codex-mcp-bridge
Provides tools for interacting with OpenAI's Codex CLI, enabling an MCP client to run queries, manage threads, read session history, and optionally allow file modifications and shell commands under explicit approval policies.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codex-mcp-bridgeAsk Codex to review the recent commits for potential security issues."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
codex-mcp-bridge
MCP server that lets an MCP client (Claude Code) drive OpenAI Codex as a sub-agent: many independent or threaded queries, plus actions (shell commands, file edits) when explicitly opted into.
Important: this project does not call the OpenAI HTTP API. It drives the
Codex CLI (the codex executable) locally and/or reads local Codex session
files. Authentication and session state come from the locally-installed
codex CLI (for example, codex login), and the bridge operates against
that local CLI and its session files rather than an external API key or
billing endpoint.
Auth
Uses whatever codex login has already set up on this machine — a ChatGPT
subscription login, not API-key billing. The bridge launches the codex
executable as a child process so it inherits the current environment and the
CLI's local auth state. Do not try to configure apiKey/baseUrl/env
settings here: they are not used and env would replace the child's
environment rather than merging it, which breaks codex PATH resolution and
auth lookup.
Check status any time with:
codex login statusRelated MCP server: agent-fleet
Tool: codex_ask
One tool, parameterized:
prompt(required),working_directory(required, absolute path — no implicit default, so Codex never silently operates on the wrong repo).thread_id— pass back the id returned by a previous call to continue that conversation; omit to start a new one. Threads are persisted by the Codex CLI itself (~/.codex/sessions), so ids remain valid across restarts of this server.sandbox_mode(read-onlydefault /workspace-write/danger-full-access) andapproval_policy(neverdefault /on-request/on-failure/untrusted) — the "actions" knob. Default is read-only with no auto-approval: Codex can inspect the repo and answer, but cannot write files or run arbitrary commands unless a call explicitly asks forworkspace-write. Since this runs non-interactively (codex execunder the hood), there's no one to answer an approval prompt either way — anything outsidesandbox_modeis simply denied.require_git_repo,additional_directories,network_access,web_search,model,reasoning_effort,output_schema(JSON Schema for structured output),timeout_ms.
Independent calls (different or omitted thread_id) run concurrently as
separate Codex conversations — that's what covers "many queries" alongside
a single ongoing thread.
Tool: codex_cloud_tasks
Lists Codex Cloud background tasks, or (with task_id) shows one task's
status. Wraps codex cloud list --json / codex cloud status <id> directly
(not part of the CLI's documented surface) — these are undocumented/
experimental, so the JSON field names in the list output aren't guaranteed
stable across CLI versions. status has no --json form; its output is
passed through as-is.
Tool: codex_local_sessions
Lists recent local Codex CLI sessions — the ones codex resume picks
from — most recently touched first. codex resume itself is an
interactive-only picker with no scriptable output, so this reads
~/.codex/session_index.jsonl directly instead (also undocumented). That
index only carries session id, current thread name, and last-updated time —
no live/idle status or working directory; a session can be renamed multiple
times, so entries are deduped by id, keeping the most recent name.
Note this index only records interactively created sessions. Threads
started programmatically (including by codex_ask) are real and resumable
but do not appear here.
Tool: codex_read_thread
Reads the message history of any thread, interactive or programmatic, by
locating its rollout JSONL under ~/.codex/sessions and parsing it. No API
call, no quota — it works even when the account is rate-limited.
thread_id(required),limit(default 50, counts back from newest),include_reasoning(default false),max_chars(per-message truncation).
Returns the thread's cwd and source from its session_meta header along
with the messages.
Notes on driving a thread you want to watch
A thread created programmatically never enters the interactive session index,
so it won't show up in codex resume's default picker or the desktop app. If
you want to watch the conversation in the normal Codex UI, start the thread
there first, then pass its id to codex_ask.
Two behaviours worth knowing:
The desktop UI does not live-tail a thread, and navigating to it in an existing window serves a cached copy. Open the thread in a new window to see externally injected messages.
A turn that fails (e.g. rate limit) has already appended your message to the rollout. Rollouts are append-only, so a failed call is not a no-op.
Build
npm install
npm run buildRegister with Claude Code (user scope)
claude mcp add codex-bridge --scope user -- node /absolute/path/to/codex-mcp-bridge/dist/index.jsProbe scripts
probe-*.mjs are small standalone experiments used to work out the
behaviours above (app-server wire framing, what codex mcp-server exposes,
why codex-reply can't reach persisted threads, SDK-only resume). They are
not part of the server; each prints its usage when run without arguments.
Available Tools
4 toolscodex_askAsk Codex (OpenAI, ChatGPT subscription)ADestructive
Send a prompt to OpenAI Codex and get its response back. Codex can, if sandbox_mode is set to workspace-write, actually run shell commands and edit files under working_directory — not just answer in text. Pass the thread_id from a prior call to continue that conversation; omit it to start a fresh one. Independent calls (different or omitted thread_id) run concurrently as separate Codex conversations, so this can be used for many parallel queries as well as a single ongoing one.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Override the Codex model (defaults to the CLI's configured default). | |
| prompt | Yes | The instruction or question to send to Codex. | |
| thread_id | No | Thread id returned by a previous codex_ask call. Pass it to continue that conversation with full prior context. Omit to start a new thread. | |
| timeout_ms | No | Abort the turn if it runs longer than this many milliseconds. | |
| web_search | No | Enable Codex's own live web search tool for this turn. | |
| sandbox_mode | No | read-only: Codex can inspect files and run non-mutating commands, but cannot write files or run arbitrary commands. workspace-write: Codex may edit files and run commands within working_directory (+ additional_directories). danger-full-access: no sandboxing at all. Default read-only. | read-only |
| output_schema | No | JSON Schema the final response must conform to (structured output). | |
| network_access | No | Only relevant when sandbox_mode is workspace-write: allow shell commands to reach the network. | |
| approval_policy | No | Codex's approval policy for actions outside the sandbox. Since this runs non-interactively there is no one to answer an approval prompt, so anything requiring escalation beyond sandbox_mode is simply denied regardless of this setting. Default never. | never |
| reasoning_effort | No | Override the model's reasoning effort. | |
| require_git_repo | No | If true, Codex refuses to run when working_directory is not inside a git repository, instead of skipping that check. | |
| working_directory | Yes | Absolute path Codex should treat as its working root (e.g. C:\path\to\repo). Required — there is no implicit default, to avoid Codex silently operating on the wrong directory. | |
| additional_directories | No | Extra absolute paths Codex may read/write beyond working_directory. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description exceeds the annotations by disclosing that Codex can run shell commands and edit files when sandbox_mode is workspace-write, and that calls with different/omitted thread_id run concurrently. This adds operational context beyond the simple readOnly/destructive hints and aligns with the annotations, showing no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact—three sentences—with the most important information front-loaded: the core action, followed by key behavioral caveats. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (13 parameters) and rich schema, the description covers the essential behavioral aspects: prompt sending, thread continuity, concurrency, and file-edit capability. It doesn't describe the response format, but without an output schema and with detailed parameter docs, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents all 13 parameters with 100% coverage, so the baseline is 3. The description adds value by explaining concurrency behavior and the practical effect of sandbox_mode, which complements the schema though most param details are already covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb+resource ('Send a prompt to OpenAI Codex') and clearly explains the tool's scope, including its ability to execute commands and edit files under certain sandbox modes. It distinguishes itself from siblings by focusing on prompting Codex, while siblings like codex_read_thread and codex_local_sessions clearly handle other concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage patterns: pass thread_id to continue a conversation, omit it to start fresh, and use independent calls for parallel queries. While it doesn't explicitly contrast with sibling tools, it gives sufficient context on when to use this tool and how to manage conversations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_cloud_tasksCodex Cloud task statusARead-onlyIdempotent
List Codex Cloud background tasks, or (with task_id) show the status of one. Wraps the undocumented codex cloud list --json / codex cloud status <id> CLI commands — field names in the JSON list output are not guaranteed stable across Codex CLI versions. status has no --json form; its output is returned as-is.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max tasks to return when listing (1-20, default 20). Ignored when task_id is set. | |
| cursor | No | Pagination cursor returned by a previous list call. Ignored when task_id is set. | |
| task_id | No | If set, show the status of this one Codex Cloud task instead of listing tasks. | |
| environment_id | No | Filter the task list by environment id. Ignored when task_id is set. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, openWorldHint=true, which covers the safety profile. The description adds valuable behavioral context: it wraps undocumented CLI commands, warns that field names in list output are not guaranteed stable, and notes that status output is raw (no --json form). These details go beyond annotations and help the agent set expectations correctly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the primary action ('List... or show status'). Every sentence earns its place: the first states purpose, the second explains the CLI wrapper and instability caveat, the third clarifies the status output format. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does a good job of explaining return behavior: list returns JSON (with caveat about field stability), status returns raw output. It covers the tool's scope and limitations (undocumented CLI), and the schema handles parameter details. The tool is simple, and the description is complete enough for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter already well-documented (e.g., 'Ignored when task_id is set'). The description adds some context about task_id switching to status mode and the raw status output, but the schema already conveys this. Given the baseline of 3 for high schema coverage, this is appropriate; the description does not materially improve parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's verb ('List' / 'show the status of one') and resource ('Codex Cloud background tasks'). It distinguishes itself from siblings by focusing specifically on Codex Cloud tasks, and even mentions the wrapping of undocumented CLI commands. This is a specific, well-defined purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool (listing tasks or showing status via task_id) and implicitly differentiates from siblings (codex_ask, codex_local_sessions, codex_read_thread). It doesn't explicitly state when not to use it, but the scope is evident. A minor gap is not naming alternative tools for other task-related operations, but the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_local_sessionsLocal Codex work sessionsARead-onlyIdempotent
List recent local Codex CLI sessions — the ones codex resume picks from — most recently touched first. Reads the undocumented ~/.codex/session_index.jsonl index directly, since codex resume itself is an interactive-only picker with no scriptable output. Only exposes what that index carries: session id, current thread name, and last-updated time — not live/idle status or working directory.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max sessions to return, most recently updated first. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds significant context beyond annotations: reads an undocumented index file directly, exposes only three specific fields, and does not provide live/idle status or working directory. Annotations already say readOnlyHint/idempotentHint/destructiveHint, and the description expands on the data source and limitations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences: action, rationale, limitations. No redundant fluff, every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one optional parameter and no output schema, the description sufficiently explains purpose, data source, return contents, and limitations, making it complete for the agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with `limit` fully described (default, min, max, ordering). The description adds no new parameter details, but the schema handles it; baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it lists recent local Codex CLI sessions, specifies the source (sessions `codex resume` picks from), and distinguishes from siblings by noting it reads the session_index.jsonl index directly and what fields it exposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains when to use this tool: to get a scriptable list of sessions for `codex resume`, and why not to use `codex resume` itself (interactive-only). It also sets exclusions: doesn't expose live/idle status or working directory, guiding the agent to not expect those.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_read_threadRead a Codex thread transcriptARead-onlyIdempotent
Read the message history of any Codex thread — whether it was created interactively (GUI / VS Code / TUI) or programmatically. Reads the thread's rollout JSONL from ~/.codex/sessions directly, so it needs no API call, consumes no quota, and works even when the account is rate-limited. Returns the most recent messages by default.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max messages to return, counting back from the most recent. | |
| max_chars | No | Truncate each individual message to this many characters. | |
| thread_id | Yes | The thread/session id (UUID) whose transcript to read. | |
| include_reasoning | No | Include the agent's internal reasoning entries, not just user/agent messages. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly and idempotent annotations, the description discloses that it reads directly from local JSONL files, needs no API call, consumes no quota, and works even when rate-limited. This adds significant behavioral context about its underlying mechanism and operational characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the primary purpose in the first sentence. It includes only relevant details about the local file reading, quota-free operation, and default behavior, with no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is fairly complete for a read-only tool with annotations and full schema coverage. It explains the key use case, mechanism, and default behavior. However, it lacks details about the return format (e.g., JSON structure) or error handling, which would be useful given there is no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% parameter coverage with detailed descriptions for limit, max_chars, thread_id, and include_reasoning. The description only adds that it returns the most recent messages by default, which is already implied by the schema's 'default: 50' and 'counting back from the most recent'. No additional parameter meaning is provided beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Read the message history of any Codex thread'. It identifies the specific resource (Codex thread), the action (read), and distinguishes from siblings by covering both interactive and programmatic threads. It also mentions reading from ~/.codex/sessions, which is a unique characteristic.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool: it can read any thread, requires no API call, consumes no quota, and works under rate limits. However, it doesn't explicitly mention alternatives like codex_local_sessions for listing threads or codex_ask for asking questions, so it lacks explicit when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
4 tool updates
v0.1.0- First observed
codex_ask - First observed
codex_cloud_tasks - First observed
codex_local_sessions - First observed
codex_read_thread
TDQS
Each tool has a clearly distinct purpose: codex_ask sends prompts, codex_cloud_tasks manages cloud background tasks, codex_local_sessions lists local sessions, and codex_read_thread reads message history. There is no overlap in either target resource or action.
All tools share the codex_ prefix, making them easy to group, but the pattern is not perfectly uniform: codex_ask and codex_read_thread use verb_noun, while codex_cloud_tasks and codex_local_sessions are noun-only. Still, the names are clear and predictable enough.
Four tools is well-scoped for a lightweight bridge to Codex. Each tool covers a distinct integration point without being too sparse or bloated.
The set covers the core needs: sending prompts, reading threads, listing sessions, and checking cloud tasks. Minor gaps exist, such as no ability to cancel a cloud task or resume a local session programmatically, but these are not essential for the bridge's apparent purpose.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Augments MCP Server - A comprehensive framework documentation provider for Claude Code
Real-time chat for AI agents. Claude Code, Cursor, Cline and Codex join channels over MCP.
Hosted Amazon Seller and Vendor MCP server for Claude, ChatGPT, Cursor, Codex, Gemini, Copilot.
Related MCP Servers
- AlicenseAqualityFmaintenanceMCP server for running external coding agents as background tasks inside Claude Code. Supports multiple backends including Codex, Grok, GLM, DeepSeek, and more.7MIT
- AlicenseNot gradedqualityDmaintenanceMCP server that enables Claude Code to delegate tasks to Codex for real-time collaborative code generation and execution.18MIT
- AlicenseAqualityBmaintenanceAn MCP server for running Claude Code and the Codex CLI as a pair: Claude drives, and hands self-contained tasks to Codex as background jobs.8MIT
- AlicenseAqualityBmaintenanceAn MCP server that lets Claude Code delegate durable background tasks, reasoning profiles, thread resumption, and native image generation to your local Codex CLI.101MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/eyalk11/codex-mcp-bridge'
If you have feedback or need assistance with the MCP directory API, please join our Discord server