Skip to main content
Glama

Codex Supervisor MCP

Eine lokale Model Context Protocol (MCP)-Brücke, die es einem kompatiblen Host ermöglicht, Codex-App-Server-Arbeit zu starten, zu überwachen, zu steuern, zu unterbrechen, fortzusetzen und zu genehmigen.

Es kapselt codex app-server; es automatisiert keine Terminal-Benutzeroberfläche und extrahiert keine Daten aus einer IDE.

Funktionen

Der Server stellt diese MCP-Tools bereit:

Tool

Zweck

codex_start

Startet einen neuen Codex-Thread und arbeitet in einem erlaubten Repository.

codex_send

Sendet eine neue Anweisung, sobald der aktive Turn inaktiv ist.

codex_steer

Fügt dem aktiven Turn Anleitungen hinzu.

codex_status

Liest Thread-Zustand, letzte Ereignisse, die neueste Agent-Nachricht, Diff und ausstehende Anfragen.

codex_wait

Long-poll bis Abschluss, Fehler, Unterbrechung oder eine Genehmigungsanfrage.

codex_interrupt

Unterbricht einen aktiven Turn.

codex_list_threads

Listet persistierte Threads in konfigurierten Roots auf.

codex_read_thread

Liest einen persistierten autorisierten Thread.

codex_list_approvals

Untersucht ausstehende App-Server-Anfragen.

codex_resolve_approval

Akzeptiert, lehnt ab oder storniert Genehmigungen für Befehlsausführung und Dateiänderungen.

Related MCP server: Codex Bridge MCP

Anforderungen

  • Node.js 22 oder neuer.

  • Eine aktuelle Codex-CLI, verfügbar als codex.

  • Codex-CLI-Authentifizierung bereits konfiguriert.

  • Ein oder mehrere explizite lokale Repository-Roots.

Dieses Projekt hat keine npm-Laufzeitabhängigkeiten.

Paket verifizieren

npm test

Die Testsuite verwendet einen protokollkompatiblen Mock-App-Server. Sie stellt keine Modellanfragen und erfordert keine Codex-Authentifizierung.

Installation mit der Codex-CLI

Verwenden Sie den MCP-Servernamen codex-supervisor. Der Name muss CODEX_SUPERVISOR_MCP_NAME entsprechen; die Brücke verwendet ihn, um zu verhindern, dass der untergeordnete App-Server diesen MCP-Server rekursiv lädt.

macOS oder Linux

codex mcp add codex-supervisor \
  --env CODEX_ALLOWED_ROOTS="/Users/you/code:/Users/you/work" \
  --env CODEX_SUPERVISOR_MCP_NAME="codex-supervisor" \
  -- node "/absolute/path/to/codex-supervisor-mcp/src/index.mjs"

Verwenden Sie das Pfadlisten-Trennzeichen der Plattform zwischen den Roots. Auf macOS und Linux ist es ein Doppelpunkt (:).

Windows PowerShell

codex mcp add codex-supervisor `
  --env CODEX_ALLOWED_ROOTS="C:\src;D:\work" `
  --env CODEX_SUPERVISOR_MCP_NAME="codex-supervisor" `
  -- node "C:\absolute\path\to\codex-supervisor-mcp\src\index.mjs"

Unter Windows ist das Pfadlisten-Trennzeichen ein Semikolon (;).

Bestätigen Sie die Registrierung:

codex mcp list

Geben Sie in Codex /mcp ein, um den verbundenen Server zu überprüfen.

Installation mit config.toml

Kopieren und passen Sie examples/config.toml an, und legen Sie den Inhalt in ~/.codex/config.toml oder im .codex/config.toml eines vertrauenswürdigen Projekts ab.

Verwenden Sie absolute Pfade. Lassen Sie die Server-ID und CODEX_SUPERVISOR_MCP_NAME identisch.

ChatGPT-Desktop oder die Codex-IDE-Erweiterung

  1. Öffnen Sie Einstellungen → MCP-Server → Server hinzufügen.

  2. Setzen Sie den Namen auf codex-supervisor.

  3. Wählen Sie STDIO.

  4. Setzen Sie den Befehl auf node.

  5. Fügen Sie den absoluten Pfad zu src/index.mjs als einziges Argument hinzu.

  6. Fügen Sie CODEX_ALLOWED_ROOTS und CODEX_SUPERVISOR_MCP_NAME=codex-supervisor hinzu.

  7. Speichern Sie und starten Sie den Host neu.

  8. Geben Sie /mcp ein, um die Tools zu überprüfen.

Lokale STDIO-MCP-Server werden von normalen ChatGPT-Web-Chats nicht geladen. Die Nutzung dieser Brücke über das Web erfordert einen separat bereitgestellten, authentifizierten Remote-MCP-Dienst oder ein gehostetes Plugin.

Typischer Arbeitsablauf

Bitten Sie den MCP-Host:

Use codex_start in /absolute/path/to/repository to implement the requested
change. Use workspaceWrite, keep network access disabled, wait for progress,
show me every approval request before resolving it, and report the final diff
and test result.

Der Host sollte dieser Reihenfolge folgen:

codex_start -> codex_wait
  approval request -> inspect -> codex_resolve_approval -> codex_wait
  active correction -> codex_steer -> codex_wait
  completed -> codex_status
  later follow-up -> codex_send -> codex_wait

Jeder Start-/Sende-/Steuer-/Unterbrechungsaufruf gibt einen eventCursor zurück. Übergeben Sie ihn als afterSequence an codex_wait oder codex_status, um die Wiedergabe älterer Ereignisse zu vermeiden.

approvalPolicy akzeptiert die aktuellen App-Server-Drahtwerte on-request (Standard) und untrusted. Die Legacy-Werte onRequest und unlessTrusted werden von der Brücke akzeptiert und vor der App-Server-Anfrage normalisiert.

Die öffentliche Genehmigungs-API akzeptiert decline, selbst wenn eine Codex-App-Server-Version für die Anfrage nur cancel angibt. In diesem Fall verwendet die Brücke die sichere App-Server-Stornierungsantwort und meldet sowohl die angeforderte als auch die tatsächlich wirksame Entscheidung.

Konfiguration

Variable

Standard

Bedeutung

CODEX_ALLOWED_ROOTS

Erforderlich

Repository-Roots, getrennt durch das Pfadlisten-Trennzeichen der Plattform.

CODEX_BIN

codex

Pfad zur nativen Codex-Ausführungsdatei. Windows-.cmd-, .bat- und .ps1-Shims werden abgelehnt.

CODEX_SUPERVISOR_MCP_NAME

codex-supervisor

MCP-Konfigurations-ID, die im verschachtelten App-Server deaktiviert ist, um Rekursion zu verhindern.

CODEX_ALLOW_NETWORK

0

Auf 1 setzen, um Aufrufern zu erlauben, Netzwerkzugriff anzufordern.

CODEX_EVENT_LIMIT

1000

Anzahl der Ereignisse im Speicher, begrenzt auf 100–10.000.

CODEX_SUPERVISOR_DEBUG

0

Auf 1 setzen, um den stderr des Codex-App-Servers an den stderr dieses Servers zu kopieren.

CODEX_APP_SERVER_ARGS

Interner sicherer Standard

Erweitertes JSON-Array, das jedes an codex übergebene Argument ersetzt.

Die Standard-App-Server-Argumente entsprechen:

-c mcp_servers.<CODEX_SUPERVISOR_MCP_NAME>.enabled=false app-server

Das Überschreiben von CODEX_APP_SERVER_ARGS entfernt diesen Rekursionsschutz. Fügen Sie selbst einen entsprechenden Deaktivierungs-Override hinzu.

Sicherheitsmodell

  • CODEX_ALLOWED_ROOTS ist obligatorisch.

  • Pfade werden mit realpath kanonisiert; Symlink-Ausbrüche werden abgelehnt.

  • Codex erhält eingeschränkten Lesezugriff auf das ausgewählte Repository und die Plattformstandards.

  • workspaceWrite begrenzt beschreibbare Roots auf das ausgewählte Repository.

  • dangerFullAccess wird nicht verfügbar gemacht.

  • Netzwerkzugriff erfordert sowohl CODEX_ALLOW_NETWORK=1 als auch networkAccess: true bei einer Aufgabe.

  • Die Brücke hat kein generisches, nicht-sandboxed Shell-Tool.

  • Genehmigungen für Befehlsausführung und Dateiänderungen müssen explizit aufgelöst werden.

  • Threads außerhalb der erlaubten Roots werden abgelehnt oder gefiltert.

  • Ereignisnutzlasten werden vor der Speicherung in ihrer Größe begrenzt.

  • Gespeicherte Thread-Pfade werden bei der Verwendung erneut kanonisiert; gelöschte oder ersetzte Repository-Pfade schließen sicher fehl (fail closed).

  • Mutationen innerhalb desselben Threads, Genehmigungsantworten und wiederholte Remote-Aufrufe werden serialisiert oder dedupliziert, anstatt zweimal ausgeführt zu werden.

  • Transportfehler werden rekursiv geschwärzt und in der Größe begrenzt, bevor sie STDIO- oder HTTP-Grenzen überschreiten.

  • Relay- und Remote-Server-Anmeldedaten (BIOTELE_* und CODEX_REMOTE_*) werden aus der untergeordneten Codex-Umgebung entfernt.

  • Remote-Ergebniseinreichungen werden HMAC-authentifiziert, base64url-kodiert, in begrenzte Blöcke aufgeteilt und vor der Verwendung anhand von Länge und SHA-256 verifiziert. Die Kodierung schützt den Transport vor Inhaltsfiltern; sie ist keine Verschlüsselung.

Der untergeordnete App-Server erbt weiterhin Nicht-Relay-Prozesseinstellungen und Ihre umfassendere Codex-Konfiguration. Prüfen Sie andere Umgebungsgeheimnisse, Apps, Skills, Hooks und konfigurierte MCP-Server, bevor Sie ihn mit nicht vertrauenswürdigem Code verwenden. Das Entfernen von Umgebungsvariablen ist keine Sicherheitsgrenze des Betriebssystems: Ein untergeordneter Prozess, der als derselbe Windows-Benutzer läuft, kann gezielt benutzerspezifische Einstellungen abfragen. Verwenden Sie ein dediziertes Windows-Konto, wenn diese Bedrohung relevant ist.

Unterstützte Genehmigungsanfragen

Diese Version bearbeitet:

  • item/commandExecution/requestApproval

  • item/fileChange/requestApproval

Andere App-Server-Anfragen bleiben über codex_status und codex_list_approvals sichtbar, aber die Brücke weigert sich, sie zu beantworten. Dies verhindert, dass ein generischer Antwort-Endpunkt stillschweigend Berechtigungen erteilt oder sensible Benutzereingaben liefert.

Persistenz und Überwachung

Codex besitzt den persistierten Thread-Verlauf. Die Brücke hält gestreamte Ereignispuffer, letzte Deltas und den Zustand ausstehender Anfragen im Speicher. Ein Neustart des MCP-Servers löscht diesen transienten Zustand, aber codex_list_threads und codex_read_thread können autorisierte persistierte Threads wiederherstellen.

Entwicklung

npm test
node --check src/index.mjs

Projektstruktur:

src/app-server-client.mjs  Codex app-server JSONL client
src/approval-policy.mjs    Approval-policy validation and legacy normalization
src/event-store.mjs        Bounded event, turn, and approval state
src/security.mjs           Repository-root policy
src/supervisor-service.mjs Codex lifecycle orchestration
src/tool-registry.mjs      MCP tool schemas and validation
src/mcp-server.mjs         Dual-era MCP STDIO transport
src/index.mjs              Entrypoint
test/                      Unit and integration tests

Lizenz

MIT

Kompatibilität mit dem Codex App Server

Version 1.0.3 entfernt die veralteten Felder readOnly.access und workspaceWrite.readOnlyAccess aus turn/start. Aktuelle Codex-App- Server-Versionen verwenden Berechtigungsprofile, wenn ein Client benutzerdefinierte eingeschränkte Lesebereiche benötigt. Der Supervisor schränkt beschreibbare Roots weiterhin auf das ausgewählte Repository ein und validiert jedes Aufgabenverzeichnis gegen CODEX_ALLOWED_ROOTS.

Hostinger-Remote-Relay

Version 1.2.5 bietet ein Hostinger-kompatibles Relay für den Remote-MCP-Zugriff von ChatGPT:

ChatGPT -> OAuth bearer JWT -> Hostinger /mcp -> namespace-routed queue
  codex_*  -> outbound Windows local-agent -> Codex app-server
  reeves_* -> outbound Reeves Android agent -> accessibility service

Der öffentliche /mcp-Endpunkt validiert RS256-OAuth-Zugriffstokens von einem externen Identitätsanbieter. Die Windows- und Reeves-Agenten verwenden unabhängige HMAC- Anmeldedaten nur für ausgehendes Polling, Status, Leasing-Erwerb und Ergebniseinreichung. Das Hostinger-Relay startet Codex nie und liest niemals lokale Repositorys.

Das gehostete Relay behält alle vorhandenen codex_*-Tools und stellt zusätzlich reeves_status, reeves_tap, reeves_swipe, reeves_type, reeves_back, reeves_home, reeves_recents, reeves_sequence und reeves_screenshot bereit. Die lokale STDIO-Codex- Registrierung bleibt Codex-only. Agentenansprüche werden nach authentifizierter Schlüssel-ID gefiltert; vom Client gelieferte Routing-Felder werden ignoriert.

reeves_screenshot gibt Android-Pixel als standardmäßigen MCP-image-Inhaltsblock zurück (image/png mit Base64-Daten) zusammen mit Breite, Höhe, Aufnahmezeitstempel, Agenten-ID und Byte-Längen-Metadaten. Der Android-Agent verwendet das vom Relay angekündigte Chunk-Ergebnisprotokoll, sodass kein unbrauchbarer Android-lokaler Pfad offengelegt wird und jede signierte HTTP-Anfrage innerhalb des Relay-Body-Limits bleibt.

reeves_sequence sendet 1 bis 50 geordnete Geräteaktionen in einem gerouteten Auftrag. Android führt Tipp-, Wisch-, Eingabe-, Zurück-, Home-, Recents-, Warte- und Screenshot-Aktionen lokal aus, stoppt standardmäßig beim ersten Fehler und gibt standardmäßig ein abschließendes MCP- Bild zurück. Die Ergebnisse enthalten indizierte Aktionsergebnisse und additive, geheimnisfreie Relay/Android-Phasenzeitmessungen. Die bestehende 25-Sekunden-Agentenanfrage ist ein Wake-on-Enqueue-Long-Poll und keine Abholverzögerung; Android startet nach jeder erfolgreichen Ergebniseinreichung sofort einen weiteren Claim und nutzt denselben OkHttp- Verbindungspool erneut.

Diese Version verhandelt außerdem eine unterstützte MCP-Protokollversion, stellt eine begrenzte, an den OAuth-Betreff gebundene Sitzung aus und verlangt diese Sitzung bei Folgeanfragen. Wiederholte Tool-Aufrufe sind an den OAuth-Betreff, die MCP-Sitzung, die typisierte JSON-RPC- ID und den Anforderungshash gebunden; das Beenden einer Sitzung macht ihre zwischengespeicherten oder ausstehenden Arbeiten ungültig. Die Version bereinigt außerdem abgebrochene Relay-Arbeiten und abgestürzte App-Server- Zustände, validiert autorisierte Pfade neu, isoliert Ereignisse pro Thread und schwärzt begrenzte verschachtelte Fehlerdaten an jedem öffentlichen Transport.

Version 1.2.5 gleicht außerdem codex_status.latestAgentMessage mit dem autorisierten persistierten Transkript ab. Vollständig persistierte externe Codex-Vervollständigungen, einschließlich synthetisierter rollout-*-Turns, ersetzen nun veraltete, von der Brücke beobachtete Nachrichten, während unvollständige oder unterbrochene Transkript-Enden ausgeschlossen bleiben.

Stellen Sie das aktualisierte Relay bereit, bevor Sie den Windows-Agenten aktualisieren. Das neue Relay akzeptiert weiterhin Legacy-Einmalergebnisse, während der neue Agent das Chunk-Format nur verwendet, nachdem das Relay Unterstützung angekündigt hat.

Siehe docs/REMOTE_DEPLOYMENT.md für Hostinger-hPanel-Schritte, DNS für mcp.biotele.mx, Auth0-Einrichtung, Microsoft-Entra-ID-Einrichtung, Einrichtung und Wiederherstellung des ChatGPT-Web-Connectors, Umgebungsvariablen, lokale Agenteninstallation und das Bedrohungsmodell.

Available Tools

10 tools
codex_interruptInterrupt Codex turnA
DestructiveIdempotent

Request cancellation of an active Codex turn.

ParametersJSON Schema
NameRequiredDescriptionDefault
turnIdNoOptional turn id; defaults to the active turn known by this bridge.
threadIdYesCodex thread id.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds the nuance that the cancellation applies to an 'active' turn, which implies it may not have effect on non-active turns. However, the annotations already declare destructiveHint and idempotentHint, so the description does not need to restate those. It does not clarify what happens if no active turn exists or whether this is a request versus a guaranteed cancellation, but with annotations covering the safety profile, the additional context is moderate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that directly conveys the tool's purpose without any filler. It is perfectly concise and well-structured for such a simple operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, the presence of annotations (destructive, idempotent) and full schema descriptions, the description provides sufficient context for invocation. It does not mention return values or error scenarios, but with no output schema and a straightforward operation, this is not a critical gap. It covers the essential action and target.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Both parameters have thorough descriptions in the schema (100% coverage), including meaning and default behavior for turnId. The tool description itself adds no further parameter semantics, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action (request cancellation) on a specific resource (an active Codex turn), which distinguishes it from sibling tools like codex_start or codex_status. The verb 'request cancellation' is unambiguous and the phrase 'active Codex turn' scopes the operation appropriately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives. It does not mention that it should be used to stop an ongoing turn, or that one might use codex_status first to check for an active turn. The description simply states what it does without any contextual 'when-to-use' or exclusionary language.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_list_approvalsList Codex approvalsA
Read-onlyIdempotent

List pending app-server requests. This release resolves command-execution and file-change approval requests; unsupported request types remain visible.

ParametersJSON Schema
NameRequiredDescriptionDefault
threadIdNoOptional authorized thread filter.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly and non-destructive behavior. The description adds context that unsupported request types remain visible and specifies which types this release resolves, going beyond annotations. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences: the first states the primary action, the second adds scope clarification. No waste, information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with good annotations and full schema coverage, the description covers the operation and adds useful context about supported versus unsupported request types. It does not specify the return format, but no output schema exists, so the description is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, threadId, is fully documented in the schema as 'Optional authorized thread filter.' The description adds no further parameter semantics, so the schema carries the weight.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('pending app-server requests'), clearly distinguishing it from siblings like codex_resolve_approval and codex_list_threads. The title corroborates this.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly provides the context for when to use the tool (listing pending approvals). However, it does not explicitly mention alternatives or exclusions, so it does not achieve a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_list_threadsList Codex threadsA
Read-onlyIdempotent

List persisted Codex threads whose working directories are inside CODEX_ALLOWED_ROOTS. Results outside those roots are filtered.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoOptional exact allowed working-directory filter.
limitNo
cursorNoOptional pagination cursor.
searchTermNoOptional thread search text.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only and idempotent safety, so the description adds value by revealing the filtering behavior based on CODEX_ALLOWED_ROOTS and the 'persisted' qualifier. This goes beyond what annotations provide and gives important behavioral context for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences. The first sentence states the primary action and scope, and the second clarifies a key behavioral constraint. No unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple listing tool with no output schema, the description covers the essential purpose and a key constraint. Combined with the schema and annotations, it provides sufficient context to use the tool, though it could mention pagination or return format explicitly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not elaborate on any parameters. However, schema descriptions cover 3 of 4 parameters (cwd, cursor, searchTerm), and the remaining limit parameter has min/max constraints. With 75% schema coverage, the description's lack of parameter details is acceptable but not outstanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') with a clear resource ('persisted Codex threads') and a scoping constraint (working directories inside CODEX_ALLOWED_ROOTS). This clearly distinguishes it from sibling tools like codex_read_thread (which reads a single thread) and codex_list_approvals.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by stating the tool lists threads and filters by allowed roots. It gives clear context (listing function) but does not explicitly name alternative tools or exclusions. The mention that results outside allowed roots are filtered provides actionable guidance about when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_read_threadRead Codex threadA
Read-onlyIdempotent

Read a persisted authorized Codex thread. The bridge denies threads outside CODEX_ALLOWED_ROOTS.

ParametersJSON Schema
NameRequiredDescriptionDefault
threadIdYesCodex thread id.
includeTurnsNoInclude full persisted turns. Omit for the safer compact thread view.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds a substantive behavioral detail: the bridge denies threads outside CODEX_ALLOWED_ROOTS, which is not visible in annotations. This informs the agent about potential authorization failures and scoping limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with no filler. The main purpose is front-loaded in the first sentence, and the second sentence provides a crucial constraint. Every word contributes to understanding the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, strong annotations, and full parameter schema coverage, the description is mostly complete. It does not describe the return value format, but with no output schema, that is a gap; however, the name and the includeTurns parameter reasonably convey what is returned. The authorization constraint adds essential context for operational use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% for both parameters, so the structured schema already defines threadId and includeTurns. The description adds no additional meaning beyond what the schema provides, such as the distinction between compact and full turn views, which is already in the schema. Baseline 3 is appropriate when schema covers parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Read') and the resource ('a persisted authorized Codex thread'), immediately distinguishing it from sibling tools like codex_list_threads (list threads) or codex_status (status check). The scope is well-defined with the authorization constraint, making the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for reading a specific thread's contents, but it does not explicitly differentiate from alternatives like codex_status or codex_list_threads. The mention of CODEX_ALLOWED_ROOTS is a constraint on valid inputs rather than guidance on when to choose this tool over others. Use is implied rather than clearly instructed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_resolve_approvalResolve Codex approvalA
Destructive

Explicitly accept, accept for the session, decline, or cancel a pending Codex command-execution or file-change approval.

ParametersJSON Schema
NameRequiredDescriptionDefault
decisionYes
requestKeyYesOpaque requestKey returned by codex_status or codex_list_approvals.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already mark the tool as destructive (destructiveHint: true) and non-idempotent (idempotentHint: false). The description adds the specific decision actions (accept, acceptForSession, decline, cancel) but does not disclose behavioral details such as whether accepting triggers command execution or whether cancellation is reversible. It does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, information-dense sentence that efficiently lists all decision actions and the approval types. There is no redundancy or filler, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool, the description covers the core purpose and decision spectrum adequately. However, it fails to mention how to obtain a requestKey or what happens after a decision (e.g., whether the command execution proceeds). The lack of an output schema means return values are unaddressed, but this is a minor gap given the simple nature of the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is only 50%, with requestKey having a description and decision lacking one. The description repeats the enum values without explaining their semantic differences or the consequences of each choice. It adds no meaning beyond the schema for requestKey, merely referencing 'pending approval' without clarifying how to obtain or use the key.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses explicit verbs (accept, decline, cancel) and names the resource (pending Codex command-execution or file-change approval), making the tool's purpose immediately clear. It also distinguishes this from sibling tools like codex_list_approvals by indicating this tool resolves rather than lists approvals.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used when a pending approval exists, but it does not explicitly state when to use this tool versus alternatives, nor does it mention prerequisites like obtaining a requestKey. There is no guidance on when to choose acceptForSession over accept, or when to cancel rather than decline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_sendSend new Codex turnA
Destructive

Resume an authorized Codex thread when necessary and start a new turn. Use only when no turn is active; use codex_steer for an in-flight turn.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoOptional allowed repository directory override.
modelNoOptional Codex model id. Omit to use the configured default.
effortNoOptional reasoning effort accepted by the selected model.
promptYesNew user instruction.
threadIdYesCodex thread id.
sandboxModeNoread-only prevents edits; workspace-write permits writes only in the repository. Legacy camelCase aliases remain accepted.workspace-write
networkAccessNoRequires CODEX_ALLOW_NETWORK=1 on the MCP server.
approvalPolicyNoControls when Codex asks before command execution or file changes.on-request

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive and open-world behavior, so the description doesn't need to repeat those. However, it adds only a state constraint ('no turn active') without explaining what 'authorized' means, potential side effects like command execution, or how approval flow (given sibling codex_resolve_approval) interacts. Neutral but somewhat thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no fluff, front-loaded with action and usage. Every word earns its place and is highly scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While purpose and usage are clear, the tool has 8 parameters and no output schema. The description doesn't explain what the function returns, how to handle approval requests, or what distinguishes an 'authorized thread'. Sibling tools like codex_wait and codex_resolve_approval imply a larger workflow, but this description alone leaves some gaps for an agent to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all 8 parameters. The description adds no parameter-level detail beyond what the schema already provides, which is acceptable given the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific verbs ('Resume', 'start a new turn') with a clear resource ('Codex thread'), and differentiates itself from the sibling tool codex_steer by explicitly stating its scope. It clearly states what the tool does and when it applies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('only when no turn is active') and names the alternative for the opposite case ('use codex_steer for an in-flight turn'). This is exactly the kind of direct usage guidance needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_startStart Codex taskA
Destructive

Start a new Codex app-server thread and immediately begin a turn in an allowed local repository. Return threadId, turnId, and an event cursor for codex_wait or codex_status.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdYesExisting repository directory inside CODEX_ALLOWED_ROOTS.
modelNoOptional Codex model id. Omit to use the configured default.
effortNoOptional reasoning effort accepted by the selected model.
promptYesComplete implementation or investigation request for Codex.
sandboxModeNoread-only prevents edits; workspace-write permits writes only in the repository. Legacy camelCase aliases remain accepted.workspace-write
networkAccessNoRequires CODEX_ALLOW_NETWORK=1 on the MCP server.
approvalPolicyNoControls when Codex asks before command execution or file changes.on-request

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral context beyond annotations: it returns threadId, turnId, and an event cursor, and clarifies that the turn begins immediately in an allowed local repository. Annotations already mark it as destructive and open-world, so no contradiction exists. It doesn't elaborate on approval or sandbox behavior, but those are covered by schema and annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences convey purpose, behavior, and return value without repetition. Every clause earns its place: it names the resource, the immediate action, the allowed scope, and the downstream tools that consume the return values.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description appropriately explains the return values. It also contextualizes the tool as a starting point for a thread lifecycle. It doesn't explicitly state that execution is asynchronous or that the returned IDs are needed for later calls, but those are strongly implied by the mention of the event cursor. The tool's complexity is well handled overall.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents all parameters well. The description only adds 'allowed local repository' context that aligns with cwd, and mentions the return cursor, but doesn't add new details about parameters like model, effort, sandboxMode, etc. This meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Start a new Codex app-server thread'), the resource ('Codex app-server thread'), and the immediate behavior ('begin a turn in an allowed local repository'). It also distinguishes this from sibling tools by explicitly returning an event cursor for codex_wait or codex_status, signaling this is the entry point for new threads.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains what this tool does and implies its role relative to siblings by referencing post-start tools (codex_wait, codex_status). It doesn't explicitly say when not to use it or name alternatives for existing threads, but the context of 'new' thread is clear. The return cursor guidance helps the agent know how to follow up.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_statusRead Codex statusA
Read-onlyIdempotent

Read a thread snapshot, current turn state, pending approvals, latest agent message, latest diff, and recent streamed events.

ParametersJSON Schema
NameRequiredDescriptionDefault
threadIdYesCodex thread id.
maxEventsNo
includeTurnsNoInclude persisted turn history; this can produce a large response.
afterSequenceNoReturn events newer than this cursor.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds transparency by detailing the exact data returned (latest diff, streamed events, etc.) beyond the annotation flags. It does not mention potential large responses from includeTurns, but that is covered in the schema parameter description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the main action ('Read a thread snapshot') and then lists all data components in a logical sequence. No filler or redundant content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description adequately enumerates the key return categories (thread snapshot, turn state, approvals, etc.). It does not cover edge cases or polling behavior, but given the read-only annotation and schema parameters, it provides sufficient context for an agent to understand the tool's purpose and outputs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not elaborate on any parameters, but the input schema already provides descriptions for 3 of 4 parameters (threadId, includeTurns, afterSequence). The only undocumented parameter, maxEvents, is self-explanatory. The description's phrase 'recent streamed events' loosely implies event-related parameters but adds minimal value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reads a thread snapshot, current turn state, pending approvals, latest agent message, latest diff, and recent streamed events. It uses a specific verb ('Read') and resource, and the enumerated components distinguish it from sibling tools like codex_read_thread or codex_list_approvals.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implicitly conveys this is for getting a composite status view, but it does not explicitly state when to use this tool versus alternatives such as codex_read_thread or codex_list_approvals. No exclusions or alternative recommendations are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_steerSteer active Codex turnA
Destructive

Append guidance to the currently active turn without creating another turn. Supply expectedTurnId when available to prevent steering the wrong turn.

ParametersJSON Schema
NameRequiredDescriptionDefault
promptYesAdditional in-flight guidance.
threadIdYesCodex thread id.
expectedTurnIdNoOptional active turn id returned by codex_start or codex_send.

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint false, destructiveHint true, and idempotentHint false, so the agent knows this modifies state. The description adds context about the 'currently active turn' and the safety mechanism of expectedTurnId to avoid steering the wrong turn. Still, it does not explain failure modes or what happens if no active turn exists, so it provides only moderate additional transparency beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the core action, and every word earns its place. It avoids repetition and includes both the primary function and an important usage hint without excess.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and the presence of detailed annotations, the description is adequate. It covers the key behavior and the critical safety parameter. A minor gap is that it does not explain return behavior or error conditions (e.g., what happens if no active turn exists), but since there is no output schema and the context is straightforward, this is not a significant omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds meaning for expectedTurnId by explaining its purpose ('prevent steering the wrong turn'), which goes slightly beyond the schema. However, it offers no additional context for prompt or threadId beyond the existing schema descriptions. Overall, the added value is marginal, so a 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool appends guidance to the currently active turn, using the specific verb 'append' and resource 'guidance to active turn'. It also distinguishes itself from creating another turn, differentiating it from siblings like codex_send. The mention of expectedTurnId to prevent steering the wrong turn further clarifies its unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: when you want to add guidance to an ongoing turn rather than starting a new one. The phrase 'without creating another turn' provides an exclusion, and the instruction to supply expectedTurnId when available gives practical guidance. However, it does not explicitly name alternative tools, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_waitWait for Codex progressA
Read-onlyIdempotent

Long-poll an active turn until it completes, fails, requests approval, is interrupted, or reaches the timeout. Continue with the returned eventCursor.

ParametersJSON Schema
NameRequiredDescriptionDefault
threadIdYesCodex thread id.
maxEventsNo
timeoutMsNo
afterSequenceNoCursor returned by the preceding Codex tool call.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so behavioral disclosure of safety is covered. The description adds valuable context about long-polling semantics, terminal states, timeout behavior, and the eventCursor continuation mechanism, which goes beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the action and outcome, and every phrase adds value. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple polling tool, the description covers purpose, terminal conditions, timeout, and continuation with eventCursor. There is no output schema, but the description gives enough hint about the return value. It could mention what events contain or how to handle approval requests, but those may be covered by sibling tools like codex_resolve_approval.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: threadId and afterSequence are described, while maxEvents and timeoutMs are not. The description mentions 'timeout' and 'eventCursor', providing partial meaning for timeoutMs and afterSequence, but does not fully compensate for the undocumented parameters. Parameter names are mostly self-explanatory, but a clearer mapping would help.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function with a specific verb ('Long-poll') and a specific resource ('an active turn'), listing all terminal states: completes, fails, requests approval, interrupted, or timeout. This distinguishes it from siblings like codex_status (which likely polls status) and codex_read_thread (which reads a thread).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use this tool: after an active turn exists, to wait for completion or interruption, and to continue using the returned eventCursor. It does not explicitly name alternatives or exclusions, but the context is clear enough that an agent can infer it should be used instead of codex_status for blocking waits.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev1.2.3
    • Changedcodex_read_thread2 fields changed
      • changedInput schema / properties / includeTurns / default
        Previous value: -trueNew value: +false
      • addedInput schema / properties / includeTurns / description
        Added value: +"Include full persisted turns. Omit for the safer compact thread view."
  2. 10 tool updatesv1.0.3
    • First observedcodex_interrupt
    • First observedcodex_list_approvals
    • First observedcodex_list_threads
    • First observedcodex_read_thread
    • First observedcodex_resolve_approval
    • First observedcodex_send
    • First observedcodex_start
    • First observedcodex_status
    • First observedcodex_steer
    • First observedcodex_wait

TDQS

A4.1/5.0

Scored across 10 tools

Disambiguation5/5

Each tool targets a distinct lifecycle moment: start/send create or resume turns, steer mutates an active turn, status/wait/read observe, interrupt cancels, and approvals have dedicated list/resolve tools. Potentially overlapping pairs like send vs steer and status vs read_thread are explicitly disambiguated in their descriptions.

Naming Consistency5/5

All tools share the codex_ prefix and use clear action-oriented verbs, with verb_noun forms for list/read/resolve operations. The naming is consistent, predictable, and uniformly snake_case.

Tool Count5/5

10 tools is well-scoped for a Codex supervisor, covering turn lifecycle, observation, thread inspection, and approval handling without unnecessary redundancy. Each tool has a clear role in the workflow.

Completeness4/5

The surface covers the core workflow: starting, resuming, steering, observing, waiting on, interrupting, and listing threads, plus approval management. Minor gaps exist around deleting threads or resolving unsupported approval types, but agents can complete primary supervision tasks.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers