codex-supervisor
Codex Supervisor MCP
A local Model Context Protocol (MCP) bridge that lets a compatible host start, monitor, steer, interrupt, resume, and approve Codex app-server work.
It wraps codex app-server; it does not automate a terminal UI or scrape an IDE.
기능
The server exposes these MCP tools:
Tool | 목적 |
| 허용된 저장소에서 새 Codex 스레드와 턴을 시작합니다. |
| 활성 턴이 유휴 상태가 된 후 새 지시를 보냅니다. |
| 활성 턴에 안내를 추가합니다. |
| 스레드 상태, 최근 이벤트, 최신 에이전트 메시지, diff 및 대기 중인 요청을 읽습니다. |
| 완료, 실패, 중단 또는 승인 요청이 있을 때까지 롱폴링합니다. |
| 활성 턴을 중단합니다. |
| 구성된 루트 내의 영구 저장된 스레드를 나열합니다. |
| 승인된 영구 저장 스레드를 읽습니다. |
| 대기 중인 앱 서버 요청을 검사합니다. |
| 명령 실행 및 파일 변경 승인을 수락, 거부 또는 취소합니다. |
Related MCP server: Codex Bridge MCP
요구 사항
Node.js 22 이상.
codex로 사용 가능한 최신 Codex CLI.Codex CLI 인증이 이미 구성되어 있어야 합니다.
명시적인 로컬 저장소 루트가 하나 이상 있어야 합니다.
이 프로젝트에는 npm 런타임 종속성이 없습니다.
패키지 검증
npm test테스트 스위트는 프로토콜 호환 목 앱 서버를 사용합니다. 모델 요청을 하지 않으며 Codex 인증이 필요하지 않습니다.
Codex CLI로 설치
MCP 서버 이름 codex-supervisor를 사용하세요. 이름은 CODEX_SUPERVISOR_MCP_NAME과 일치해야 합니다. 브리지는 이 이름을 사용하여 자식 앱 서버가 이 동일한 MCP 서버를 재귀적으로 로드하지 못하게 합니다.
macOS 또는 Linux
codex mcp add codex-supervisor \
--env CODEX_ALLOWED_ROOTS="/Users/you/code:/Users/you/work" \
--env CODEX_SUPERVISOR_MCP_NAME="codex-supervisor" \
-- node "/absolute/path/to/codex-supervisor-mcp/src/index.mjs"루트 사이에 플랫폼 경로 목록 구분 기호를 사용하세요. macOS 및 Linux에서는 콜론(:)입니다.
Windows PowerShell
codex mcp add codex-supervisor `
--env CODEX_ALLOWED_ROOTS="C:\src;D:\work" `
--env CODEX_SUPERVISOR_MCP_NAME="codex-supervisor" `
-- node "C:\absolute\path\to\codex-supervisor-mcp\src\index.mjs"Windows에서 경로 목록 구분 기호는 세미콜론(;)입니다.
등록을 확인하세요:
codex mcp listCodex에서 /mcp를 입력하여 연결된 서버를 검사하세요.
config.toml로 설치
examples/config.toml을 복사하여 수정한 후 그 내용을 ~/.codex/config.toml 또는 신뢰할 수 있는 프로젝트의 .codex/config.toml에 넣으세요.
절대 경로를 사용하세요. 서버 ID와 CODEX_SUPERVISOR_MCP_NAME을 동일하게 유지하세요.
ChatGPT 데스크톱 또는 Codex IDE 확장 프로그램
설정 → MCP 서버 → 서버 추가를 엽니다.
이름을
codex-supervisor로 설정합니다.STDIO를 선택합니다.
명령을
node로 설정합니다.유일한 인수로
src/index.mjs의 절대 경로를 추가합니다.CODEX_ALLOWED_ROOTS와CODEX_SUPERVISOR_MCP_NAME=codex-supervisor를 추가합니다.저장하고 호스트를 다시 시작합니다.
도구를 확인하려면
/mcp를 입력합니다.
로컬 STDIO MCP 서버는 일반 ChatGPT 웹 채팅에서 로드되지 않습니다. 웹에서 이 브리지를 사용하려면 별도로 배포된 인증된 원격 MCP 서비스 또는 호스팅 플러그인이 필요합니다.
일반적인 워크플로우
MCP 호스트에게 요청하세요:
Use codex_start in /absolute/path/to/repository to implement the requested
change. Use workspaceWrite, keep network access disabled, wait for progress,
show me every approval request before resolving it, and report the final diff
and test result.호스트는 다음 순서를 따라야 합니다:
codex_start -> codex_wait
approval request -> inspect -> codex_resolve_approval -> codex_wait
active correction -> codex_steer -> codex_wait
completed -> codex_status
later follow-up -> codex_send -> codex_wait모든 start/send/steer/interrupt 호출은 eventCursor를 반환합니다. 이를 afterSequence로 codex_wait 또는 codex_status에 전달하여 이전 이벤트가 재생되지 않도록 하세요.
approvalPolicy는 현재 앱 서버 와이어 값 on-request(기본값)와 untrusted를 수락합니다. 레거시 값 onRequest와 unlessTrusted는 브리지에서 수락되어 앱 서버 요청 전에 정규화됩니다.
공개 승인 API는 Codex 앱 서버 릴리스가 요청에 대해 cancel만 광고하는 경우에도 decline을 수락합니다. 이 경우 브리지는 안전한 앱 서버 취소 응답을 사용하고 요청된 결정과 실제 결정을 모두 보고합니다.
구성
변수 | 기본값 | 의미 |
| 필수 | 플랫폼 경로 목록 구분 기호로 구분된 저장소 루트. |
|
| 기본 Codex 실행 파일 경로. Windows |
|
| 재귀를 방지하기 위해 중첩된 앱 서버에서 비활성화되는 MCP 구성 ID. |
|
| 호출자가 네트워크 액세스를 요청할 수 있도록 허용하려면 |
|
| 메모리 내 이벤트 수, 100–10,000으로 제한됨. |
|
| Codex 앱 서버 stderr를 이 서버의 stderr로 복사하려면 |
| 내부 안전 기본값 |
|
기본 앱 서버 인수는 다음과 동일합니다:
-c mcp_servers.<CODEX_SUPERVISOR_MCP_NAME>.enabled=false app-serverCODEX_APP_SERVER_ARGS를 재정의하면 해당 재귀 보호 장치가 제거됩니다. 직접 동등한 비활성화 재정의를 포함하세요.
보안 모델
CODEX_ALLOWED_ROOTS는 필수입니다.경로는
realpath로 정규화됩니다. 심볼릭 링크 탈출은 거부됩니다.Codex는 선택한 저장소 및 플랫폼 기본값에 대한 제한된 읽기 액세스 권한을 받습니다.
workspaceWrite는 쓰기 가능한 루트를 선택한 저장소로 제한합니다.dangerFullAccess는 노출되지 않습니다.네트워크 액세스는 작업에
CODEX_ALLOW_NETWORK=1과networkAccess: true가 모두 필요합니다.브리지에는 일반적이고 샌드박스가 없는 셸 도구가 없습니다.
명령 및 파일 변경 승인은 명시적으로 해결되어야 합니다.
허용된 루트 밖의 스레드는 거부되거나 필터링됩니다.
이벤트 페이로드는 저장 전에 크기가 제한됩니다.
저장된 스레드 경로는 사용 시 재정규화됩니다. 삭제되거나 교체된 저장소 경로는 기본적으로 거부됩니다.
동일 스레드 변경, 승인 응답 및 재시도된 원격 호출은 두 번 실행되지 않고 직렬화되거나 중복 제거됩니다.
전송 오류는 STDIO 또는 HTTP 경계를 넘기 전에 재귀적으로 편집되고 크기가 제한됩니다.
릴레이 및 원격 서버 자격 증명(
BIOTELE_*및CODEX_REMOTE_*)은 자식 Codex 환경에서 제거됩니다.원격 결과 제출은 HMAC 인증을 거치고 base64url로 인코딩되며 크기가 제한된 청크로 분할되고 사용 전에 길이와 SHA-256으로 검증됩니다. 인코딩은 전송을 콘텐츠 필터로부터 보호합니다. 암호화는 아닙니다.
자식 앱 서버는 여전히 비 릴레이 프로세스 설정과 더 넓은 Codex 구성을 상속받습니다. 신뢰할 수 없는 코드와 함께 사용하기 전에 다른 환경 비밀값, 앱, 스킬, 훅 및 구성된 MCP 서버를 감사하세요. 환경 제거는 운영 체제 보안 경계가 아닙니다. 동일한 Windows 사용자로 실행되는 자식 프로세스는 의도적으로 사용자 범위 설정을 조회할 수 있습니다. 해당 위협이 범위 내에 있다면 전용 Windows 계정을 사용하세요.
지원되는 승인 요청
이 릴리스는 다음을 해결합니다:
item/commandExecution/requestApprovalitem/fileChange/requestApproval
다른 앱 서버 요청은 codex_status와 codex_list_approvals를 통해 계속 볼 수 있지만 브리지는 응답을 거부합니다. 이는 일반 응답 엔드포인트가 조용히 권한을 부여하거나 민감한 사용자 입력을 제공하는 것을 방지합니다.
영속성 및 모니터링
Codex는 영구 저장된 스레드 기록을 소유합니다. 브리지는 스트리밍된 이벤트 버퍼, 최신 델타 및 대기 중인 요청 상태를 메모리에 유지합니다. MCP 서버를 다시 시작하면 해당 일시적 상태가 지워지지만 codex_list_threads와 codex_read_thread는 승인된 영구 저장 스레드를 복구할 수 있습니다.
개발
npm test
node --check src/index.mjs프로젝트 구조:
src/app-server-client.mjs Codex app-server JSONL client
src/approval-policy.mjs Approval-policy validation and legacy normalization
src/event-store.mjs Bounded event, turn, and approval state
src/security.mjs Repository-root policy
src/supervisor-service.mjs Codex lifecycle orchestration
src/tool-registry.mjs MCP tool schemas and validation
src/mcp-server.mjs Dual-era MCP STDIO transport
src/index.mjs Entrypoint
test/ Unit and integration tests라이선스
MIT
Codex App Server 호환성
버전 1.0.3은 turn/start에서 더 이상 사용되지 않는 readOnly.access 및 workspaceWrite.readOnlyAccess 필드를 제거합니다. 현재 Codex App Server 릴리스는 클라이언트가 사용자 지정 제한 읽기 범위를 필요로 할 때 권한 프로필을 사용합니다. 슈퍼바이저는 쓰기 가능한 루트를 선택한 저장소로 계속 제한하고 모든 작업 디렉터리를 CODEX_ALLOWED_ROOTS에 대해 검증합니다.
Hostinger 원격 릴레이
버전 1.2.5는 ChatGPT 원격 MCP 액세스를 위한 Hostinger 호환 릴레이를 제공합니다:
ChatGPT -> OAuth bearer JWT -> Hostinger /mcp -> namespace-routed queue
codex_* -> outbound Windows local-agent -> Codex app-server
reeves_* -> outbound Reeves Android agent -> accessibility service공개 /mcp 엔드포인트는 외부 ID 제공자의 RS256 OAuth 액세스 토큰을 검증합니다. Windows 및 Reeves 에이전트는 아웃바운드 폴링, 상태, 임대 획득 및 결과 제출에만 독립적인 HMAC 자격 증명을 사용합니다. Hostinger 릴레이는 Codex를 시작하지 않으며 로컬 저장소를 읽지 않습니다.
호스팅 릴레이는 기존의 모든 codex_* 도구를 유지하고 추가로 reeves_status, reeves_tap, reeves_swipe, reeves_type, reeves_back, reeves_home, reeves_recents, reeves_sequence, reeves_screenshot을 노출합니다. 로컬 STDIO Codex 레지스트리는 Codex 전용으로 유지됩니다. 에이전트 클레임은 인증된 키 ID로 필터링됩니다. 클라이언트가 제공한 라우팅 필드는 무시됩니다.
reeves_screenshot은 표준 MCP image 콘텐츠 블록(image/png + base64 데이터)으로 Android 픽셀을 너비, 높이, 캡처 타임스탬프, 에이전트 ID 및 바이트 길이 메타데이터와 함께 반환합니다. Android 에이전트는 릴레이가 광고하는 청크 결과 프로토콜을 사용하므로 사용할 수 없는 Android 로컬 경로가 노출되지 않으며 각 서명된 HTTP 요청은 릴레이 본문 한도 내에 유지됩니다.
reeves_sequence는 하나의 라우팅된 작업에서 1~50개의 정렬된 장치 동작을 보냅니다. Android는 탭, 스와이프, 입력, 뒤로, 홈, 최근 앱, 대기 및 스크린샷 동작을 로컬에서 실행하고 기본적으로 첫 번째 오류에서 중지하며 기본적으로 최종 MCP 이미지 하나를 반환합니다. 결과에는 인덱스된 동작 결과와 추가적인 비밀 없는 릴레이/Android 단계 타이밍이 포함됩니다. 기존 25초 에이전트 요청은 큐에 넣을 때 깨우는 롱폴링이지 픽업 지연이 아닙니다. Android는 각 성공적인 결과 제출 후 즉시 다른 클레임을 시작하고 하나의 OkHttp 연결 풀을 재사용합니다.
이 릴리스는 또한 지원되는 MCP 프로토콜 버전을 협상하고 제한된 OAuth 주체 바인딩 세션을 발급하며 후속 요청에서 해당 세션을 요구합니다. 재시도된 도구 호출은 OAuth 주체, MCP 세션, 타입이 지정된 JSON-RPC ID 및 요청 해시에 바인딩됩니다. 세션을 종료하면 캐시되거나 대기 중인 작업이 무효화됩니다. 이 릴리스는 또한 취소된 릴레이 작업과 충돌한 앱 서버 상태를 정리하고 승인된 경로를 다시 검증하며 스레드별 이벤트를 격리하고 모든 공개 전송에서 크기가 제한된 중첩 오류 데이터를 편집합니다.
버전 1.2.5는 또한 codex_status.latestAgentMessage를 승인된 영구 저장 대화 기록과 조정합니다. 합성된 rollout-* 턴을 포함하여 완전히 영구 저장된 외부 Codex 완료 응답은 이제 오래된 브리지 관찰 메시지를 대체하며 불완전하거나 중단된 대화 기록의 꼬리는 계속 제외됩니다.
Windows 에이전트를 업데이트하기 전에 업데이트된 릴레이를 배포하세요. 새 릴레이는 여전히 레거시 원샷 결과를 수용하고 새 에이전트는 릴레이가 지원을 광고한 후에만 청크 형식을 사용합니다.
Hostinger hPanel 단계, mcp.biotele.mx용 DNS, Auth0 설정, Microsoft Entra ID 설정, ChatGPT 웹 커넥터 설정 및 복구, 환경 변수, 로컬 에이전트 설치 및 위협 모델에 대해서는 docs/REMOTE_DEPLOYMENT.md를 참조하세요.
Available Tools
10 toolscodex_interruptInterrupt Codex turnADestructiveIdempotent
Request cancellation of an active Codex turn.
| Name | Required | Description | Default |
|---|---|---|---|
| turnId | No | Optional turn id; defaults to the active turn known by this bridge. | |
| threadId | Yes | Codex thread id. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds the nuance that the cancellation applies to an 'active' turn, which implies it may not have effect on non-active turns. However, the annotations already declare destructiveHint and idempotentHint, so the description does not need to restate those. It does not clarify what happens if no active turn exists or whether this is a request versus a guaranteed cancellation, but with annotations covering the safety profile, the additional context is moderate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that directly conveys the tool's purpose without any filler. It is perfectly concise and well-structured for such a simple operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, the presence of annotations (destructive, idempotent) and full schema descriptions, the description provides sufficient context for invocation. It does not mention return values or error scenarios, but with no output schema and a straightforward operation, this is not a critical gap. It covers the essential action and target.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Both parameters have thorough descriptions in the schema (100% coverage), including meaning and default behavior for turnId. The tool description itself adds no further parameter semantics, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action (request cancellation) on a specific resource (an active Codex turn), which distinguishes it from sibling tools like codex_start or codex_status. The verb 'request cancellation' is unambiguous and the phrase 'active Codex turn' scopes the operation appropriately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives. It does not mention that it should be used to stop an ongoing turn, or that one might use codex_status first to check for an active turn. The description simply states what it does without any contextual 'when-to-use' or exclusionary language.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_list_approvalsList Codex approvalsARead-onlyIdempotent
List pending app-server requests. This release resolves command-execution and file-change approval requests; unsupported request types remain visible.
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | No | Optional authorized thread filter. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly and non-destructive behavior. The description adds context that unsupported request types remain visible and specifies which types this release resolves, going beyond annotations. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: the first states the primary action, the second adds scope clarification. No waste, information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with good annotations and full schema coverage, the description covers the operation and adds useful context about supported versus unsupported request types. It does not specify the return format, but no output schema exists, so the description is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, threadId, is fully documented in the schema as 'Optional authorized thread filter.' The description adds no further parameter semantics, so the schema carries the weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('pending app-server requests'), clearly distinguishing it from siblings like codex_resolve_approval and codex_list_threads. The title corroborates this.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly provides the context for when to use the tool (listing pending approvals). However, it does not explicitly mention alternatives or exclusions, so it does not achieve a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_list_threadsList Codex threadsARead-onlyIdempotent
List persisted Codex threads whose working directories are inside CODEX_ALLOWED_ROOTS. Results outside those roots are filtered.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Optional exact allowed working-directory filter. | |
| limit | No | ||
| cursor | No | Optional pagination cursor. | |
| searchTerm | No | Optional thread search text. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only and idempotent safety, so the description adds value by revealing the filtering behavior based on CODEX_ALLOWED_ROOTS and the 'persisted' qualifier. This goes beyond what annotations provide and gives important behavioral context for an agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences. The first sentence states the primary action and scope, and the second clarifies a key behavioral constraint. No unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with no output schema, the description covers the essential purpose and a key constraint. Combined with the schema and annotations, it provides sufficient context to use the tool, though it could mention pagination or return format explicitly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not elaborate on any parameters. However, schema descriptions cover 3 of 4 parameters (cwd, cursor, searchTerm), and the remaining limit parameter has min/max constraints. With 75% schema coverage, the description's lack of parameter details is acceptable but not outstanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') with a clear resource ('persisted Codex threads') and a scoping constraint (working directories inside CODEX_ALLOWED_ROOTS). This clearly distinguishes it from sibling tools like codex_read_thread (which reads a single thread) and codex_list_approvals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating the tool lists threads and filters by allowed roots. It gives clear context (listing function) but does not explicitly name alternative tools or exclusions. The mention that results outside allowed roots are filtered provides actionable guidance about when this tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_read_threadRead Codex threadARead-onlyIdempotent
Read a persisted authorized Codex thread. The bridge denies threads outside CODEX_ALLOWED_ROOTS.
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | Yes | Codex thread id. | |
| includeTurns | No | Include full persisted turns. Omit for the safer compact thread view. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds a substantive behavioral detail: the bridge denies threads outside CODEX_ALLOWED_ROOTS, which is not visible in annotations. This informs the agent about potential authorization failures and scoping limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no filler. The main purpose is front-loaded in the first sentence, and the second sentence provides a crucial constraint. Every word contributes to understanding the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, strong annotations, and full parameter schema coverage, the description is mostly complete. It does not describe the return value format, but with no output schema, that is a gap; however, the name and the includeTurns parameter reasonably convey what is returned. The authorization constraint adds essential context for operational use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters, so the structured schema already defines threadId and includeTurns. The description adds no additional meaning beyond what the schema provides, such as the distinction between compact and full turn views, which is already in the schema. Baseline 3 is appropriate when schema covers parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Read') and the resource ('a persisted authorized Codex thread'), immediately distinguishing it from sibling tools like codex_list_threads (list threads) or codex_status (status check). The scope is well-defined with the authorization constraint, making the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for reading a specific thread's contents, but it does not explicitly differentiate from alternatives like codex_status or codex_list_threads. The mention of CODEX_ALLOWED_ROOTS is a constraint on valid inputs rather than guidance on when to choose this tool over others. Use is implied rather than clearly instructed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_resolve_approvalResolve Codex approvalADestructive
Explicitly accept, accept for the session, decline, or cancel a pending Codex command-execution or file-change approval.
| Name | Required | Description | Default |
|---|---|---|---|
| decision | Yes | ||
| requestKey | Yes | Opaque requestKey returned by codex_status or codex_list_approvals. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already mark the tool as destructive (destructiveHint: true) and non-idempotent (idempotentHint: false). The description adds the specific decision actions (accept, acceptForSession, decline, cancel) but does not disclose behavioral details such as whether accepting triggers command execution or whether cancellation is reversible. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, information-dense sentence that efficiently lists all decision actions and the approval types. There is no redundancy or filler, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool, the description covers the core purpose and decision spectrum adequately. However, it fails to mention how to obtain a requestKey or what happens after a decision (e.g., whether the command execution proceeds). The lack of an output schema means return values are unaddressed, but this is a minor gap given the simple nature of the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is only 50%, with requestKey having a description and decision lacking one. The description repeats the enum values without explaining their semantic differences or the consequences of each choice. It adds no meaning beyond the schema for requestKey, merely referencing 'pending approval' without clarifying how to obtain or use the key.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses explicit verbs (accept, decline, cancel) and names the resource (pending Codex command-execution or file-change approval), making the tool's purpose immediately clear. It also distinguishes this from sibling tools like codex_list_approvals by indicating this tool resolves rather than lists approvals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when a pending approval exists, but it does not explicitly state when to use this tool versus alternatives, nor does it mention prerequisites like obtaining a requestKey. There is no guidance on when to choose acceptForSession over accept, or when to cancel rather than decline.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_sendSend new Codex turnADestructive
Resume an authorized Codex thread when necessary and start a new turn. Use only when no turn is active; use codex_steer for an in-flight turn.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Optional allowed repository directory override. | |
| model | No | Optional Codex model id. Omit to use the configured default. | |
| effort | No | Optional reasoning effort accepted by the selected model. | |
| prompt | Yes | New user instruction. | |
| threadId | Yes | Codex thread id. | |
| sandboxMode | No | read-only prevents edits; workspace-write permits writes only in the repository. Legacy camelCase aliases remain accepted. | workspace-write |
| networkAccess | No | Requires CODEX_ALLOW_NETWORK=1 on the MCP server. | |
| approvalPolicy | No | Controls when Codex asks before command execution or file changes. | on-request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and open-world behavior, so the description doesn't need to repeat those. However, it adds only a state constraint ('no turn active') without explaining what 'authorized' means, potential side effects like command execution, or how approval flow (given sibling codex_resolve_approval) interacts. Neutral but somewhat thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no fluff, front-loaded with action and usage. Every word earns its place and is highly scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While purpose and usage are clear, the tool has 8 parameters and no output schema. The description doesn't explain what the function returns, how to handle approval requests, or what distinguishes an 'authorized thread'. Sibling tools like codex_wait and codex_resolve_approval imply a larger workflow, but this description alone leaves some gaps for an agent to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 8 parameters. The description adds no parameter-level detail beyond what the schema already provides, which is acceptable given the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs ('Resume', 'start a new turn') with a clear resource ('Codex thread'), and differentiates itself from the sibling tool codex_steer by explicitly stating its scope. It clearly states what the tool does and when it applies.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('only when no turn is active') and names the alternative for the opposite case ('use codex_steer for an in-flight turn'). This is exactly the kind of direct usage guidance needed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_startStart Codex taskADestructive
Start a new Codex app-server thread and immediately begin a turn in an allowed local repository. Return threadId, turnId, and an event cursor for codex_wait or codex_status.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | Yes | Existing repository directory inside CODEX_ALLOWED_ROOTS. | |
| model | No | Optional Codex model id. Omit to use the configured default. | |
| effort | No | Optional reasoning effort accepted by the selected model. | |
| prompt | Yes | Complete implementation or investigation request for Codex. | |
| sandboxMode | No | read-only prevents edits; workspace-write permits writes only in the repository. Legacy camelCase aliases remain accepted. | workspace-write |
| networkAccess | No | Requires CODEX_ALLOW_NETWORK=1 on the MCP server. | |
| approvalPolicy | No | Controls when Codex asks before command execution or file changes. | on-request |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavioral context beyond annotations: it returns threadId, turnId, and an event cursor, and clarifies that the turn begins immediately in an allowed local repository. Annotations already mark it as destructive and open-world, so no contradiction exists. It doesn't elaborate on approval or sandbox behavior, but those are covered by schema and annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences convey purpose, behavior, and return value without repetition. Every clause earns its place: it names the resource, the immediate action, the allowed scope, and the downstream tools that consume the return values.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description appropriately explains the return values. It also contextualizes the tool as a starting point for a thread lifecycle. It doesn't explicitly state that execution is asynchronous or that the returned IDs are needed for later calls, but those are strongly implied by the mention of the event cursor. The tool's complexity is well handled overall.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema documents all parameters well. The description only adds 'allowed local repository' context that aligns with cwd, and mentions the return cursor, but doesn't add new details about parameters like model, effort, sandboxMode, etc. This meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Start a new Codex app-server thread'), the resource ('Codex app-server thread'), and the immediate behavior ('begin a turn in an allowed local repository'). It also distinguishes this from sibling tools by explicitly returning an event cursor for codex_wait or codex_status, signaling this is the entry point for new threads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains what this tool does and implies its role relative to siblings by referencing post-start tools (codex_wait, codex_status). It doesn't explicitly say when not to use it or name alternatives for existing threads, but the context of 'new' thread is clear. The return cursor guidance helps the agent know how to follow up.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_statusRead Codex statusARead-onlyIdempotent
Read a thread snapshot, current turn state, pending approvals, latest agent message, latest diff, and recent streamed events.
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | Yes | Codex thread id. | |
| maxEvents | No | ||
| includeTurns | No | Include persisted turn history; this can produce a large response. | |
| afterSequence | No | Return events newer than this cursor. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds transparency by detailing the exact data returned (latest diff, streamed events, etc.) beyond the annotation flags. It does not mention potential large responses from includeTurns, but that is covered in the schema parameter description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the main action ('Read a thread snapshot') and then lists all data components in a logical sequence. No filler or redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description adequately enumerates the key return categories (thread snapshot, turn state, approvals, etc.). It does not cover edge cases or polling behavior, but given the read-only annotation and schema parameters, it provides sufficient context for an agent to understand the tool's purpose and outputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not elaborate on any parameters, but the input schema already provides descriptions for 3 of 4 parameters (threadId, includeTurns, afterSequence). The only undocumented parameter, maxEvents, is self-explanatory. The description's phrase 'recent streamed events' loosely implies event-related parameters but adds minimal value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads a thread snapshot, current turn state, pending approvals, latest agent message, latest diff, and recent streamed events. It uses a specific verb ('Read') and resource, and the enumerated components distinguish it from sibling tools like codex_read_thread or codex_list_approvals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly conveys this is for getting a composite status view, but it does not explicitly state when to use this tool versus alternatives such as codex_read_thread or codex_list_approvals. No exclusions or alternative recommendations are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_steerSteer active Codex turnADestructive
Append guidance to the currently active turn without creating another turn. Supply expectedTurnId when available to prevent steering the wrong turn.
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | Additional in-flight guidance. | |
| threadId | Yes | Codex thread id. | |
| expectedTurnId | No | Optional active turn id returned by codex_start or codex_send. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint false, destructiveHint true, and idempotentHint false, so the agent knows this modifies state. The description adds context about the 'currently active turn' and the safety mechanism of expectedTurnId to avoid steering the wrong turn. Still, it does not explain failure modes or what happens if no active turn exists, so it provides only moderate additional transparency beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the core action, and every word earns its place. It avoids repetition and includes both the primary function and an important usage hint without excess.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of detailed annotations, the description is adequate. It covers the key behavior and the critical safety parameter. A minor gap is that it does not explain return behavior or error conditions (e.g., what happens if no active turn exists), but since there is no output schema and the context is straightforward, this is not a significant omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds meaning for expectedTurnId by explaining its purpose ('prevent steering the wrong turn'), which goes slightly beyond the schema. However, it offers no additional context for prompt or threadId beyond the existing schema descriptions. Overall, the added value is marginal, so a 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool appends guidance to the currently active turn, using the specific verb 'append' and resource 'guidance to active turn'. It also distinguishes itself from creating another turn, differentiating it from siblings like codex_send. The mention of expectedTurnId to prevent steering the wrong turn further clarifies its unique role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when you want to add guidance to an ongoing turn rather than starting a new one. The phrase 'without creating another turn' provides an exclusion, and the instruction to supply expectedTurnId when available gives practical guidance. However, it does not explicitly name alternative tools, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_waitWait for Codex progressARead-onlyIdempotent
Long-poll an active turn until it completes, fails, requests approval, is interrupted, or reaches the timeout. Continue with the returned eventCursor.
| Name | Required | Description | Default |
|---|---|---|---|
| threadId | Yes | Codex thread id. | |
| maxEvents | No | ||
| timeoutMs | No | ||
| afterSequence | No | Cursor returned by the preceding Codex tool call. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so behavioral disclosure of safety is covered. The description adds valuable context about long-polling semantics, terminal states, timeout behavior, and the eventCursor continuation mechanism, which goes beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action and outcome, and every phrase adds value. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple polling tool, the description covers purpose, terminal conditions, timeout, and continuation with eventCursor. There is no output schema, but the description gives enough hint about the return value. It could mention what events contain or how to handle approval requests, but those may be covered by sibling tools like codex_resolve_approval.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: threadId and afterSequence are described, while maxEvents and timeoutMs are not. The description mentions 'timeout' and 'eventCursor', providing partial meaning for timeoutMs and afterSequence, but does not fully compensate for the undocumented parameters. Parameter names are mostly self-explanatory, but a clearer mapping would help.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb ('Long-poll') and a specific resource ('an active turn'), listing all terminal states: completes, fails, requests approval, interrupted, or timeout. This distinguishes it from siblings like codex_status (which likely polls status) and codex_read_thread (which reads a thread).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: after an active turn exists, to wait for completion or interruption, and to continue using the returned eventCursor. It does not explicitly name alternatives or exclusions, but the context is clear enough that an agent can infer it should be used instead of codex_status for blocking waits.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v1.2.3- Changed
codex_read_thread2 fields changed- changed
Input schema / properties / includeTurns / defaultPrevious value: -trueNew value: +false - added
Input schema / properties / includeTurns / descriptionAdded value: +"Include full persisted turns. Omit for the safer compact thread view."
10 tool updates
v1.0.3- First observed
codex_interrupt - First observed
codex_list_approvals - First observed
codex_list_threads - First observed
codex_read_thread - First observed
codex_resolve_approval - First observed
codex_send - First observed
codex_start - First observed
codex_status - First observed
codex_steer - First observed
codex_wait
TDQS
Scored across 10 tools
Each tool targets a distinct lifecycle moment: start/send create or resume turns, steer mutates an active turn, status/wait/read observe, interrupt cancels, and approvals have dedicated list/resolve tools. Potentially overlapping pairs like send vs steer and status vs read_thread are explicitly disambiguated in their descriptions.
All tools share the codex_ prefix and use clear action-oriented verbs, with verb_noun forms for list/read/resolve operations. The naming is consistent, predictable, and uniformly snake_case.
10 tools is well-scoped for a Codex supervisor, covering turn lifecycle, observation, thread inspection, and approval handling without unnecessary redundancy. Each tool has a clear role in the workflow.
The surface covers the core workflow: starting, resuming, steering, observing, waiting on, interrupting, and listing threads, plus approval management. Minor gaps exist around deleting threads or resolving unsupported approval types, but agents can complete primary supervision tasks.
Maintenance
Related MCP Connectors
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Remote MCP server exposing your Node Command fleet (files, shell, processes, browser) to AI hosts.
1Guarded MCP server for agent-readable business truth, provenance, readiness, and discovery.
Related MCP Servers
- AlicenseBqualityFmaintenanceAn MCP server that exposes the local Grok CLI to Codex for bounded repo work, reviews, rescue analysis, adversarial checks, session listing/export, and background job management while keeping Codex hidden context out of scope.121MIT
- FlicenseNot gradedqualityCmaintenanceCodex Bridge MCP is a local MCP orchestration service for a stable Claude Code x Codex CLI development workflow.2-
- AlicenseNot gradedqualityAmaintenanceA local STDIO MCP server that bridges MCP clients to the Codex CLI by sending instructions to a configured workspace, exposing task run, status, and result tools with a read-only sandbox and no remote transport.133MIT
- FlicenseBqualityBmaintenanceProduction-oriented MCP gateway for managing Codex through a persistent codex app-server process, supporting threads, autonomous goals, approvals, and HTTP/stdio transports.202-