Skip to main content
Glama

codex-subagent-mcp

CI License: MIT

An MCP server that lets Claude Code delegate coding tasks to OpenAI's Codex CLI running on the same machine — multi-model orchestration, locally, with the model and reasoning depth chosen per task.

Claude stays the orchestrator. Codex becomes a subagent it can call.

An independent project. Not affiliated with, endorsed by, or supported by OpenAI or Anthropic.

Why this exists

A single model doing everything has three recurring problems, and delegation solves each one:

Your context window is finite. Having Claude read forty files to answer one question spends context you need for the actual work. Delegating the investigation returns the answer instead of the forty files.

One model has one set of blind spots. A second opinion is worth most when it comes from a different model family — different training, different failure modes. Asking the same model twice mostly gets you the same answer twice.

Not every task deserves the same reasoning budget. Renaming a variable and diagnosing a race condition are not the same job. Here they are separate dials: the model sets raw capability, the reasoning effort sets how long it deliberates. Cheap work goes to a fast model; a hard problem gets the capable one thinking for as long as it needs.

Everything stays on your machine. The server drives the Codex CLI you already have installed and holds no credentials of its own.

Related MCP server: claude-code-codex-agents

Requirements

  • Node.js 20 or newer.

  • The Codex CLI, installed, on PATH, and signed in.

You do not have to check this by hand. Run the codex_doctor tool — or just ask Claude to — and it reports what is missing and the exact commands for your platform. Every other tool runs the same check first, so you never get a bare spawn ENOENT. Nothing is ever installed on your behalf.

If you do not have the Codex CLI yet:

# macOS — recommended
brew install --cask codex
# macOS / Linux — standalone installer
curl -fsSL https://chatgpt.com/codex/install.sh | sh

On Windows, use the installer rather than npm: powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex".

Then run codex once to sign in, and confirm with codex login status.

The npm package is not the program: bin/codex.js is a Node wrapper that spawns the real Rust binary. That has two consequences.

Every invocation pays a Node startup. Measured on macOS: about 80 ms through the wrapper against about 20 ms calling the binary directly. This server spawns the CLI once per tool call, so the cost recurs — though it is still noise next to a delegation that runs for seconds.

A global npm install lives inside the active Node version. Under a version manager such as nvm it lands in ~/.nvm/versions/node/<version>/lib/node_modules, so switching Node versions takes codex off PATH until you reinstall it. This is the bigger problem in practice.

On Windows there is a third, harder consequence: a global npm install produces a codex.cmd batch shim, which cannot be launched without a command shell — and this server never uses one. It detects that case and says so, but the installer avoids it entirely. See ADR 11.

Switching is two commands, and your sign-in survives because credentials live in ~/.codex:

npm uninstall -g @openai/codex && brew install --cask codex

Install

claude mcp add codex-subagent -- npx -y codex-subagent-mcp

That works in both the Claude Code CLI and the desktop app; they share the same configuration.

Global install, if you prefer not to go through npx:

npm install -g codex-subagent-mcp

Then point Claude Code at the codex-subagent binary.

Claude Desktop has no equivalent command. Add an entry to mcpServers in claude_desktop_config.json and restart the app:

{
  "mcpServers": {
    "codex-subagent": {
      "command": "npx",
      "args": ["-y", "codex-subagent-mcp"]
    }
  }
}

From a clone, for development:

git clone https://github.com/parisbs/codex-subagent-mcp.git
cd codex-subagent-mcp && npm ci && npm run build

The repository ships a .mcp.json, so running Claude Code from the project root picks the server up.

Set CODEX_BIN if your Codex executable is not called codex or is not on PATH.

First steps

Ask Claude to check the installation:

Check that the Codex subagent is set up correctly.

You should see status: ok, a version, and signed in: yes. Then see what you can delegate to:

What Codex models are available, and what are they each good for?

Then try a real one. This is read-only, so Codex investigates and reports without touching anything:

Have Codex look at this repository and explain how the build is wired together.

Using it

Delegations run read-only by default: Codex investigates and reports, but cannot modify files. Letting it write is a deliberate, separate request.

The examples below are the four situations where delegating beats doing it in the main conversation. Each one has been run against the real Codex CLI — writing them is how two defects in this server were found and fixed.

Get a second opinion from a different model family

The value here is not a second run — it is a different set of blind spots.

Ask Codex to review src/server.ts for correctness problems, focusing on error paths. Use a high reasoning effort and tell it to report each finding with the line and why it matters.

Claude picks the model, passes your file as the focus, and returns the findings. This is how the terminate() defect in this repository's own runner was found: a delegated review spotted that two code paths could each arm a timer while only one was ever cleared.

Investigate without spending your context

Forty files go into the delegation; one answer comes back.

Have Codex trace how a reasoning effort travels from the MCP tool call down to the arguments handed to the Codex CLI, and report just the call chain.

Codex runs its own searches and reads whatever it needs. Your conversation receives the conclusion, not the search results.

Run long work in the background while you keep going

Kick off a Codex run in the background that writes unit tests for src/jobs.ts, then keep helping me with the API layer.

You get a job_id immediately. Ask for the status whenever you want, and read the result when it is done. Up to eight can run at once.

Buy deep reasoning for one hard problem

Raising the reasoning effort for the whole conversation is expensive. Raising it for one delegation is not.

This intermittent test failure has beaten me twice. Ask Codex to work out the root cause at maximum reasoning effort, give it test/runner.test.ts and the CI log, and tell it not to change anything — I want the diagnosis first.

Keep the thread going

Follow-ups reuse the context Codex already has, so they cost a fraction of the original:

Ask Codex to expand on its second finding.

Let it write, when you mean it

Have Codex apply its first two suggestions. Let it edit files, but keep it inside a git worktree so my working tree stays clean.

That last clause matters: use_worktree confines every change to a managed git worktree under ~/.codex/worktrees/ instead of your checkout, and the result lists every file it touched with the path where it landed. Worktrees rely on an experimental Codex feature, which the server turns on for that invocation only — it never changes your Codex configuration.

Whatever the sandbox, a delegation that writes reports what it wrote:

Files changed (2):
- [edit] src/codex/runner.ts
- [add] test/runner.test.ts

Before you start enabling writes as a habit, read the next section. It is short.

Safety

This server runs another program on your machine, so it is worth two minutes before you enable writes.

What protects you

Delegations are read-only by default. Writing requires an explicit sandbox: "workspace-write", and use_worktree confines those writes to a managed git worktree instead of your checkout.

The confinement is not a promise from the model — it is the operating system's own sandbox (seatbelt on macOS). Measured against Codex CLI 0.154.0:

read-only

workspace-write

danger-full-access

Write inside the working directory

no

yes

yes

Write outside it (your home)

no

no

yes

Network access

no

no

yes

Read outside the working directory

yes

yes

yes

There is also no shell anywhere in the path: the CLI is spawned with an argv array and the prompt is written to its stdin, never interpolated into a command string. Shell metacharacters in a prompt are inert.

What does not protect you

Reads are not confined. That last row is not a typo. Codex can read anything your user account can, in every mode — your SSH keys, your cloud credentials. Network access is blocked so it cannot send them anywhere, but its report comes back to you, and that is a channel.

A prompt is untrusted input, and Codex acts on it. This is prompt injection, and it is the risk that matters here. If you build a delegation from content you did not write — an issue body, a web page, a log, a file from someone else's repository — that content can carry instructions. With workspace-write it can direct Codex to modify your repository; even read-only it can direct Codex to read something sensitive and put it in the answer. The sandbox bounds where Codex can write. It does not judge what it should write, or why it was asked.

The result is not sanitised. What comes back is text from a model that just read your files. Treat it as data, not as instructions.

Reducing the risk

  • Leave the default alone. Read-only handles investigation, review and diagnosis, which is most delegation.

  • If you never want writes from this server, cap it: CODEX_SUBAGENT_MAX_SANDBOX=read-only. A ceiling cannot be argued past by anything in the conversation, which is what makes it different from a default.

  • When you do enable writes, add use_worktree so changes land somewhere you can inspect before they touch your branch.

  • Do not assemble delegation prompts from untrusted content when you intend to act on the answer.

  • If this threat matters seriously to you, run Codex under an account or container with no access to your secrets. That solves it at the root instead of bounding it.

SECURITY.md has the full threat model, what a deny_read policy could add, and how to report a vulnerability.

Choosing a model

Read live from your installed CLI, so this list tracks whatever you have. As of Codex CLI 0.154.0:

Slug

Positioning

Reasoning efforts

Default

gpt-6-astra

Most capable, for complex demanding work

low … ultra

low

gpt-5.6-sol

Reliable agentic workhorse

low … ultra

low

gpt-5.6-terra

Balanced everyday coding

low … ultra

medium

gpt-5.6-luna

Fast and affordable

low … max

medium

gpt-5.5

Previous generation

low … xhigh

medium

Model and reasoning effort are independent. The model sets raw capability; the effort — low, medium, high, xhigh, max, ultra — sets how long it deliberates before acting. ultra additionally delegates subtasks automatically.

The server does not choose for you. Which model a task deserves depends on your budget and on how costly a wrong answer is, and a regular expression over a prompt cannot know either. Ask for a delegation without naming a model and it refuses — but the refusal carries the recommendation it would have made, so you decide in one more exchange instead of paying for a guess.

If you would rather not be asked, set a default once and it stops asking:

claude mcp add codex-subagent -e CODEX_SUBAGENT_DEFAULT_MODEL=gpt-5.6-terra -- npx -y codex-subagent-mcp

For advice rather than a decision, ask:

Which Codex model should handle migrating this repo's tests to vitest?

That routes mechanical edits to the fast model at low, everyday work to the balanced one at medium, multi-file migrations to the agentic workhorse at high, and hard reasoning problems to the most capable model at xhigh or ultra. It is a suggestion you can ignore. An effort the chosen model does not support is clamped down, with a note saying so.

Configuration

Everything is optional, and set through environment variables on the MCP server:

Variable

Effect

CODEX_SUBAGENT_DEFAULT_MODEL

Stops the server asking which model to use.

CODEX_SUBAGENT_DEFAULT_EFFORT

Reasoning effort when a call specifies none.

CODEX_SUBAGENT_ALLOWED_MODELS

Comma-separated allow-list. Anything else is refused.

CODEX_SUBAGENT_MAX_SANDBOX

Ceiling on what a delegation may do. read-only forbids writing outright.

CODEX_SUBAGENT_MAX_EFFORT

Ceiling on reasoning effort. Useful for keeping ultra off the table.

CODEX_BIN

Path to the Codex executable, if it is not codex on PATH.

One rule shapes all of these: configuration can only restrict. There is no setting that makes delegations more permissive, which is why you cannot change the default sandbox, only cap it. See Safety for why a ceiling is worth more than a default.

Your own escalation rules belong in your CLAUDE.md, in plain language, where Claude applies them with actual understanding and they stay yours. See ADR 12 for why they are not built into this server.

Tools

Tool

What it does

codex_doctor

Check the Codex CLI installation and report how to fix it.

list_codex_models

List available models and their reasoning-effort levels.

codex_recommend

Suggest a model and effort for a described task.

codex_delegate

Run a task, blocking or in the background.

codex_follow_up

Continue a previous delegation using its thread_id.

codex_job_status

Check a background delegation.

codex_job_result

Read a finished background delegation's output.

codex_job_cancel

Stop a running background delegation.

Full parameter reference: docs/TOOLS.md.

FAQ

Does this cost money? It uses your existing Codex quota, the same as running codex yourself. This server adds nothing. Higher reasoning efforts consume more; codex_recommend exists partly so you do not spend ultra on work that low would have handled.

Can it modify my files? Not by default. Delegations run read-only unless you explicitly ask for write access, and use_worktree keeps even those changes out of your working tree.

Why drive the CLI instead of calling the OpenAI API? Delegated coding is not a single completion — it is an agentic loop with a sandbox, an approval model, session persistence and project instruction files. All of that lives in the Codex client, not in the model endpoint. See ADR 1.

Do I need Claude Code, or does Claude Desktop work? Either. Claude Code gets a one-line install; Claude Desktop needs a manual config entry.

It says Codex is not installed, but codex works in my terminal. Most likely Windows with a global npm install, which produces a codex.cmd batch shim that cannot be launched without a command shell. codex_doctor reports this as unsupported-shim and offers two fixes. On macOS and Linux, check whether a Node version manager moved codex off PATH.

Does it work on Windows? CI builds, tests and starts the server on Windows, macOS and Linux on every change, and checks that the Codex CLI is resolved correctly on each. A real delegation has only been verified on macOS — the CI runners have no Codex installation or credentials. Reports from Windows and Linux are welcome.

Can Codex read files outside the directory I point it at? Yes, in every sandbox mode — the sandbox restricts writes and network access, not reads. See Safety for what that means in practice and what to do about it.

Where do worktree changes end up? Under ~/.codex/worktrees/, and the delegation result gives you the full path of every file it touched. The server does not clean those worktrees up: they may hold work you have not applied yet.

Documentation

  • docs/TOOLS.md — every tool and parameter.

  • docs/adr/ — why the design is what it is, decision by decision.

  • docs/ROADMAP.md — what is planned, and what is deliberately out of scope.

  • Issues — what is actually open right now.

  • docs/VERSIONING.md — what counts as a breaking change here.

  • CHANGELOG.md — what changed in each release, and the Codex CLI version it was verified against.

  • CONTRIBUTING.md — setup, and the rules that are not negotiable.

Disclaimer

Not an official product. This is an independent, community project. It is not affiliated with, endorsed by, sponsored by or supported by OpenAI or Anthropic. "Codex", "ChatGPT" and "OpenAI" are trademarks of OpenAI; "Claude" and "Claude Code" are trademarks of Anthropic. They are used here only to describe what this software interoperates with, which is nominative use — no claim is made to any of them. Neither company is responsible for this software, and problems with it should be reported here rather than to them.

No warranty. The software is provided "as is", without warranty of any kind, as stated in LICENSE. You use it at your own risk.

It runs an agent on your machine. This server spawns the Codex CLI as a child process. Depending on the sandbox you allow, that process can read your files, run shell commands and modify your working tree. Read Safety before enabling writes, and review what a delegation did rather than assuming it did what you asked.

It spends your quota. Delegations consume your own OpenAI Codex usage, at whatever rate your account is billed. Higher reasoning efforts consume more, and ultra delegates subtasks of its own. This project has no visibility into that cost and does not cap it beyond the limits you configure yourself.

License

MIT. See LICENSE.

Available Tools

8 tools
codex_delegateDelegate a task to CodexA

Delegate a coding or analysis task to the local Codex CLI, choosing model and reasoning effort. Codex runs read-only by default: it investigates and reports. Set sandbox to workspace-write to let it edit files. Codex cannot see this conversation, so pass everything it needs in prompt, context, and target_files.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNoblocking (default) waits and streams progress; background returns a job_id immediately.
modelNoCatalog slug from list_codex_models. Omitted means the recommendation matrix picks one.
promptYesThe task for Codex. Be specific and self-contained: Codex cannot see this conversation.
contextNoBackground Codex needs: prior findings, constraints, relevant excerpts.
sandboxNoSandbox policy. Defaults to read-only: Codex analyses and reports but cannot modify files.
add_dirsNoAdditional absolute directories that should be writable alongside working_dir.
web_searchNoEnable Codex's native web search tool.
working_dirNoAbsolute path Codex uses as its working root.
auto_approveNoAdds --approve-for-me so Codex auto-approves its own commands. Only applies when sandbox allows writes.
target_filesNoPaths Codex should focus on, relative to working_dir.
use_worktreeNoRun in a managed git worktree so changes never touch the current working tree.
timeout_secondsNoWall-clock budget. Defaults to 1800s.
reasoning_effortNoReasoning depth, independent of model choice. Clamped to what the chosen model supports.
acceptance_criteriaNoConcrete conditions that must hold for the task to be considered done.
skip_git_repo_checkNoAllow running outside a git repository.
system_instructionsNoPersona or extra rules inherited from the orchestrator, layered on the built-in quality contract.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=false and openWorldHint=true, so the safety bar is lower. The description adds meaningful behavioral context beyond annotations: the default read-only behavior, the workspace-write escape hatch, and the crucial isolation constraint that Codex cannot see this conversation. It doesn't cover timeout defaults or approval implications, which the schema documents.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: what the tool does, the safety default, and the isolation constraint. Front-loaded with purpose and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 16-parameter delegation tool with rich schema and no output schema, the description covers the essential operational facts an agent must know (default read-only, write enablement, context isolation). It leaves timeout defaults and mode semantics to the schema, which is reasonable given the full coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 16 parameters thoroughly. The description reinforces the prompt/context/target_files trio as the isolation-carrying inputs, which adds a little framing but no syntax or format detail beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (delegate) and resource (coding/analysis task) and names the execution backend (local Codex CLI). It distinguishes itself from siblings like list_codex_models and codex_job_status by being the task-submission entry point.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives real context: Codex runs read-only by default and only edits when sandbox is set to workspace-write, which implicitly tells the agent when to use each mode. It doesn't explicitly route to siblings like codex_recommend or codex_follow_up, so it falls short of 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_doctorCheck the Codex CLI installationA
Read-only

Check whether the local Codex CLI is installed, recent enough and signed in, and report the exact steps to fix it if not. Run this when any other tool reports the CLI is unavailable, or before relying on delegation for the first time. It only inspects the installation; it never installs or changes anything.

ParametersJSON Schema
NameRequiredDescriptionDefault
refreshNoRe-probe the CLI instead of reusing the cached diagnosis.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds that it inspects the installation and reports exact fix steps, and reinforces the no-change boundary, but does not disclose caching behavior or output format. With annotations carrying the safety load, this is a useful but not exceptional addition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with purpose, then usage triggers, then the scope boundary. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only diagnostic with one optional parameter and no output schema, the description covers purpose, usage triggers, and boundaries sufficiently. It even indicates that failure produces exact fix steps, so an agent can call it correctly without more detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for the single 'refresh' parameter, so the schema already explains its meaning. The description adds no parameter-level detail, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: checks whether the local Codex CLI is installed, recent enough, and signed in, and reports exact fix steps. Distinguishes from siblings by framing itself as the diagnostic to run when other tools report CLI unavailability or before relying on delegation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to run: when any other tool reports the CLI is unavailable, or before relying on delegation for the first time. Also sets a boundary ('never installs or changes anything'), which tells the agent not to use it for installation. The alternative (delegation) is implied rather than named, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_follow_upContinue a Codex sessionA

Send a follow-up message to a previous delegation using its thread_id. Codex still has the earlier context, so this is much cheaper than re-sending it with codex_delegate.

ParametersJSON Schema
NameRequiredDescriptionDefault
modelNoOverride the model for this turn.
promptYesThe follow-up instruction.
sandboxNoSandbox policy for this turn. Defaults to read-only.
thread_idYesThe thread_id reported by a previous codex_delegate call.
working_dirNo
auto_approveNo
timeout_secondsNo
reasoning_effortNoOverride the reasoning effort for this turn.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false and openWorldHint=true, so the description carries most of the burden. It usefully adds the context-retention/cost benefit of reusing an existing thread, but says nothing about side effects, permissions, or what state is modified on a follow-up turn.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, no waste, with the thread_id mechanism and the cost rationale front-loaded. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the core purpose and the key routing rationale for an 8-parameter mutation tool, and the thread_id link is clear. However, with no output schema and several undocumented parameters (auto_approve, timeout, working_dir), the description leaves notable behavioral gaps for a non-read-only tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 63%, with model, prompt, sandbox, thread_id and reasoning_effort documented and working_dir, auto_approve, timeout_seconds bare. The description reinforces the thread_id source and the context-reuse semantics, but adds nothing about sandbox, auto_approve, or timeout behavior. Baseline 3 fits the moderate coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('send a follow-up message to a previous delegation') and explicitly anchors it to the thread_id. It distinguishes itself from the sibling codex_delegate by naming it as the more expensive alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clear when-to-use: continuing an existing delegation via thread_id, and it names codex_delegate as the alternative for re-sending context. It stops short of explicit when-not conditions (e.g., use codex_delegate for a fresh task), leaving that to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_job_cancelCancel a background delegationB
Destructive

Terminate a running background delegation.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesThe job_id returned by codex_delegate.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, clearly indicating a destructive operation. The description adds 'running' as a state constraint, which is useful. However, it omits key behavioral details like whether the job is killed immediately or gracefully, whether it can be undone, or what happens to any partial results. With annotations covering the safety profile, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with no wasted words. It is front-loaded with the action, though it is extremely terse, which might leave some ambiguity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, no output schema) and the annotations covering destructiveness, the description is minimally adequate but lacks important context about side effects, job state requirements, and the return value or confirmation. It should do more to help an agent understand when and how to use it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the single parameter job_id is fully documented in the schema, including that it comes from codex_delegate. The description adds no additional parameter meaning beyond what the schema provides, making the baseline 3 correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Terminate) and resource (running background delegation), which is clearer than the title. However, it does not distinguish itself from siblings like codex_job_status or codex_job_result, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives, or when not to use it. The description gives no context about the conditions under which cancellation is appropriate, such as whether the job must be running or what happens if it has already completed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_job_resultRead a background delegation's resultA
Read-only

Return the full output of a finished background delegation. Errors if the job is still running.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYesThe job_id returned by codex_delegate.

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds a meaningful behavioral constraint: it errors when the job is still running, telling the agent this is a post-completion read with a specific failure mode. It does not discuss output truncation or pagination, so 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, and the completion precondition is front-loaded. The error condition follows immediately after the main action, keeping the most important routing information prominent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with full schema coverage and annotations covering safety, the description supplies the necessary completion precondition and output scope. No output schema exists, so describing the return as 'full output' is appropriately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the only parameter 'job_id' is documented as 'returned by codex_delegate'. The description adds no additional syntax, format, or constraint beyond the schema, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Return') and resource ('full output of a finished background delegation'), and the error condition distinguishes it from a status check. It does not explicitly name sibling codex_job_status as the alternative, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies use only after completion via 'finished background delegation' and 'Errors if the job is still running'. However, it does not explicitly tell the agent to call codex_job_status first or name alternatives, so usage is inferable but not spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_job_statusCheck a background delegationA
Read-only

Report the state and recent activity of a background delegation started with mode=background. Call it with no job_id to list every known job.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idNoOmit to list all jobs.
include_activityNoInclude the recent progress log for the job.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds that it reports state plus recent activity and that omitting job_id enumerates all jobs, but says nothing about pagination, log volume, or failure modes for unknown job ids.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core purpose and with the no-arg listing behavior second; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-required-param, read-only status tool with no output schema, the description covers what is queried (state and activity) and the two calling modes. It is nearly complete, with only return-shape hints and error handling left unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters are already documented in the schema; the description's note about omitting job_id restates that documentation rather than adding format or constraint detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (report) plus resource (state and recent activity of a background delegation) and scopes it to delegations started with mode=background, which links it to codex_delegate and separates it from codex_job_result.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives one concrete usage rule — call with no job_id to list every known job — but never says when to prefer this over codex_job_result, codex_follow_up, or codex_job_cancel, so the sibling routing is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_recommendRecommend a Codex model and effortA
Read-only

Given a task description, recommend which Codex model and reasoning effort to delegate it with. Runs no model call; applies a documented matrix reconciled against the installed catalog.

ParametersJSON Schema
NameRequiredDescriptionDefault
priorityNoBias the reasoning effort: quality raises it, latency and cost lower it. Default balanced.
task_descriptionYesWhat the delegated task involves, in one or two sentences.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish it is a safe read (readOnlyHint=true, openWorldHint=false), and the description usefully adds that no model call occurs and that the result comes from a documented matrix reconciled against the installed catalog. That tells the agent the output is deterministic and catalog-bound, though it doesn't say how recommendations change as the catalog updates.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with zero filler; the core purpose leads and the no-model-call caveat follows as needed qualification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter advisory tool with no output schema, the description covers what it does, that it is deterministic, and where its knowledge comes from. It stops short of characterizing the returned recommendation's shape (model name plus effort level), which would fully close the loop.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (task_description and the priority enum with its quality/latency/cost bias) are already fully documented. The description adds no additional parameter meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (recommend) and precise resource (Codex model plus reasoning effort) and clarifies the input it keys off (a task description). It also implicitly separates itself from the execution siblings by noting it runs no model call, unlike codex_delegate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'to delegate it with' implies this is a pre-delegation advisory step, but it never explicitly says 'call this before codex_delegate' or names any alternative path. Usage is inferable rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_codex_modelsList Codex modelsA
Read-only

List the Codex models available on this machine, with the reasoning-effort levels each one supports. Read from the installed Codex CLI, never hardcoded. Call this before codex_delegate when choosing a model explicitly.

ParametersJSON Schema
NameRequiredDescriptionDefault
refreshNoBypass the cache and re-read the catalog from the CLI.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnlyHint=true, openWorldHint=false), so the bar is lower. The description still adds meaningful behavior: the catalog is read from the installed Codex CLI and 'never hardcoded,' which tells the agent results reflect the local environment. It also implies caching via the refresh parameter's semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, each carrying distinct information: what is returned, where the data comes from, and when to call it. Front-loaded with the core action and no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does describe the content of the return (models and their reasoning-effort levels), covering the essential shape. It doesn't detail the exact structure or the case where the CLI is absent, but for a single-optional-param read tool this is close to complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single 'refresh' parameter is fully documented there as bypassing the cache. The description adds no syntax or format detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource ('List the Codex models available on this machine') plus the scope of what is returned ('reasoning-effort levels each one supports'). It also names the sibling it relates to (codex_delegate), so an agent can distinguish it from the other codex_* tools without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states the trigger: 'Call this before codex_delegate when choosing a model explicitly.' That gives a clear when-to-use tied to a named sibling. It stops short of stating when-not-to-use (e.g., when a default model is fine), so it's not fully exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Changedcodex_follow_up1 field changed
      • addedInput schema / properties / thread_id / pattern
        Added value: +"^[A-Za-z0-9][A-Za-z0-9_-]{0,199}$"
  2. 8 tool updatesv0.1.0
    • First observedcodex_delegate
    • First observedcodex_doctor
    • First observedcodex_follow_up
    • First observedcodex_job_cancel
    • First observedcodex_job_result
    • First observedcodex_job_status
    • First observedcodex_recommend
    • First observedlist_codex_models

TDQS

A3.9/5.0

Scored across 8 tools

Disambiguation5/5

Each tool targets a clearly distinct operation: delegation, follow-up on a thread, diagnostics, and three separate job-management actions (cancel/result/status) that are well differentiated by their descriptions. The only near-overlap is codex_recommend vs list_codex_models, but one advises and the other enumerates, which the descriptions make explicit.

Naming Consistency4/5

Most tools follow a consistent codex_<action> or codex_job_<action> snake_case pattern, which is predictable and readable. list_codex_models deviates by putting the verb first (list_) instead of the codex_ prefix used elsewhere, a minor inconsistency in an otherwise coherent scheme.

Tool Count5/5

Eight tools is well-scoped for a delegation wrapper: one core action, one follow-up, three job-lifecycle controls, one diagnostic, and two model-selection helpers. Nothing feels padded or redundant.

Completeness4/5

The surface covers the full delegation lifecycle (run, follow-up, background status/result/cancel) plus setup diagnostics and model discovery, which is solid coverage of the stated domain. Minor gaps remain, such as no explicit way to enumerate or resume prior threads beyond a job_id from status.

Maintenance

ActivityMaintained
ResponsivenessResponsive

Related MCP Connectors

Related MCP Servers