codex-app-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| CODEX_APP_MCP_HTTP_TOKEN | No | Bearer token for HTTP transport. Mutually exclusive with CODEX_APP_MCP_HTTP_TOKEN_FILE. | |
| CODEX_APP_MCP_ALLOWED_ROOTS | No | Semicolon-separated list of allowed project roots. Project paths fail closed until roots are configured. | |
| CODEX_APP_MCP_DEFAULT_SANDBOX | No | Default sandbox to use. Example: 'danger-full-access'. | |
| CODEX_APP_MCP_HTTP_TOKEN_FILE | No | Path to a file containing the bearer token for HTTP transport. Mutually exclusive with CODEX_APP_MCP_HTTP_TOKEN. | |
| CODEX_APP_MCP_ALLOW_UNSAFE_RPC | No | Set to '1' to allow unsafe RPC calls. | |
| CODEX_APP_MCP_ALLOW_FULL_ACCESS | No | Set to '1' to allow full host access. | |
| CODEX_APP_MCP_ALLOWED_RPC_METHODS | No | Allowed RPC methods allowlist. Use '*' for all, or a narrow list. | |
| CODEX_APP_MCP_DEFAULT_APPROVAL_POLICY | No | Default approval policy. Example: 'never'. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| codex_app_statusC | Start/probe the version-pinned Codex app-server connection. |
| codex_app_doctorA | Run read-only app-server, account, config-requirements, and Windows sandbox-readiness diagnostics without invoking codex doctor. |
| codex_app_discoverC | Discover live models/efforts, collaboration modes, features, permission profiles, configured MCP servers, apps, plugins, skills, hooks, or account. |
| codex_app_threadC | Create, list, read, resume, fork, name, compact, archive, unarchive, or unsubscribe persistent Codex threads. |
| codex_app_goalB | Start or manage a persisted autonomous goal. Activating a goal lets the Codex runtime generate continuation turns until terminal goal status. |
| codex_app_turnC | Start, steer, or interrupt a turn on a loaded Codex thread. |
| codex_app_reviewA | Run the native app-server reviewer inline or detached against uncommitted changes, a base branch, a commit, or custom instructions. |
| codex_app_commandC | Run and control app-server command/exec sessions. Commands are argv arrays; danger-full-access remains an explicit governed option. |
| codex_app_processC | Control experimental unsandboxed app-server process/* sessions. Requires CODEX_APP_MCP_ALLOW_FULL_ACCESS=1. |
| codex_app_fsC | Use app-server filesystem v2 for governed read/write/list/copy/remove/watch operations under allowlisted roots. |
| codex_app_eventsC | Poll cursor-paginated thread events, list pending approvals/input, or respond to a deferred app-server request. |
| codex_app_jobC | Start, inspect, resume, or cancel durable background goal/turn jobs. Jobs use a SQLite ledger and expose persisted thread/turn identifiers. |
| codex_app_laneC | Prepare/list/diff isolated codex/* git worktrees, run or background a turn, poll it, and review it through app-server. |
| codex_app_mcp_callB | Call an explicitly allowlisted downstream MCP/SaaS tool through app-server. Disabled until server and tool allowlists are configured. |
| codex_app_protocolC | Generate and inspect the exact versioned JSON schema exposed by the configured Codex app-server binary. |
| codex_app_adminB | Typed access to account, config, apps/plugins/skills, environment, search, memory, realtime, and remote-control app-server operations. Mutations require the unsafe RPC operator gate. |
| codex_app_scheduleA | Create and operate durable timezone-aware RRULE schedules that launch Codex goal/turn jobs with idempotency, misfire policy, and retries. |
| codex_app_runtimeA | Read gateway counters or explicitly restart the owned app-server connection. Restart requires the unsafe RPC operator gate. |
| codex_app_rpc_readB | Version-forward-compatible escape hatch for a strict read-only RPC allowlist. |
| codex_app_rpcA | Forward-compatible raw app-server RPC. Read methods use the built-in allowlist; stateful methods require an operator method allowlist plus CODEX_APP_MCP_ALLOW_UNSAFE_RPC=1. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 20 tools
Most tools have clearly distinct purposes (status, doctor, fs, events, etc.), but there is some overlap among job/lane/turn/goal management which could confuse agents about which to use for background work. Descriptions differentiate them, but boundaries are less crisp.
All tools follow a consistent codex_app_ prefix and mostly use noun-like names (status, doctor, fs, job), but a few use verbs (discover, mcp_call) and rpc_read is an adjective-noun combo. The pattern is predictable overall.
With 20 tools, this server is on the heavy side (16-25). The scope is broad enough that each tool may be justified, but the count will likely overwhelm agents and increase selection difficulty.
The tool surface is remarkably comprehensive, covering diagnostics, filesystem, events, jobs, scheduling, RPC, commands, threads, turns, goals, review, and process control. There are no obvious dead ends or missing core operations for the stated purpose of managing a Codex app-server.