Skip to main content
Glama

codex-mcp-bridge

MCP server that lets an MCP client (Claude Code) drive OpenAI Codex as a sub-agent: many independent or threaded queries, plus actions (shell commands, file edits) when explicitly opted into.

Important: this project does not call the OpenAI HTTP API. It drives the Codex CLI (the codex executable) locally and/or reads local Codex session files. Authentication and session state come from the locally-installed codex CLI (for example, codex login), and the bridge operates against that local CLI and its session files rather than an external API key or billing endpoint.

Auth

Uses whatever codex login has already set up on this machine — a ChatGPT subscription login, not API-key billing. The bridge launches the codex executable as a child process so it inherits the current environment and the CLI's local auth state. Do not try to configure apiKey/baseUrl/env settings here: they are not used and env would replace the child's environment rather than merging it, which breaks codex PATH resolution and auth lookup.

Check status any time with:

codex login status

Related MCP server: agent-fleet

Tool: codex_ask

One tool, parameterized:

  • prompt (required), working_directory (required, absolute path — no implicit default, so Codex never silently operates on the wrong repo).

  • thread_id — pass back the id returned by a previous call to continue that conversation; omit to start a new one. Threads are persisted by the Codex CLI itself (~/.codex/sessions), so ids remain valid across restarts of this server.

  • sandbox_mode (read-only default / workspace-write / danger-full-access) and approval_policy (never default / on-request / on-failure / untrusted) — the "actions" knob. Default is read-only with no auto-approval: Codex can inspect the repo and answer, but cannot write files or run arbitrary commands unless a call explicitly asks for workspace-write. Since this runs non-interactively (codex exec under the hood), there's no one to answer an approval prompt either way — anything outside sandbox_mode is simply denied.

  • require_git_repo, additional_directories, network_access, web_search, model, reasoning_effort, output_schema (JSON Schema for structured output), timeout_ms.

Independent calls (different or omitted thread_id) run concurrently as separate Codex conversations — that's what covers "many queries" alongside a single ongoing thread.

Tool: codex_cloud_tasks

Lists Codex Cloud background tasks, or (with task_id) shows one task's status. Wraps codex cloud list --json / codex cloud status <id> directly (not part of the CLI's documented surface) — these are undocumented/ experimental, so the JSON field names in the list output aren't guaranteed stable across CLI versions. status has no --json form; its output is passed through as-is.

Tool: codex_local_sessions

Lists recent local Codex CLI sessions — the ones codex resume picks from — most recently touched first. codex resume itself is an interactive-only picker with no scriptable output, so this reads ~/.codex/session_index.jsonl directly instead (also undocumented). That index only carries session id, current thread name, and last-updated time — no live/idle status or working directory; a session can be renamed multiple times, so entries are deduped by id, keeping the most recent name.

Note this index only records interactively created sessions. Threads started programmatically (including by codex_ask) are real and resumable but do not appear here.

Tool: codex_read_thread

Reads the message history of any thread, interactive or programmatic, by locating its rollout JSONL under ~/.codex/sessions and parsing it. No API call, no quota — it works even when the account is rate-limited.

  • thread_id (required), limit (default 50, counts back from newest), include_reasoning (default false), max_chars (per-message truncation).

Returns the thread's cwd and source from its session_meta header along with the messages.

Notes on driving a thread you want to watch

A thread created programmatically never enters the interactive session index, so it won't show up in codex resume's default picker or the desktop app. If you want to watch the conversation in the normal Codex UI, start the thread there first, then pass its id to codex_ask.

Two behaviours worth knowing:

  • The desktop UI does not live-tail a thread, and navigating to it in an existing window serves a cached copy. Open the thread in a new window to see externally injected messages.

  • A turn that fails (e.g. rate limit) has already appended your message to the rollout. Rollouts are append-only, so a failed call is not a no-op.

Build

npm install
npm run build

Register with Claude Code (user scope)

claude mcp add codex-bridge --scope user -- node /absolute/path/to/codex-mcp-bridge/dist/index.js

Probe scripts

probe-*.mjs are small standalone experiments used to work out the behaviours above (app-server wire framing, what codex mcp-server exposes, why codex-reply can't reach persisted threads, SDK-only resume). They are not part of the server; each prints its usage when run without arguments.

Available Tools

4 tools
codex_askAsk Codex (OpenAI, ChatGPT subscription)A
Destructive

Send a prompt to OpenAI Codex and get its response back. Codex can, if sandbox_mode is set to workspace-write, actually run shell commands and edit files under working_directory — not just answer in text. Pass the thread_id from a prior call to continue that conversation; omit it to start a fresh one. Independent calls (different or omitted thread_id) run concurrently as separate Codex conversations, so this can be used for many parallel queries as well as a single ongoing one.

ParametersJSON Schema
NameRequiredDescriptionDefault
modelNoOverride the Codex model (defaults to the CLI's configured default).
promptYesThe instruction or question to send to Codex.
thread_idNoThread id returned by a previous codex_ask call. Pass it to continue that conversation with full prior context. Omit to start a new thread.
timeout_msNoAbort the turn if it runs longer than this many milliseconds.
web_searchNoEnable Codex's own live web search tool for this turn.
sandbox_modeNoread-only: Codex can inspect files and run non-mutating commands, but cannot write files or run arbitrary commands. workspace-write: Codex may edit files and run commands within working_directory (+ additional_directories). danger-full-access: no sandboxing at all. Default read-only.read-only
output_schemaNoJSON Schema the final response must conform to (structured output).
network_accessNoOnly relevant when sandbox_mode is workspace-write: allow shell commands to reach the network.
approval_policyNoCodex's approval policy for actions outside the sandbox. Since this runs non-interactively there is no one to answer an approval prompt, so anything requiring escalation beyond sandbox_mode is simply denied regardless of this setting. Default never.never
reasoning_effortNoOverride the model's reasoning effort.
require_git_repoNoIf true, Codex refuses to run when working_directory is not inside a git repository, instead of skipping that check.
working_directoryYesAbsolute path Codex should treat as its working root (e.g. C:\path\to\repo). Required — there is no implicit default, to avoid Codex silently operating on the wrong directory.
additional_directoriesNoExtra absolute paths Codex may read/write beyond working_directory.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description exceeds the annotations by disclosing that Codex can run shell commands and edit files when sandbox_mode is workspace-write, and that calls with different/omitted thread_id run concurrently. This adds operational context beyond the simple readOnly/destructive hints and aligns with the annotations, showing no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact—three sentences—with the most important information front-loaded: the core action, followed by key behavioral caveats. No redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (13 parameters) and rich schema, the description covers the essential behavioral aspects: prompt sending, thread continuity, concurrency, and file-edit capability. It doesn't describe the response format, but without an output schema and with detailed parameter docs, this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents all 13 parameters with 100% coverage, so the baseline is 3. The description adds value by explaining concurrency behavior and the practical effect of sandbox_mode, which complements the schema though most param details are already covered.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ('Send a prompt to OpenAI Codex') and clearly explains the tool's scope, including its ability to execute commands and edit files under certain sandbox modes. It distinguishes itself from siblings by focusing on prompting Codex, while siblings like codex_read_thread and codex_local_sessions clearly handle other concerns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage patterns: pass thread_id to continue a conversation, omit it to start fresh, and use independent calls for parallel queries. While it doesn't explicitly contrast with sibling tools, it gives sufficient context on when to use this tool and how to manage conversations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_cloud_tasksCodex Cloud task statusA
Read-onlyIdempotent

List Codex Cloud background tasks, or (with task_id) show the status of one. Wraps the undocumented codex cloud list --json / codex cloud status <id> CLI commands — field names in the JSON list output are not guaranteed stable across Codex CLI versions. status has no --json form; its output is returned as-is.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax tasks to return when listing (1-20, default 20). Ignored when task_id is set.
cursorNoPagination cursor returned by a previous list call. Ignored when task_id is set.
task_idNoIf set, show the status of this one Codex Cloud task instead of listing tasks.
environment_idNoFilter the task list by environment id. Ignored when task_id is set.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, openWorldHint=true, which covers the safety profile. The description adds valuable behavioral context: it wraps undocumented CLI commands, warns that field names in list output are not guaranteed stable, and notes that status output is raw (no --json form). These details go beyond annotations and help the agent set expectations correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the primary action ('List... or show status'). Every sentence earns its place: the first states purpose, the second explains the CLI wrapper and instability caveat, the third clarifies the status output format. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does a good job of explaining return behavior: list returns JSON (with caveat about field stability), status returns raw output. It covers the tool's scope and limitations (undocumented CLI), and the schema handles parameter details. The tool is simple, and the description is complete enough for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with each parameter already well-documented (e.g., 'Ignored when task_id is set'). The description adds some context about task_id switching to status mode and the raw status output, but the schema already conveys this. Given the baseline of 3 for high schema coverage, this is appropriate; the description does not materially improve parameter understanding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's verb ('List' / 'show the status of one') and resource ('Codex Cloud background tasks'). It distinguishes itself from siblings by focusing specifically on Codex Cloud tasks, and even mentions the wrapping of undocumented CLI commands. This is a specific, well-defined purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool (listing tasks or showing status via task_id) and implicitly differentiates from siblings (codex_ask, codex_local_sessions, codex_read_thread). It doesn't explicitly state when not to use it, but the scope is evident. A minor gap is not naming alternative tools for other task-related operations, but the context is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_local_sessionsLocal Codex work sessionsA
Read-onlyIdempotent

List recent local Codex CLI sessions — the ones codex resume picks from — most recently touched first. Reads the undocumented ~/.codex/session_index.jsonl index directly, since codex resume itself is an interactive-only picker with no scriptable output. Only exposes what that index carries: session id, current thread name, and last-updated time — not live/idle status or working directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax sessions to return, most recently updated first.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds significant context beyond annotations: reads an undocumented index file directly, exposes only three specific fields, and does not provide live/idle status or working directory. Annotations already say readOnlyHint/idempotentHint/destructiveHint, and the description expands on the data source and limitations without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences: action, rationale, limitations. No redundant fluff, every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only list tool with one optional parameter and no output schema, the description sufficiently explains purpose, data source, return contents, and limitations, making it complete for the agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with `limit` fully described (default, min, max, ordering). The description adds no new parameter details, but the schema handles it; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it lists recent local Codex CLI sessions, specifies the source (sessions `codex resume` picks from), and distinguishes from siblings by noting it reads the session_index.jsonl index directly and what fields it exposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains when to use this tool: to get a scriptable list of sessions for `codex resume`, and why not to use `codex resume` itself (interactive-only). It also sets exclusions: doesn't expose live/idle status or working directory, guiding the agent to not expect those.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_read_threadRead a Codex thread transcriptA
Read-onlyIdempotent

Read the message history of any Codex thread — whether it was created interactively (GUI / VS Code / TUI) or programmatically. Reads the thread's rollout JSONL from ~/.codex/sessions directly, so it needs no API call, consumes no quota, and works even when the account is rate-limited. Returns the most recent messages by default.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax messages to return, counting back from the most recent.
max_charsNoTruncate each individual message to this many characters.
thread_idYesThe thread/session id (UUID) whose transcript to read.
include_reasoningNoInclude the agent's internal reasoning entries, not just user/agent messages.

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly and idempotent annotations, the description discloses that it reads directly from local JSONL files, needs no API call, consumes no quota, and works even when rate-limited. This adds significant behavioral context about its underlying mechanism and operational characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the primary purpose in the first sentence. It includes only relevant details about the local file reading, quota-free operation, and default behavior, with no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is fairly complete for a read-only tool with annotations and full schema coverage. It explains the key use case, mechanism, and default behavior. However, it lacks details about the return format (e.g., JSON structure) or error handling, which would be useful given there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% parameter coverage with detailed descriptions for limit, max_chars, thread_id, and include_reasoning. The description only adds that it returns the most recent messages by default, which is already implied by the schema's 'default: 50' and 'counting back from the most recent'. No additional parameter meaning is provided beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Read the message history of any Codex thread'. It identifies the specific resource (Codex thread), the action (read), and distinguishes from siblings by covering both interactive and programmatic threads. It also mentions reading from ~/.codex/sessions, which is a unique characteristic.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool: it can read any thread, requires no API call, consumes no quota, and works under rate limits. However, it doesn't explicitly mention alternatives like codex_local_sessions for listing threads or codex_ask for asking questions, so it lacks explicit when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 4 tool updatesv0.1.0
    • First observedcodex_ask
    • First observedcodex_cloud_tasks
    • First observedcodex_local_sessions
    • First observedcodex_read_thread

TDQS

A4.5/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: codex_ask sends prompts, codex_cloud_tasks manages cloud background tasks, codex_local_sessions lists local sessions, and codex_read_thread reads message history. There is no overlap in either target resource or action.

Naming Consistency4/5

All tools share the codex_ prefix, making them easy to group, but the pattern is not perfectly uniform: codex_ask and codex_read_thread use verb_noun, while codex_cloud_tasks and codex_local_sessions are noun-only. Still, the names are clear and predictable enough.

Tool Count5/5

Four tools is well-scoped for a lightweight bridge to Codex. Each tool covers a distinct integration point without being too sparse or bloated.

Completeness4/5

The set covers the core needs: sending prompts, reading threads, listing sessions, and checking cloud tasks. Minor gaps exist, such as no ability to cancel a cloud task or resume a local session programmatically, but these are not essential for the bridge's apparent purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/eyalk11/codex-mcp-bridge'

If you have feedback or need assistance with the MCP directory API, please join our Discord server