Start/probe the version-pinned Codex app-server connection.

Run read-only app-server, account, config-requirements, and Windows sandbox-readiness diagnostics without invoking codex doctor.

Discover live models/efforts, collaboration modes, features, permission profiles, configured MCP servers, apps, plugins, skills, hooks, or account.

Create, list, read, resume, fork, name, compact, archive, unarchive, or unsubscribe persistent Codex threads.

Start or manage a persisted autonomous goal. Activating a goal lets the Codex runtime generate continuation turns until terminal goal status.

Start, steer, or interrupt a turn on a loaded Codex thread.

Run the native app-server reviewer inline or detached against uncommitted changes, a base branch, a commit, or custom instructions.

Run and control app-server command/exec sessions. Commands are argv arrays; danger-full-access remains an explicit governed option.

Control experimental unsandboxed app-server process/* sessions. Requires CODEX_APP_MCP_ALLOW_FULL_ACCESS=1.

Use app-server filesystem v2 for governed read/write/list/copy/remove/watch operations under allowlisted roots.

Poll cursor-paginated thread events, list pending approvals/input, or respond to a deferred app-server request.

Start, inspect, resume, or cancel durable background goal/turn jobs. Jobs use a SQLite ledger and expose persisted thread/turn identifiers.

Prepare/list/diff isolated codex/* git worktrees, run or background a turn, poll it, and review it through app-server.

Call an explicitly allowlisted downstream MCP/SaaS tool through app-server. Disabled until server and tool allowlists are configured.

Generate and inspect the exact versioned JSON schema exposed by the configured Codex app-server binary.

Typed access to account, config, apps/plugins/skills, environment, search, memory, realtime, and remote-control app-server operations. Mutations require the unsafe RPC operator gate.

Create and operate durable timezone-aware RRULE schedules that launch Codex goal/turn jobs with idempotency, misfire policy, and retries.

Read gateway counters or explicitly restart the owned app-server connection. Restart requires the unsafe RPC operator gate.

Version-forward-compatible escape hatch for a strict read-only RPC allowlist.

Forward-compatible raw app-server RPC. Read methods use the built-in allowlist; stateful methods require an operator method allowlist plus CODEX_APP_MCP_ALLOW_UNSAFE_RPC=1.