5.6-terra) and reasoning effort per task, read-only investigation by default or explicitly allowed file edits, capturing the list of changed files, running long jobs in the background with job status polling, continuing a delegated thread, and confining writes to a managed git worktree. Also exposes a doctor check reporting whether the Codex CLI is installed and signed in.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codex-subagent-mcphave codex investigate why the auth tests are flaky and report back"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
codex-subagent-mcp
An MCP server that lets Claude Code delegate coding tasks to OpenAI's Codex CLI running on the same machine — multi-model orchestration, locally, with the model and reasoning depth chosen per task.
Claude stays the orchestrator. Codex becomes a subagent it can call.
An independent project. Not affiliated with, endorsed by, or supported by OpenAI or Anthropic.
Why this exists
A single model doing everything has three recurring problems, and delegation solves each one:
Your context window is finite. Having Claude read forty files to answer one question spends context you need for the actual work. Delegating the investigation returns the answer instead of the forty files.
One model has one set of blind spots. A second opinion is worth most when it comes from a different model family — different training, different failure modes. Asking the same model twice mostly gets you the same answer twice.
Not every task deserves the same reasoning budget. Renaming a variable and diagnosing a race condition are not the same job. Here they are separate dials: the model sets raw capability, the reasoning effort sets how long it deliberates. Cheap work goes to a fast model; a hard problem gets the capable one thinking for as long as it needs.
Everything stays on your machine. The server drives the Codex CLI you already have installed and holds no credentials of its own.
Related MCP server: claude-code-codex-agents
Requirements
Node.js 20 or newer.
The Codex CLI, installed, on
PATH, and signed in.
You do not have to check this by hand. Run the codex_doctor tool — or just ask Claude to — and it
reports what is missing and the exact commands for your platform. Every other tool runs the same
check first, so you never get a bare spawn ENOENT. Nothing is ever installed on your behalf.
If you do not have the Codex CLI yet:
# macOS — recommended
brew install --cask codex# macOS / Linux — standalone installer
curl -fsSL https://chatgpt.com/codex/install.sh | shOn Windows, use the installer rather than npm:
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex".
Then run codex once to sign in, and confirm with codex login status.
The npm package is not the program: bin/codex.js is a Node wrapper that spawns the real Rust
binary. That has two consequences.
Every invocation pays a Node startup. Measured on macOS: about 80 ms through the wrapper against about 20 ms calling the binary directly. This server spawns the CLI once per tool call, so the cost recurs — though it is still noise next to a delegation that runs for seconds.
A global npm install lives inside the active Node version. Under a version manager such as nvm
it lands in ~/.nvm/versions/node/<version>/lib/node_modules, so switching Node versions takes
codex off PATH until you reinstall it. This is the bigger problem in practice.
On Windows there is a third, harder consequence: a global npm install produces a codex.cmd batch
shim, which cannot be launched without a command shell — and this server never uses one. It detects
that case and says so, but the installer avoids it entirely. See
ADR 11.
Switching is two commands, and your sign-in survives because credentials live in ~/.codex:
npm uninstall -g @openai/codex && brew install --cask codexInstall
claude mcp add codex-subagent -- npx -y codex-subagent-mcpThat works in both the Claude Code CLI and the desktop app; they share the same configuration.
Global install, if you prefer not to go through npx:
npm install -g codex-subagent-mcpThen point Claude Code at the codex-subagent binary.
Claude Desktop has no equivalent command. Add an entry to mcpServers in
claude_desktop_config.json and restart the app:
{
"mcpServers": {
"codex-subagent": {
"command": "npx",
"args": ["-y", "codex-subagent-mcp"]
}
}
}From a clone, for development:
git clone https://github.com/parisbs/codex-subagent-mcp.git
cd codex-subagent-mcp && npm ci && npm run buildThe repository ships a .mcp.json, so running Claude Code from the project root picks the server up.
Set CODEX_BIN if your Codex executable is not called codex or is not on PATH.
First steps
Ask Claude to check the installation:
Check that the Codex subagent is set up correctly.
You should see status: ok, a version, and signed in: yes. Then see what you can delegate to:
What Codex models are available, and what are they each good for?
Then try a real one. This is read-only, so Codex investigates and reports without touching anything:
Have Codex look at this repository and explain how the build is wired together.
Using it
Delegations run read-only by default: Codex investigates and reports, but cannot modify files. Letting it write is a deliberate, separate request.
The examples below are the four situations where delegating beats doing it in the main conversation. Each one has been run against the real Codex CLI — writing them is how two defects in this server were found and fixed.
Get a second opinion from a different model family
The value here is not a second run — it is a different set of blind spots.
Ask Codex to review
src/server.tsfor correctness problems, focusing on error paths. Use a high reasoning effort and tell it to report each finding with the line and why it matters.
Claude picks the model, passes your file as the focus, and returns the findings. This is how the
terminate() defect in this repository's own runner was found: a delegated review spotted that two
code paths could each arm a timer while only one was ever cleared.
Investigate without spending your context
Forty files go into the delegation; one answer comes back.
Have Codex trace how a reasoning effort travels from the MCP tool call down to the arguments handed to the Codex CLI, and report just the call chain.
Codex runs its own searches and reads whatever it needs. Your conversation receives the conclusion, not the search results.
Run long work in the background while you keep going
Kick off a Codex run in the background that writes unit tests for
src/jobs.ts, then keep helping me with the API layer.
You get a job_id immediately. Ask for the status whenever you want, and read the result when it is
done. Up to eight can run at once.
Buy deep reasoning for one hard problem
Raising the reasoning effort for the whole conversation is expensive. Raising it for one delegation is not.
This intermittent test failure has beaten me twice. Ask Codex to work out the root cause at maximum reasoning effort, give it
test/runner.test.tsand the CI log, and tell it not to change anything — I want the diagnosis first.
Keep the thread going
Follow-ups reuse the context Codex already has, so they cost a fraction of the original:
Ask Codex to expand on its second finding.
Let it write, when you mean it
Have Codex apply its first two suggestions. Let it edit files, but keep it inside a git worktree so my working tree stays clean.
That last clause matters: use_worktree confines every change to a managed git worktree under
~/.codex/worktrees/ instead of your checkout, and the result lists every file it touched with the
path where it landed. Worktrees rely on an experimental Codex feature, which the server turns on for
that invocation only — it never changes your Codex configuration.
Whatever the sandbox, a delegation that writes reports what it wrote:
Files changed (2):
- [edit] src/codex/runner.ts
- [add] test/runner.test.tsBefore you start enabling writes as a habit, read the next section. It is short.
Safety
This server runs another program on your machine, so it is worth two minutes before you enable writes.
What protects you
Delegations are read-only by default. Writing requires an explicit sandbox: "workspace-write",
and use_worktree confines those writes to a managed git worktree instead of your checkout.
The confinement is not a promise from the model — it is the operating system's own sandbox (seatbelt on macOS). Measured against Codex CLI 0.154.0:
|
|
| |
Write inside the working directory | no | yes | yes |
Write outside it (your home) | no | no | yes |
Network access | no | no | yes |
Read outside the working directory | yes | yes | yes |
There is also no shell anywhere in the path: the CLI is spawned with an argv array and the prompt is written to its stdin, never interpolated into a command string. Shell metacharacters in a prompt are inert.
What does not protect you
Reads are not confined. That last row is not a typo. Codex can read anything your user account can, in every mode — your SSH keys, your cloud credentials. Network access is blocked so it cannot send them anywhere, but its report comes back to you, and that is a channel.
A prompt is untrusted input, and Codex acts on it. This is prompt injection, and it is the risk
that matters here. If you build a delegation from content you did not write — an issue body, a web
page, a log, a file from someone else's repository — that content can carry instructions. With
workspace-write it can direct Codex to modify your repository; even read-only it can direct Codex
to read something sensitive and put it in the answer. The sandbox bounds where Codex can write. It
does not judge what it should write, or why it was asked.
The result is not sanitised. What comes back is text from a model that just read your files. Treat it as data, not as instructions.
Reducing the risk
Leave the default alone. Read-only handles investigation, review and diagnosis, which is most delegation.
If you never want writes from this server, cap it:
CODEX_SUBAGENT_MAX_SANDBOX=read-only. A ceiling cannot be argued past by anything in the conversation, which is what makes it different from a default.When you do enable writes, add
use_worktreeso changes land somewhere you can inspect before they touch your branch.Do not assemble delegation prompts from untrusted content when you intend to act on the answer.
If this threat matters seriously to you, run Codex under an account or container with no access to your secrets. That solves it at the root instead of bounding it.
SECURITY.md has the full threat model, what a deny_read policy could add, and how to
report a vulnerability.
Choosing a model
Read live from your installed CLI, so this list tracks whatever you have. As of Codex CLI 0.154.0:
Slug | Positioning | Reasoning efforts | Default |
| Most capable, for complex demanding work | low … ultra | low |
| Reliable agentic workhorse | low … ultra | low |
| Balanced everyday coding | low … ultra | medium |
| Fast and affordable | low … max | medium |
| Previous generation | low … xhigh | medium |
Model and reasoning effort are independent. The model sets raw capability; the effort — low,
medium, high, xhigh, max, ultra — sets how long it deliberates before acting. ultra
additionally delegates subtasks automatically.
The server does not choose for you. Which model a task deserves depends on your budget and on how costly a wrong answer is, and a regular expression over a prompt cannot know either. Ask for a delegation without naming a model and it refuses — but the refusal carries the recommendation it would have made, so you decide in one more exchange instead of paying for a guess.
If you would rather not be asked, set a default once and it stops asking:
claude mcp add codex-subagent -e CODEX_SUBAGENT_DEFAULT_MODEL=gpt-5.6-terra -- npx -y codex-subagent-mcpFor advice rather than a decision, ask:
Which Codex model should handle migrating this repo's tests to vitest?
That routes mechanical edits to the fast model at low, everyday work to the balanced one at
medium, multi-file migrations to the agentic workhorse at high, and hard reasoning problems to
the most capable model at xhigh or ultra. It is a suggestion you can ignore. An effort the chosen
model does not support is clamped down, with a note saying so.
Configuration
Everything is optional, and set through environment variables on the MCP server:
Variable | Effect |
| Stops the server asking which model to use. |
| Reasoning effort when a call specifies none. |
| Comma-separated allow-list. Anything else is refused. |
| Ceiling on what a delegation may do. |
| Ceiling on reasoning effort. Useful for keeping |
| Path to the Codex executable, if it is not |
One rule shapes all of these: configuration can only restrict. There is no setting that makes delegations more permissive, which is why you cannot change the default sandbox, only cap it. See Safety for why a ceiling is worth more than a default.
Your own escalation rules belong in your CLAUDE.md, in plain language, where Claude applies them
with actual understanding and they stay yours. See
ADR 12 for why they are not built into this server.
Tools
Tool | What it does |
| Check the Codex CLI installation and report how to fix it. |
| List available models and their reasoning-effort levels. |
| Suggest a model and effort for a described task. |
| Run a task, blocking or in the background. |
| Continue a previous delegation using its |
| Check a background delegation. |
| Read a finished background delegation's output. |
| Stop a running background delegation. |
Full parameter reference: docs/TOOLS.md.
FAQ
Does this cost money?
It uses your existing Codex quota, the same as running codex yourself. This server adds nothing.
Higher reasoning efforts consume more; codex_recommend exists partly so you do not spend ultra
on work that low would have handled.
Can it modify my files?
Not by default. Delegations run read-only unless you explicitly ask for write access, and
use_worktree keeps even those changes out of your working tree.
Why drive the CLI instead of calling the OpenAI API? Delegated coding is not a single completion — it is an agentic loop with a sandbox, an approval model, session persistence and project instruction files. All of that lives in the Codex client, not in the model endpoint. See ADR 1.
Do I need Claude Code, or does Claude Desktop work? Either. Claude Code gets a one-line install; Claude Desktop needs a manual config entry.
It says Codex is not installed, but codex works in my terminal.
Most likely Windows with a global npm install, which produces a codex.cmd batch shim that cannot
be launched without a command shell. codex_doctor reports this as unsupported-shim and offers two
fixes. On macOS and Linux, check whether a Node version manager moved codex off PATH.
Does it work on Windows? CI builds, tests and starts the server on Windows, macOS and Linux on every change, and checks that the Codex CLI is resolved correctly on each. A real delegation has only been verified on macOS — the CI runners have no Codex installation or credentials. Reports from Windows and Linux are welcome.
Can Codex read files outside the directory I point it at? Yes, in every sandbox mode — the sandbox restricts writes and network access, not reads. See Safety for what that means in practice and what to do about it.
Where do worktree changes end up?
Under ~/.codex/worktrees/, and the delegation result gives you the full path of every file it
touched. The server does not clean those worktrees up: they may hold work you have not applied yet.
Documentation
docs/TOOLS.md — every tool and parameter.
docs/adr/ — why the design is what it is, decision by decision.
docs/ROADMAP.md — what is planned, and what is deliberately out of scope.
Issues — what is actually open right now.
docs/VERSIONING.md — what counts as a breaking change here.
CHANGELOG.md — what changed in each release, and the Codex CLI version it was verified against.
CONTRIBUTING.md — setup, and the rules that are not negotiable.
Disclaimer
Not an official product. This is an independent, community project. It is not affiliated with, endorsed by, sponsored by or supported by OpenAI or Anthropic. "Codex", "ChatGPT" and "OpenAI" are trademarks of OpenAI; "Claude" and "Claude Code" are trademarks of Anthropic. They are used here only to describe what this software interoperates with, which is nominative use — no claim is made to any of them. Neither company is responsible for this software, and problems with it should be reported here rather than to them.
No warranty. The software is provided "as is", without warranty of any kind, as stated in LICENSE. You use it at your own risk.
It runs an agent on your machine. This server spawns the Codex CLI as a child process. Depending on the sandbox you allow, that process can read your files, run shell commands and modify your working tree. Read Safety before enabling writes, and review what a delegation did rather than assuming it did what you asked.
It spends your quota. Delegations consume your own OpenAI Codex usage, at whatever rate your
account is billed. Higher reasoning efforts consume more, and ultra delegates subtasks of its own.
This project has no visibility into that cost and does not cap it beyond the limits you configure
yourself.
License
MIT. See LICENSE.
Available Tools
8 toolscodex_delegateDelegate a task to CodexA
Delegate a coding or analysis task to the local Codex CLI, choosing model and reasoning effort. Codex runs read-only by default: it investigates and reports. Set sandbox to workspace-write to let it edit files. Codex cannot see this conversation, so pass everything it needs in prompt, context, and target_files.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | blocking (default) waits and streams progress; background returns a job_id immediately. | |
| model | No | Catalog slug from list_codex_models. Omitted means the recommendation matrix picks one. | |
| prompt | Yes | The task for Codex. Be specific and self-contained: Codex cannot see this conversation. | |
| context | No | Background Codex needs: prior findings, constraints, relevant excerpts. | |
| sandbox | No | Sandbox policy. Defaults to read-only: Codex analyses and reports but cannot modify files. | |
| add_dirs | No | Additional absolute directories that should be writable alongside working_dir. | |
| web_search | No | Enable Codex's native web search tool. | |
| working_dir | No | Absolute path Codex uses as its working root. | |
| auto_approve | No | Adds --approve-for-me so Codex auto-approves its own commands. Only applies when sandbox allows writes. | |
| target_files | No | Paths Codex should focus on, relative to working_dir. | |
| use_worktree | No | Run in a managed git worktree so changes never touch the current working tree. | |
| timeout_seconds | No | Wall-clock budget. Defaults to 1800s. | |
| reasoning_effort | No | Reasoning depth, independent of model choice. Clamped to what the chosen model supports. | |
| acceptance_criteria | No | Concrete conditions that must hold for the task to be considered done. | |
| skip_git_repo_check | No | Allow running outside a git repository. | |
| system_instructions | No | Persona or extra rules inherited from the orchestrator, layered on the built-in quality contract. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false and openWorldHint=true, so the safety bar is lower. The description adds meaningful behavioral context beyond annotations: the default read-only behavior, the workspace-write escape hatch, and the crucial isolation constraint that Codex cannot see this conversation. It doesn't cover timeout defaults or approval implications, which the schema documents.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: what the tool does, the safety default, and the isolation constraint. Front-loaded with purpose and no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 16-parameter delegation tool with rich schema and no output schema, the description covers the essential operational facts an agent must know (default read-only, write enablement, context isolation). It leaves timeout defaults and mode semantics to the schema, which is reasonable given the full coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 16 parameters thoroughly. The description reinforces the prompt/context/target_files trio as the isolation-carrying inputs, which adds a little framing but no syntax or format detail beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (delegate) and resource (coding/analysis task) and names the execution backend (local Codex CLI). It distinguishes itself from siblings like list_codex_models and codex_job_status by being the task-submission entry point.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives real context: Codex runs read-only by default and only edits when sandbox is set to workspace-write, which implicitly tells the agent when to use each mode. It doesn't explicitly route to siblings like codex_recommend or codex_follow_up, so it falls short of 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_doctorCheck the Codex CLI installationARead-only
Check whether the local Codex CLI is installed, recent enough and signed in, and report the exact steps to fix it if not. Run this when any other tool reports the CLI is unavailable, or before relying on delegation for the first time. It only inspects the installation; it never installs or changes anything.
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No | Re-probe the CLI instead of reusing the cached diagnosis. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds that it inspects the installation and reports exact fix steps, and reinforces the no-change boundary, but does not disclose caching behavior or output format. With annotations carrying the safety load, this is a useful but not exceptional addition.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with purpose, then usage triggers, then the scope boundary. Every sentence earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only diagnostic with one optional parameter and no output schema, the description covers purpose, usage triggers, and boundaries sufficiently. It even indicates that failure produces exact fix steps, so an agent can call it correctly without more detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'refresh' parameter, so the schema already explains its meaning. The description adds no parameter-level detail, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: checks whether the local Codex CLI is installed, recent enough, and signed in, and reports exact fix steps. Distinguishes from siblings by framing itself as the diagnostic to run when other tools report CLI unavailability or before relying on delegation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to run: when any other tool reports the CLI is unavailable, or before relying on delegation for the first time. Also sets a boundary ('never installs or changes anything'), which tells the agent not to use it for installation. The alternative (delegation) is implied rather than named, but the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_follow_upContinue a Codex sessionA
Send a follow-up message to a previous delegation using its thread_id. Codex still has the earlier context, so this is much cheaper than re-sending it with codex_delegate.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Override the model for this turn. | |
| prompt | Yes | The follow-up instruction. | |
| sandbox | No | Sandbox policy for this turn. Defaults to read-only. | |
| thread_id | Yes | The thread_id reported by a previous codex_delegate call. | |
| working_dir | No | ||
| auto_approve | No | ||
| timeout_seconds | No | ||
| reasoning_effort | No | Override the reasoning effort for this turn. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=false and openWorldHint=true, so the description carries most of the burden. It usefully adds the context-retention/cost benefit of reusing an existing thread, but says nothing about side effects, permissions, or what state is modified on a follow-up turn.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, no waste, with the thread_id mechanism and the cost rationale front-loaded. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the core purpose and the key routing rationale for an 8-parameter mutation tool, and the thread_id link is clear. However, with no output schema and several undocumented parameters (auto_approve, timeout, working_dir), the description leaves notable behavioral gaps for a non-read-only tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 63%, with model, prompt, sandbox, thread_id and reasoning_effort documented and working_dir, auto_approve, timeout_seconds bare. The description reinforces the thread_id source and the context-reuse semantics, but adds nothing about sandbox, auto_approve, or timeout behavior. Baseline 3 fits the moderate coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('send a follow-up message to a previous delegation') and explicitly anchors it to the thread_id. It distinguishes itself from the sibling codex_delegate by naming it as the more expensive alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear when-to-use: continuing an existing delegation via thread_id, and it names codex_delegate as the alternative for re-sending context. It stops short of explicit when-not conditions (e.g., use codex_delegate for a fresh task), leaving that to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_cancelCancel a background delegationBDestructive
Terminate a running background delegation.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | The job_id returned by codex_delegate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, clearly indicating a destructive operation. The description adds 'running' as a state constraint, which is useful. However, it omits key behavioral details like whether the job is killed immediately or gracefully, whether it can be undone, or what happens to any partial results. With annotations covering the safety profile, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no wasted words. It is front-loaded with the action, though it is extremely terse, which might leave some ambiguity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema) and the annotations covering destructiveness, the description is minimally adequate but lacks important context about side effects, job state requirements, and the return value or confirmation. It should do more to help an agent understand when and how to use it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the single parameter job_id is fully documented in the schema, including that it comes from codex_delegate. The description adds no additional parameter meaning beyond what the schema provides, making the baseline 3 correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Terminate) and resource (running background delegation), which is clearer than the title. However, it does not distinguish itself from siblings like codex_job_status or codex_job_result, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, or when not to use it. The description gives no context about the conditions under which cancellation is appropriate, such as whether the job must be running or what happens if it has already completed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_resultRead a background delegation's resultARead-only
Return the full output of a finished background delegation. Errors if the job is still running.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | The job_id returned by codex_delegate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds a meaningful behavioral constraint: it errors when the job is still running, telling the agent this is a post-completion read with a specific failure mode. It does not discuss output truncation or pagination, so 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, and the completion precondition is front-loaded. The error condition follows immediately after the main action, keeping the most important routing information prominent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read tool with full schema coverage and annotations covering safety, the description supplies the necessary completion precondition and output scope. No output schema exists, so describing the return as 'full output' is appropriately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the only parameter 'job_id' is documented as 'returned by codex_delegate'. The description adds no additional syntax, format, or constraint beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Return') and resource ('full output of a finished background delegation'), and the error condition distinguishes it from a status check. It does not explicitly name sibling codex_job_status as the alternative, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies use only after completion via 'finished background delegation' and 'Errors if the job is still running'. However, it does not explicitly tell the agent to call codex_job_status first or name alternatives, so usage is inferable but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_job_statusCheck a background delegationARead-only
Report the state and recent activity of a background delegation started with mode=background. Call it with no job_id to list every known job.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | No | Omit to list all jobs. | |
| include_activity | No | Include the recent progress log for the job. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds that it reports state plus recent activity and that omitting job_id enumerates all jobs, but says nothing about pagination, log volume, or failure modes for unknown job ids.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core purpose and with the no-arg listing behavior second; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-param, read-only status tool with no output schema, the description covers what is queried (state and activity) and the two calling modes. It is nearly complete, with only return-shape hints and error handling left unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are already documented in the schema; the description's note about omitting job_id restates that documentation rather than adding format or constraint detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (report) plus resource (state and recent activity of a background delegation) and scopes it to delegations started with mode=background, which links it to codex_delegate and separates it from codex_job_result.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives one concrete usage rule — call with no job_id to list every known job — but never says when to prefer this over codex_job_result, codex_follow_up, or codex_job_cancel, so the sibling routing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_recommendRecommend a Codex model and effortARead-only
Given a task description, recommend which Codex model and reasoning effort to delegate it with. Runs no model call; applies a documented matrix reconciled against the installed catalog.
| Name | Required | Description | Default |
|---|---|---|---|
| priority | No | Bias the reasoning effort: quality raises it, latency and cost lower it. Default balanced. | |
| task_description | Yes | What the delegated task involves, in one or two sentences. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish it is a safe read (readOnlyHint=true, openWorldHint=false), and the description usefully adds that no model call occurs and that the result comes from a documented matrix reconciled against the installed catalog. That tells the agent the output is deterministic and catalog-bound, though it doesn't say how recommendations change as the catalog updates.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with zero filler; the core purpose leads and the no-model-call caveat follows as needed qualification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter advisory tool with no output schema, the description covers what it does, that it is deterministic, and where its knowledge comes from. It stops short of characterizing the returned recommendation's shape (model name plus effort level), which would fully close the loop.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (task_description and the priority enum with its quality/latency/cost bias) are already fully documented. The description adds no additional parameter meaning, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (recommend) and precise resource (Codex model plus reasoning effort) and clarifies the input it keys off (a task description). It also implicitly separates itself from the execution siblings by noting it runs no model call, unlike codex_delegate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'to delegate it with' implies this is a pre-delegation advisory step, but it never explicitly says 'call this before codex_delegate' or names any alternative path. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_codex_modelsList Codex modelsARead-only
List the Codex models available on this machine, with the reasoning-effort levels each one supports. Read from the installed Codex CLI, never hardcoded. Call this before codex_delegate when choosing a model explicitly.
| Name | Required | Description | Default |
|---|---|---|---|
| refresh | No | Bypass the cache and re-read the catalog from the CLI. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint=true, openWorldHint=false), so the bar is lower. The description still adds meaningful behavior: the catalog is read from the installed Codex CLI and 'never hardcoded,' which tells the agent results reflect the local environment. It also implies caching via the refresh parameter's semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each carrying distinct information: what is returned, where the data comes from, and when to call it. Front-loaded with the core action and no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does describe the content of the return (models and their reasoning-effort levels), covering the essential shape. It doesn't detail the exact structure or the case where the CLI is absent, but for a single-optional-param read tool this is close to complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single 'refresh' parameter is fully documented there as bypassing the cache. The description adds no syntax or format detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ('List the Codex models available on this machine') plus the scope of what is returned ('reasoning-effort levels each one supports'). It also names the sibling it relates to (codex_delegate), so an agent can distinguish it from the other codex_* tools without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the trigger: 'Call this before codex_delegate when choosing a model explicitly.' That gives a clear when-to-use tied to a named sibling. It stops short of stating when-not-to-use (e.g., when a default model is fine), so it's not fully exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Changed
codex_follow_up1 field changed- added
Input schema / properties / thread_id / patternAdded value: +"^[A-Za-z0-9][A-Za-z0-9_-]{0,199}$"
8 tool updates
v0.1.0- First observed
codex_delegate - First observed
codex_doctor - First observed
codex_follow_up - First observed
codex_job_cancel - First observed
codex_job_result - First observed
codex_job_status - First observed
codex_recommend - First observed
list_codex_models
TDQS
Scored across 8 tools
Each tool targets a clearly distinct operation: delegation, follow-up on a thread, diagnostics, and three separate job-management actions (cancel/result/status) that are well differentiated by their descriptions. The only near-overlap is codex_recommend vs list_codex_models, but one advises and the other enumerates, which the descriptions make explicit.
Most tools follow a consistent codex_<action> or codex_job_<action> snake_case pattern, which is predictable and readable. list_codex_models deviates by putting the verb first (list_) instead of the codex_ prefix used elsewhere, a minor inconsistency in an otherwise coherent scheme.
Eight tools is well-scoped for a delegation wrapper: one core action, one follow-up, three job-lifecycle controls, one diagnostic, and two model-selection helpers. Nothing feels padded or redundant.
The surface covers the full delegation lifecycle (run, follow-up, background status/result/cancel) plus setup diagnostics and model discovery, which is solid coverage of the stated domain. Minor gaps remain, such as no explicit way to enumerate or resume prior threads beyond a job_id from status.
Maintenance
Related MCP Connectors
No-data MCP handoff for local Claude Code to Codex harness moves. $49 lifetime.
Source-checked CLI guides and model-aware planning for Claude Code, Codex, and Grok Build.
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Persistent cross-session memory shared by Codex, Claude Code, ChatGPT, and other AI agents.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables Codex to delegate tasks to Claude Code, allowing Claude to investigate, edit, and verify changes in the repository with background job management.7 npmMIT
- AlicenseAqualityDmaintenanceEnables Claude Code to delegate tasks to OpenAI's Codex CLI (GPT-5.4) with structured execution traces, parallel execution, session persistence, and adversarial code review.15MIT
- AlicenseNot gradedqualityBmaintenanceEnables Claude Code to call OpenAI Codex for read-only design, deep reasoning, and code review tasks.18 npmMIT
- AlicenseNot gradedqualityBmaintenanceEnables Codex to delegate bounded engineering jobs to Claude Code CLI in isolated Git worktrees with strict security and allowance pacing.MIT