codex-mcp-bridge
This server wraps the OpenAI Codex CLI as an MCP bridge, exposing AI-powered tools for code execution, web search, text analysis, code review, structured output, session management, and health monitoring, with subprocess isolation and concurrency control.
AI Code Execution (
codex): Run prompts with file context, resume sessions, control sandbox levels (read-only,workspace-write,full-auto), and adjust reasoning effort. Supports multi-turn conversations and automatic model fallback on quota exhaustion.Web Search (
search): Query the web and receive synthesized answers with source URLs.Lightweight Text Analysis (
query): Analyze or critique provided text without repo context.Native Code Review (
review): Diff-aware review of uncommitted changes, a base branch, or a specific commit in a git repository.Structured Output (
structured): Generate JSON validated against a caller-supplied JSON Schema.Session Management (
listSessions): List active sessions with metadata (turn count, model, timestamps) for orchestration.Health Checks (
ping,mcpStatus): Verify CLI installation and authentication, report concurrency diagnostics (activeCount,queueDepth), and state of other MCP servers.Isolation & Concurrency: Environment allowlisting, no shell escape, secret redaction, FIFO-queued concurrency (default max 3 parallel spawns), and partial response capture on timeout.
Integrates with OpenAI's Codex CLI to provide code execution, web search, and structured output capabilities.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@codex-mcp-bridgereview the current branch for security issues"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
codex-mcp-bridge
MCP server that wraps Codex CLI as a subprocess, exposing code execution, web search, and structured output as Model Context Protocol tools.
Works with any MCP client: Claude Code, Gemini CLI, Cursor, Windsurf, VS Code, or any tool that speaks MCP.
Do you need this?
If you're in a terminal agent (Claude Code, Codex CLI, Gemini CLI) with shell access, call Codex CLI directly. It's faster, cheaper, and zero overhead:
# Review current branch vs main
codex review --base main
# Review uncommitted changes
codex review --uncommitted
# Review with custom focus
codex review --base main "Focus on security and error handling"
# From a worktree (run inside the worktree; `-C` is broken for `review`)
cd /path/to/worktree && codex review --base main
# General analysis
codex exec "Analyze src/utils/parse.ts for edge cases"Use this MCP bridge instead when:
Your client has no shell access (Cursor, Windsurf, Claude Desktop, VS Code)
You need structured output with JSON Schema validation (Codex CLI's
--jsonhas known bugs)You need partial response capture on timeout and automatic model fallback on quota exhaustion
You want subprocess isolation: explicit env allowlist, no shell escape, secret redaction on output, FIFO-queued concurrency (max 3 parallel spawns, configurable via
CODEX_MAX_CONCURRENT)You need multi-turn conversations via session resume (
sessionId/resetSession, inspected vialistSessions)
Worktree note: Codex CLI issue #9084
breaks codex -C /path review .... Run codex review from inside the worktree to avoid it.
Related MCP server: gemini-mcp-bridge
Quick Start
npx codex-mcp-bridgePrerequisites
Codex CLI installed (
npm i -g @openai/codex)OPENAI_API_KEYenvironment variable set, orcodex auth logincompleted
Claude Code
claude mcp add codex-bridge -- npx -y codex-mcp-bridgeGemini CLI
Add to ~/.gemini/settings.json:
{
"mcpServers": {
"codex-bridge": {
"command": "npx",
"args": ["-y", "codex-mcp-bridge"]
}
}
}Cursor / Windsurf / VS Code
Add to your MCP settings:
{
"codex-bridge": {
"command": "npx",
"args": ["-y", "codex-mcp-bridge"],
"env": {
"OPENAI_API_KEY": "sk-..."
}
}
}Tools
Tool | Description |
codex | Execute prompts with file context, session resume, and sandbox control. Multi-turn conversations via session IDs. Use for free-form review prompts; see Code review with this CLI. |
review | Native diff-aware Codex review via |
search | Web search via |
query | Lightweight text analysis. No repo context, no sessions. Runs in an isolated temp directory. |
structured | JSON Schema validated output via Ajv. Data extraction, classification, or any task needing machine-parseable output. |
ping | Health check with CLI version, capabilities, and concurrency diagnostics ( |
mcpStatus | Report what Codex says about each MCP server it knows about: auth type, tool inventory, and whether it initialized. Optional diagnostic mode adds explicit failure states and error text. |
listSessions | List active conversation sessions with metadata (turn count, model, timestamps). |
codex
General-purpose execution. Supports multi-turn conversations via sessionId, sandbox levels (read-only, workspace-write, full-auto), and reasoning effort control. Pass resetSession: true to discard and start fresh. Use listSessions to inspect active sessions before resuming.
Key parameters: prompt (required), files, model, sessionId, sandbox, reasoningEffort, workingDirectory, timeout (default 60s).
search
Web search powered by OpenAI's native search infrastructure via Codex CLI's --search flag. Returns synthesized answers with source URLs.
Key parameters: query (required), model, workingDirectory, timeout (default 120s).
query
Lightweight, non-agentic text analysis. Spawns in an isolated temp directory so the bridge's repo context doesn't leak. Pass text to analyze in the context parameter. Supports reasoningEffort and maxResponseLength.
Key parameters: prompt (required), context, model, reasoningEffort, timeout (default 60s).
review
Thin wrapper around Codex CLI's native diff-aware review. The bridge passes the diff selector to codex exec review --json; upstream Codex owns the review prompt. Requires a real git repository via workingDirectory.
Key parameters: mode (required: uncommitted, base, or commit), workingDirectory (required), base (required for base mode), commit (required for commit mode), title, model, timeout (default 180s).
structured
Embeds a JSON Schema in the prompt and validates the response with Ajv. Returns clean JSON on success, validation errors on failure.
Key parameters: prompt (required), schema (required, JSON string), files, model, workingDirectory, timeout (default 60s).
ping
No parameters. Returns CLI version, auth status, model configuration, and concurrency diagnostics (activeCount, queueDepth).
mcpStatus
Reports per-server MCP state as Codex's own app-server protocol sees it. Unlike every other tool, it deliberately does not suppress Codex's MCP servers or harden the subprocess environment, because both would disable the thing being measured. It therefore boots the servers in ~/.codex/config.toml and is slower than a normal call.
Key parameters: diagnostics (default false), workingDirectory, timeout (per-request, default 90s).
Mode | Cost | What you get |
default | ~6-9s | Inventory: auth type, tool names and counts, and |
| ~10-20s | Adds an explicit |
Reading the output:
unknownis not a failure. It means the inventory carried no server info and no explicit verdict was available. Onlydiagnostics: truecan reportfailed.A
degradedwarning means don't trustunknown. Slow calls have been observed reporting healthy servers as uninitialized, so the tool reports how long the underlying call took and flags the result when it was slow enough to be suspect.builtInmarks a server Codex injects that is not in your config;configuredButUnreportedmarks one in your config that Codex never mentioned.
Example:
atlassian failed auth=oAuth tools=0
error: MCP client for `atlassian` failed to start: MCP startup failed: failed to
refresh OAuth tokens for server atlassian: ... invalid_grant: Grant not found
codex_apps initialized auth=bearerToken tools=117 (builtIn)
linear initialized auth=oAuth tools=57
serena initialized auth=unsupported tools=22All tools attach execution metadata (_meta) with durationMs, model, fallbackUsed, and session info where applicable. See DESIGN.md for details.
Code review with this CLI
This bridge does not bundle reviewer prompts. There are three paths for code review:
Native upstream codex review
codex review --base main
codex review --uncommitted
codex review --base main "Focus on security and error handling"Diff-aware review built into Codex CLI. No bridge involvement. Use this when your client has shell access.
Bridge review tool for native diff-aware review
{
"tool": "review",
"arguments": {
"mode": "base",
"base": "main",
"workingDirectory": "/path/to/worktree"
}
}The bridge runs codex exec review --json from workingDirectory, captures the final review text, and returns review metadata such as threadId, event counts, and redacted command output. It does not accept a prompt.
Bridge codex tool with caller-supplied prompt
{
"tool": "codex",
"arguments": {
"prompt": "<your review prompt + diff or file references>",
"sandbox": "read-only"
}
}The bridge runs codex exec --sandbox read-only with the supplied prompt and returns stdout. Use this for free-form review prompts or review inputs that are not expressible as uncommitted, base, or commit diff selectors.
Representative review prompt
A starting point; adapt freely:
Review the following diff:
<diff content>
Look for:
- Bugs that would surface in production
- Missing error handling on user-supplied input
- Tests modified to silence failures rather than verify behaviour
- Security issues (injection, missing auth checks, secret leaks)
For each finding cite file:line, severity (high/medium/low), and a suggested fix.
Skip style/formatting; assume an autoformatter handles those.The bridge has no opinion on prompt content. See ADR-001 for the rationale.
Configuration
Variable | Default | Description |
| (CLI default) | Default model for all tools |
|
| Fallback on quota exhaustion ( |
|
| Path to CLI binary |
|
| Max concurrent subprocess spawns |
| (unset) | Control which Codex internal MCP servers stay enabled. See DESIGN.md. |
Choosing a Codex MCP server
You need... | Consider |
Structured output, model fallback, concurrency management, session resume | This bridge |
Session threading with | |
Structured patch output with approval policies | |
Minimal | |
Native Codex MCP (experimental, no wrapper needed) |
|
Performance
Codex CLI has minimal startup overhead (<100ms), so wall time is dominated by model inference.
Scenario | Typical time |
Trivial prompt | 9-12s |
Web search | ~17s |
Default timeouts (60-300s) are comfortable for typical workloads.
Bridge family
Two MCP servers, same architecture, different underlying CLIs. Each wraps a terminal agent as a subprocess and exposes it as MCP tools. Pick the one that matches your model provider, or run both for cross-model workflows.
CLI | Codex CLI | Claude Code |
Provider | OpenAI | Anthropic |
Tools | codex, review, search, query, structured, ping, listSessions | query, review, search, structured, ping, listSessions |
Code review |
|
|
Structured output | Ajv validation | Native |
Session resume | Session IDs with multi-turn | Native |
Budget caps | Not supported | Native |
Effort control |
|
|
Cold start | <100ms (inference dominates) | ~1-2s |
Auth |
|
|
Cost | Pay-per-token | Subscription (included) or API credits |
Concurrency | 3 (configurable) | 3 (configurable) |
Model fallback | Auto-retry with fallback model | Auto-retry with fallback model |
Both share: subprocess env isolation, path sandboxing, output redaction (secret stripping), FIFO concurrency queue, MCP tool annotations, _meta response metadata, progress heartbeats.
Development
npm install
npm run build # Compile TypeScript
npm run dev # Watch mode
npm test # Run tests
npm run lint # ESLint
npm run typecheck # tsc --noEmitFurther reading
DESIGN.md - Architecture, MCP server control grammar, sessions, output parsing, response metadata
SECURITY.md - Environment isolation, path sandboxing, output redaction, resource limits
CHANGELOG.md - Release history
License
MIT
Available Tools
8 toolscodexCodex CLIADestructive
Execute a prompt via Codex CLI. Codex is an AI coding agent that can generate, analyze, refactor, and explain code with full project context (reads AGENTS.md/CODEX.md automatically).
Capabilities: code generation and refactoring, code analysis and explanation, file reading and modification (when sandbox allows), git operations and terminal commands, multi-turn conversations via sessionId.
When to use a different tool:
For analysis of text you already have (plans, docs, opinions), inline it directly in the prompt rather than passing file paths. The files parameter triggers full file I/O and increases timeout pressure.
Tips:
Set workingDirectory to the target repo for project-aware responses.
Use sandbox "read-only" (default) for analysis, "full-auto" for code changes.
Break complex tasks into focused prompts rather than one large request.
Resume multi-turn conversations with sessionId (returned in previous response metadata).
Include relevant files via the files parameter for targeted context (text and images supported).
Set reasoningEffort to control depth: "none" for trivial, "minimal" for lightweight, "low"/"medium" for routine, "high"/"xhigh" for deep analysis.
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | File paths relative to workingDirectory. Supports line ranges: 'path:start-end' (e.g. 'src/lib.rs:900-950'). Text and images supported (images ignore line ranges). | |
| model | No | Model to use (e.g. o3, gpt-4.1) | |
| prompt | Yes | The prompt to send to Codex | |
| sandbox | No | Sandbox level: read-only (default), workspace-write, or full-auto (Codex CLI convenience mode for workspace-write with auto-approve) | read-only |
| timeout | No | Timeout in milliseconds (default: 60s no files, 180s+30s/file with files, max: 600000) | |
| sessionId | No | Session ID to resume a previous conversation | |
| resetSession | No | Clear this session's conversation history and start fresh (requires sessionId) | |
| reasoningEffort | No | Reasoning effort level (maps to -c model_reasoning_effort) | |
| workingDirectory | No | Working directory for the CLI | |
| maxResponseLength | No | Soft limit on response length in words |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already include destructiveHint=true and readOnlyHint=false. The description enhances this by detailing sandbox levels (read-only, workspace-write, full-auto), timeout behavior, and the impact of the files parameter on I/O and timeout. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized: a one-sentence purpose, a bulleted capabilities list, a 'When to use a different tool' paragraph, and compact tips. Every sentence adds value, and the structure aids quick comprehension.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 10 parameters, no output schema, and complex capabilities, the description covers purpose, usage guidelines, tips, and behavioral context. It could be more explicit about the response format, but overall it provides sufficient context for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. However, the description adds significant practical context: line ranges for files, sandbox semantics, timeout defaults, reasoning effort mapping, and sessionId usage. This goes well beyond the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Execute a prompt via Codex CLI' and lists specific capabilities like code generation and refactoring. It distinguishes from siblings through the 'When to use a different tool' section and by emphasizing that this tool is for interacting with an AI coding agent with full project context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a 'When to use a different tool' section that advises against using the files parameter for simple text analysis, and offers tips on setting workingDirectory, sandbox level, and session management. While it doesn't explicitly contrast with sibling tools, the guidance is clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listSessionsList SessionsARead-onlyIdempotent
List active Codex conversation sessions. Returns session metadata for orchestration (no prompts or responses, just IDs and timing). Use to check available sessions before resuming with the codex tool's sessionId parameter.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint. Description adds that it returns only metadata (no prompts/responses) and focuses on active sessions, providing useful behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the primary action, no redundant words. Highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameter-free tool with no output schema, the description fully covers purpose, return content, and usage context. Additional details on output format are unnecessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With zero parameters and 100% schema coverage, the description naturally contains no param details. Baseline score of 4 is appropriate; no further info needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists active Codex sessions and specifies exactly what metadata is returned (IDs and timing). It distinguishes itself from siblings like codex by explaining its role in orchestration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises when to use: 'Use to check available sessions before resuming with the codex tool's sessionId parameter.' No ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcpStatusMCP Server StatusARead-only
Report what Codex's own app-server says about each MCP server it knows about: auth type, tool inventory, and whether the server initialized.
Unlike the other tools, this one deliberately does NOT suppress Codex's MCP servers — suppressing them would disable the thing being measured — so it is slower than a normal call and boots the servers named in ~/.codex/config.toml.
Two modes:
Default (~6-9s): inventory only. Reports each server as "initialized" or "unknown". Creates no thread and writes no session record.
diagnostics: true (~10-20s): starts an ephemeral thread to collect startup notifications, which are the only source of an explicit "failed" state and the error text naming the cause (expired OAuth grant, missing binary, remote refusal).
Reading the output:
"unknown" is not a failure. It means the inventory carried no server info and no explicit verdict was available. Only diagnostics mode can report "failed".
A "degraded" warning means the underlying call was slow enough that healthy servers have been observed reporting as uninitialized. Treat "unknown" as unproven when it appears.
Servers marked "builtIn" are injected by Codex and are not in your config.toml. Servers marked "configuredButUnreported" are in your config.toml but absent from Codex's inventory.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | Per-request timeout in milliseconds (default: 90000) | |
| diagnostics | No | Start an ephemeral thread to collect startup notifications. Slower, but the only way to get explicit failure states and error text. | |
| workingDirectory | No | Working directory for the app-server session |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/destructive annotations, the description discloses significant behavioral traits: it is slower than normal calls, boots servers from ~/.codex/config.toml, produces no thread/session record in default mode, and starts an ephemeral thread in diagnostics mode. It also explains output interpretation ('unknown' is not a failure, 'degraded' warning semantics, builtIn vs configuredButUnreported). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Although the description is long, it is exceptionally well-structured with a clear purpose statement, a behavioral caveat section, a two-mode breakdown, and an output interpretation guide. Every sentence adds necessary detail for a tool with no output schema. It is front-loaded with the most important information and uses scannable formatting.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, the lack of an output schema, and the need to explain side effects, timing, and result semantics, the description is remarkably complete. It covers what the tool returns (initialized/unknown/failed), when failures can be detected, how to interpret warnings, and what side effects occur. No gaps remain for a competent agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds meaningful context beyond the schema for the diagnostics parameter, explaining that it 'starts an ephemeral thread to collect startup notifications' and is the only way to get explicit failure states. It also clarifies the default behavior (inventory only) which ties to the parameter's absence. Timeout and workingDirectory are left to the schema, but the added diagnostics context raises it above baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Report what Codex's own app-server says about each MCP server it knows about: auth type, tool inventory, and whether the server initialized.' It clearly distinguishes itself from sibling tools by explicitly stating 'Unlike the other tools, this one deliberately does NOT suppress Codex's MCP servers,' making its unique purpose obvious.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear when-to-use context and even explains why alternatives would not work ('suppressing them would disable the thing being measured'). It also gives explicit guidance on choosing between default and diagnostics mode, stating diagnostics is 'the only way to get explicit failure states and error text.' This is strong usage guidance with exclusions and mode selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pingHealth CheckARead-onlyIdempotent
Health check: verifies Codex CLI is installed and authenticated, reports versions and capabilities.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds context beyond annotations by specifying the verification and reporting actions, without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no waste, front-loading the purpose and key behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequately describes the tool for a health check with no parameters or output schema, though exact return format is not specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist; description adds value by stating the tool's function, meeting the baseline for 0-param tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool verifies Codex CLI installation and authentication and reports versions and capabilities, distinguishing it from siblings like search or query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives, but the purpose is implied through the health check nature.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
queryQuick QueryARead-only
Lightweight query for analysis or opinions on text you already have. No file reading, no repo exploration, no session state. Pass text in the context parameter. For code execution or file operations, use the codex tool instead.
Use cases: reviewing a plan, critiquing a draft, comparing approaches, answering questions about provided text, generating summaries.
Tips:
Pass the text to analyze in the context parameter, not as file paths.
Set reasoningEffort to control depth: "none" for trivial, "minimal" for lightweight, "low"/"medium" for routine, "high"/"xhigh" for thorough analysis.
Use maxResponseLength to control verbosity.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Model to use (e.g. o3, gpt-4.1) | |
| prompt | Yes | The question or instruction | |
| context | No | Text to analyze (inline, not file paths) | |
| timeout | No | Timeout in milliseconds (default: 60000, max: 600000) | |
| reasoningEffort | No | Reasoning effort level (maps to -c model_reasoning_effort) | |
| maxResponseLength | No | Soft limit on response length in words |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly and openWorld hints. Description adds context: no file reading, no repo exploration, no session state. It confirms non-destructive behavior and provides clarity on what the tool cannot do, which is valuable beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Description is well-structured: brief overview, explicit exclusions, use cases, and tips. Every sentence adds value. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 parameters and no output schema, the description fully covers the tool's behavior, parameter usage, and limitations. It is complete enough for an agent to use correctly without confusion.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All parameters are described in schema, but the description adds extra guidance: context must be inline text (not file paths), reasoningEffort levels mapped to depth, maxResponseLength as soft limit. This adds significant value beyond the schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool is a lightweight query for analysis on existing text, distinguishing it from code execution (codex), search, and other siblings. It specifies what it does not do (file reading, repo exploration, session state).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides use cases (reviewing, critiquing, comparing) and when not to use (for code execution or file operations, use codex). Also includes tips on how to pass text and control reasoning effort.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reviewNative Code ReviewADestructive
Run Codex CLI's native diff-aware review via codex exec review --json. The bridge does not accept or bundle a review prompt; upstream Codex owns the reviewer instructions.
Use for MCP clients that cannot run shell commands but need native Codex review of uncommitted changes, a base branch diff, or a single commit.
Tips:
Set workingDirectory to the target git repository.
Choose mode "uncommitted", "base", or "commit".
Use the codex tool with sandbox "read-only" for free-form review prompts.
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | Base branch or ref. Required when mode is "base". | |
| mode | Yes | Diff selector: uncommitted changes, changes against a base branch, or one commit | |
| model | No | Model to use (e.g. o3, gpt-4.1) | |
| title | No | Optional commit title to display in the review summary | |
| commit | No | Commit SHA or ref. Required when mode is "commit". | |
| timeout | No | Timeout in milliseconds (default: 180000, max: 600000) | |
| workingDirectory | Yes | Target git repository directory for native review |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false. The description adds no behavioral context beyond what annotations provide; it does not explain what destructive actions might occur or what side effects the review has (e.g., modifying git state). It adequately describes the input scope but not the behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise: two paragraphs and a bullet list with no filler. It front-loads the core purpose and practical usage, making it easy for an AI agent to parse efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the description covers purpose and usage, it lacks information about the output format. Since there is no output schema, the description could explain the review return structure (e.g., JSON with issues, severity, line numbers). Additionally, it gives no details on limitations or error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter already has a clear description. The description adds general tips (e.g., 'Set workingDirectory to the target git repository') but does not provide additional semantic detail beyond what the schema offers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs 'Codex CLI's native diff-aware review' and specifies it is for reviewing uncommitted changes, base branch diffs, or a single commit. It distinguishes from sibling tools like 'codex' by targeting MCP clients that cannot run shell commands.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('for MCP clients that cannot run shell commands but need native Codex review') and provides alternatives: 'Use the codex tool with sandbox "read-only" for free-form review prompts.' It also gives tips on setting workingDirectory and choosing mode.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
searchWeb SearchARead-onlyIdempotent
Web search via Codex CLI. Searches the web and synthesizes a comprehensive answer with source URLs. Use for current information, documentation lookups, API references, and research questions.
Tips:
Ask specific, focused questions for best results.
Results include source URLs for verification.
Use maxResponseLength to control response verbosity.
Default timeout is 2 minutes; increase for complex research queries that may require multiple web fetches.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Model to use (e.g. o3, gpt-4.1) | |
| query | Yes | Search query or question | |
| timeout | No | Timeout in milliseconds (default: 120000, max: 600000) | |
| workingDirectory | No | Working directory for the CLI | |
| maxResponseLength | No | Soft limit on response length in words |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint, covering safety and side effects. The description adds behavioral details such as default timeout (2 minutes), ability to increase for complex queries, and control of verbosity via maxResponseLength. It does not describe rate limits or API costs, but given the annotations, this is sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with a clear purpose statement followed by bullet-point tips. It is front-loaded with the main function. One sentence could be removed (e.g., 'Results include source URLs for verification' is stated twice), but overall it is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (web search with synthesis) and the richness of annotations, the description covers key aspects: response includes URLs, timeout behavior, and length control. No output schema exists, but the description explains return format sufficiently. Missing details like error handling are not critical for basic use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all parameters. The description adds value by explaining when to adjust timeout and maxResponseLength, and how they affect behavior (e.g., complex queries may require multiple fetches). This goes beyond the schema's type/limit descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Web search via Codex CLI' and 'Searches the web and synthesizes a comprehensive answer with source URLs', providing a specific verb and resource. However, it does not explicitly distinguish from sibling tools like 'query' or 'review', which may have overlapping purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description lists concrete use cases (current information, documentation lookups, API references, research) and provides actionable tips (ask specific questions, use maxResponseLength, adjust timeout). It lacks explicit when-not-to-use or alternative tool references, but the context is clear enough for an AI agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
structuredStructured OutputARead-only
Generate a JSON response conforming to a provided JSON Schema. Use for data extraction, classification, or any task needing machine-parseable output.
| Name | Required | Description | Default |
|---|---|---|---|
| files | No | File paths to include as context (text only, no images). Supports line ranges: 'path:start-end' (e.g. 'src/lib.rs:900-950'). | |
| model | No | Model to use (e.g. o3, gpt-4.1) | |
| prompt | Yes | What to generate or extract | |
| schema | Yes | JSON Schema the response must conform to (as a JSON string) | |
| timeout | No | Timeout in milliseconds (default: 60000) | |
| workingDirectory | No | Working directory for file paths |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering safety. The description adds that it generates a JSON response, but does not elaborate on behavior like error handling or idempotency. With annotations doing heavy lifting, the description is adequate but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the core action followed by use cases. No redundant or missing words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 6 parameters (2 required) and no output schema, the description covers the essential function and use cases. It could hint at return value more explicitly, but 'Generate a JSON response' suffices.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with detailed parameter descriptions. The tool description does not add additional meaning beyond what the schema already provides, meeting the baseline expectation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it generates JSON based on a provided schema, naming specific use cases like data extraction and classification. It distinguishes from sibling tools (codex, search) by emphasizing structured output.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use for data extraction, classification, or any task needing machine-parseable output,' providing clear when-to-use guidance. However, it lacks explicit when-not-to-use or alternatives among siblings, but the context is strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
1 tool update
v0.9.1- Added
mcpStatus
7 tool updates
v0.8.0- First observed
codex - First observed
listSessions - First observed
ping - First observed
query - First observed
review - First observed
search - First observed
structured
TDQS
Each tool has a distinct purpose, though codex/query and ping/mcpStatus have some overlap. Descriptions draw clear boundaries, but an agent could still confuse the general-purpose codex tool with its specialized variants like query or review.
Naming follows no consistent pattern: listSessions and mcpStatus use camelCase, while the rest are single lowercase verbs or nouns (codex, search, query, ping, review, structured). Some are verbs, some nouns, and one is an adjective, making the set feel inconsistent.
8 tools is appropriate for the bridge's scope, covering core execution plus specialized helpers without bloat. It sits comfortably within the typical 3-15 range and each tool earns its place.
The server covers core prompt execution, lightweight text analysis, web search, structured output, native review, session listing, and health/status checks. Minor gaps like session deletion or explicit file operations remain, but codex's own capabilities fill those holes.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
MCP server for progressive tool usage at any scale (see https://klavis.ai)
A Model Context Protocol server for Wix AI tools
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceWraps OpenAI Codex CLI as an MCP server, exposing 8 Codex tools (exec, review, skill list, skill run, status, poll, list jobs, kill) as named tools for use with pi or codex.765ISC
- AlicenseAqualityFmaintenanceMCP server that wraps Gemini CLI as a subprocess, exposing its capabilities as Model Context Protocol tools.51306MIT
- AlicenseNot gradedqualityDmaintenanceWraps OpenAI's Codex CLI as an MCP server, enabling AI clients like KiloCode, Roo Code, and Cline to leverage Codex for code generation, debugging, and analysis through natural language.52MIT
- FlicenseAqualityCmaintenanceAn MCP server that brings Parallel web search and URL extraction to Codex and other Model Context Protocol clients.221-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/hampsterx/codex-mcp-bridge'
If you have feedback or need assistance with the MCP directory API, please join our Discord server