Grok Plugin Codex
This server exposes the local Grok CLI as MCP tools, allowing Codex to delegate code analysis, reviews, diagnostics, and background job management to Grok as a second-agent surface.
Check & Models —
grok_checkverifies CLI installation, version, and login/model availability;grok_modelslists available models.Run & Continue —
grok_runexecutes any prompt in foreground (JSON) or background (streaming-JSON) mode;grok_continueresumes an existing session by ID or the latest one.Review Tools —
grok_reviewperforms bounded, findings-first code reviews;grok_adversarial_reviewfocuses on failure modes (max 5 findings);grok_rescueprovides an independent, read-only diagnosis and minimal path forward.Session & Export —
grok_sessionslists/searches past sessions;grok_exportreturns a session as Markdown or saves it to a file.Background Job Management —
grok_statuschecks job status;grok_resultretrieves stdout/stderr tails and parsed output;grok_cancelterminates a running job.Shared Configuration — All tools accept parameters for working directory, Grok binary, model, timeout, background execution, web search toggle, subagents, max turns, reasoning effort, and privacy controls (e.g.,
allowCodexPrivatePaths).
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Grok Plugin CodexReview the latest commit for potential issues."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Grok Plugin Codex
grok-plugin-codex exposes a locally installed Grok CLI to Codex through a bundled Node/TypeScript MCP server. Codex remains responsible for scope, workspace state, verification, git, and final judgment; Grok is a bounded second surface.
Version 0.3.1 is the current release. It treats an explicit absolute cwd as a per-call grant to the exact canonical workspace while preserving validation and operation-level permissions. See CHANGELOG.md for the full contract changes. Version 0.3 introduced recovery/finality controls and the private central worker architecture.
Repository: https://github.com/handong66/grok-plugin-codex Write-up: https://han-dong.link/en/work/grok-plugin-codex
Requirements
Node.js
>=22npm
macOS or Linux
Codex local plugin marketplace support
Grok CLI installed and authenticated
Check the three runtime layers separately:
grok --version # CLI can be discovered
grok --help # installed flags/capabilities
grok models # authentication and model listingA listed model has not necessarily completed a real invocation. grok_check preserves that distinction.
Related MCP server: Grok Build Bridge
Install
npm install
npm run check
codex plugin marketplace add .
codex plugin add grok-plugin-codex --marketplace grok-plugin-codexStart a new Codex task after installation or upgrade. Existing tasks retain the MCP server and skill snapshot with which they started. If a new Codex Desktop task sees the updated skill but not the updated MCP tools, restart Codex Desktop and create another task; the Desktop process can retain its MCP registry across reinstall.
The installed bundle contains both:
plugins/grok-plugin-codex/dist/server.js
plugins/grok-plugin-codex/dist/job-worker.jsCapability surface
grok_check,grok_models: CLI/capability, authentication, entitlement, and model diagnostics.authenticatedandentitledaretrue,false, or"unknown"— nevernull.grok_run,grok_continue: explicit prompt execution and known-session continuation.grok_finalize: one turn, no tools, complete answer — the recovery for a timed-out, turn-limited, cancelled, or permission-blocked run.grok_rescue,grok_review,grok_adversarial_review: enforced read-only, no-subagent second passes. Each needs atarget(orproblem), for which the sibling plugin's namepromptis also accepted.grok_adversarial_reviewtakes an optionalthreatModel; findings outside it are advisory and may not block.grok_sessions,grok_export: explicit-workspace session inspection and Markdown export.grok_status,grok_result,grok_cancel: private central background-job lifecycle byjobIdonly.grok_statusreturns cheap progress (textChars,eventCounts,lastEventAt,toolCallCount,deniedToolCalls) and takes an optionalwaitMs(≤ 30 s) server-side wait;grok_resultpagesfinalTextwithfinalTextOffset/finalTextMaxChars.
The current MCP listTools schema is authoritative for exact arguments. The repository smoke test locks the published surface and rejects drift.
Result contract
Successful operations return:
{ "ok": true, "data": {}, "error": null, "warnings": [] }Business failures set MCP isError: true and return:
{
"ok": false,
"data": null,
"error": { "code": "typed_code", "message": "actionable message", "retryable": false },
"warnings": []
}Input schema violations are SDK-generated tool errors (isError: true) without the plugin business envelope; clients must inspect the resolved tool result rather than relying only on promise rejection. Every tool publishes an output schema, and plugin-handled JSON text mirrors structuredContent.
Workspace and prompt boundaries
Workspace operations require an absolute cwd. Supplying it grants only that tool call access to the exact canonical directory, regardless of whether the MCP client advertises the same root, another root, or no roots. The grant is not cached for later calls. The server resolves symlinks, rejects missing and non-directory paths, and blocks private Codex paths such as ~/.codex unless the user explicitly authorizes that risk. This workspace grant does not enable --always-approve; mutable operation approval remains separately opt-in, and review/rescue tools remain read-only.
Prompts are staged briefly in private 0600 files so a detached worker can survive MCP-server exit. The worker reads and deletes the staging file before Grok runs, then supplies the prompt through a 0600 FIFO inside a random 0700 directory. Grok receives only that private pathname through native --prompt-file; the launcher unlinks it as soon as Grok opens it, before writing any prompt bytes. Prompt text is not placed in the child-process argument list or job record. GROK_BIN is the only supported custom executable configuration and must come from the trusted MCP environment.
Background jobs
Background jobs run in a detached worker and survive MCP-server restarts. State lives under:
$GROK_PLUGIN_STATE_DIR, when explicitly configured;$XDG_STATE_HOME/grok-plugin-codex;~/.local/state/grok-plugin-codex.
An explicit state directory must be disjoint from every active workspace root: neither inside a root nor an ancestor of one. It must be empty, carry the plugin's ownership marker, or match the strict private pre-marker job layout; the plugin will not claim or chmod an existing shared directory. These checks fail closed before creating or changing repository-local state.
Directories use 0700; records, logs, prompt staging files, cancel markers, heartbeats, and owner-token cross-process locks use 0600. Record writes are atomic and terminal status is monotonic. Cancellation is linearized by a marker consumed by the owning worker. Each process group is led by a private launcher whose command identity includes the job ID and random job token; stale-worker reconciliation terminates a persisted group only when all three match, and the launcher removes residual descendants before exiting.
Dispatch tools (grok_run, grok_review, grok_adversarial_review, grok_rescue) default to background: true; grok_continue defaults to foreground. Save data.job.id, then call job tools with jobId. A foreground call (background: false) blocks for at most timeoutMs plus a 10 s grace and then returns foreground_wait_timeout with that job id. An omitted timeoutMs defaults per kind — run/continue 180000, review/rescue 240000, adversarial_review 300000 — and an explicit value is never clamped in either direction; both effective values come back as effectiveTimeoutMs / effectiveMaxTurns. The recommended rhythm for a background job is one grok_status with waitMs, then one grok_result, rather than a polling loop. Only this combination is final:
data.resultComplete === trueInternally, completeness also requires non-empty final text and a normal end event, and — for grok_review and grok_adversarial_review — at least one tool call, since a verdict from a reviewer that opened nothing is an opinion (no_evidence_review). The read-only kinds run in plan mode, where shell execution is refused automatically: inline the diff or command output the review needs into the target, and a run that was cancelled because a shell command needed approval is reported as permission_denied_headless rather than as a target that was too wide. Stop reasons are normalised case- and separator-insensitively (end_turn and EndTurn are the same fact), the raw value is preserved in outputSummary.stopReason, and callers must not string-match it themselves. A cancelled end is returned as cancelled_output. An unrecognised stop reason after real text is accepted with stopReasonRecognised: false plus a warning instead of being discarded.
Every non-complete result carries a recovery handle — error.details.recovery on a failed foreground call, data.recovery on grok_result — shaped { jobId, grokSessionId, partialTextChars, suggested: { tool: "grok_finalize", args }, fallback: { tool: "grok_continue", args } }. The handle is executable as given: suggested is the one-call recovery, and fallback is the same thing spelled out for a caller that only speaks grok_continue (maxTurns: 1 plus the grok_finalize prompt). Neither asks for a shortened answer. The remedy for max_turns_reached and for a cancelled or timed-out run is grok_finalize with that job id, or the same call by hand: continue the same session with maxTurns: 1 and a prompt telling Grok to stop using tools and emit the final answer now. Do not narrow the target, raise maxTurns, or rerun the task — the partial answer is never destroyed, error.details.finalTextRef is the job id, and grok_result returns the complete captured text whatever resultComplete says.
resultComplete accounts for truncation itself: outputTruncated only says the shared capture window overflowed, which is normally tool-call echo, while textTruncated says answer text was dropped and is the flag that vetoes completeness. Oversized tool payloads are elided at capture time and available_commands payloads are dropped; set GROK_PLUGIN_RAW_CAPTURE=1 to keep the vendor stream verbatim for plugin development.
Use data.finalText. Partial states are diagnostics only, and the raw per-token log tails are returned only when grok_result is called with includeRawTail: true. The worker keeps the answer in an append-only <id>.final.txt ledger and the stream facts in <id>.summary.json, so grok_result answers from that ledger instead of re-parsing the raw stream, and grok_status reads progress from the same file. Terminal job artifacts are retained for seven days and cleaned opportunistically.
Upgrading from 0.1
Finish or cancel 0.1 background jobs before upgrading.
0.2 does not scan or trust old
<workspace>/.grok-plugin-codex/jobsrecords.Old workspace directories are not automatically removed because they belong to the user's workspace.
Per-call executable selection, caller-selected export files, implicit review targets, and job-control
cwdare removed.
Privacy boundary
The plugin does not copy hidden Codex context, system/developer messages, reasoning, arbitrary tool output, secrets, or credentials into prompts. It cannot redact sensitive text that a caller explicitly supplies. See docs/privacy.md.
Development
npm install
npm run check
git diff --checkOptional authenticated invocation:
npm run smoke:live-grokRuntime schemas and tests are authoritative. Bundled README/skill files are the installed user contract; test/contract-drift.test.ts and the MCP smoke prevent removed arguments or mismatched versions from reappearing.
See docs/development.md and docs/verification.md.
Project policies
Available Tools
12 toolsgrok_adversarial_reviewGrok Adversarial ReviewB
Ask Grok for a bounded failure-mode review with at most 5 findings.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| model | No | Grok model ID to pass with -m/--model. | |
| target | No | Review target. Defaults to current working tree. | |
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| maxTurns | No | Pass --max-turns. | |
| timeoutMs | No | ||
| background | No | Run as a background job using --output-format streaming-json. | |
| noSubagents | No | Pass --no-subagents. | |
| alwaysApprove | No | Pass --always-approve only when explicitly true. | |
| reasoningEffort | No | Pass --reasoning-effort only for non-default models where the plugin does not know it is unsupported. | |
| disableWebSearch | No | Pass --disable-web-search. | |
| allowCodexPrivatePaths | No | Allow prompts that mention Codex private runtime paths such as ~/.codex. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears the full burden of disclosing behavioral traits. It only mentions a limit of 5 findings, leaving unclear whether the tool is read-only, what side effects occur, or how background execution (parameter 'background') affects behavior. Essential safety details are missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 12 words, front-loading the action and key constraint ('at most 5 findings'). Every word carries weight; it is maximally concise without sacrificing clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, 12 parameters, and the complexity of invoking an external binary, the description is too sparse. It does not explain what constitutes a 'failure-mode review,' how findings are presented, error handling, or how parameters like 'background' or 'model' affect behavior. Much needed context is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high (92%), so the baseline is 3. The description adds no additional parameter context beyond the overall purpose, but the schema already documents most parameters well. The description does not compensate for the uncovered ~8% or enrich parameter meanings.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool asks Grok for a 'bounded failure-mode review with at most 5 findings,' specifying a distinct verb ('Ask') and resource type. It distinguishes itself from the sibling tool 'grok_review' by emphasizing boundedness and failure-mode focus.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for adversarial or security-related failure analysis, and the 'bounded' qualifier hints at scenarios needing limited findings. However, it lacks explicit guidance on when to use this versus sibling tools like 'grok_review' or 'grok_run', and does not mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_cancelCancel Grok JobC
Cancel a running background Grok job.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| jobId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must disclose behavioral traits. It only states the action but omits side effects (e.g., whether the job is terminated or can be resumed), permission requirements, or impact on other jobs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise at one sentence, but it lacks structure and fails to include critical details. It earns a middle score for brevity without completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 2 parameters, no output schema, and no annotations, the description is insufficient. It does not cover prerequisites, return behavior, or error conditions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description adds no meaning to the parameters. It does not explain 'cwd' or how to obtain 'jobId,' leaving the agent to guess.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Cancel' and the resource 'a running background Grok job,' which is distinct from sibling tools like grok_run or grok_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, nor when not to use it. For example, it doesn't mention whether cancel requires the job to be running or if it works on queued jobs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_checkCheck GrokC
Discover Grok CLI, run grok --version, and detect login/model availability with grok models.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| model | No | Grok model ID to pass with -m/--model. | |
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| maxTurns | No | Pass --max-turns. | |
| timeoutMs | No | ||
| background | No | Run as a background job using --output-format streaming-json. | |
| noSubagents | No | Pass --no-subagents. | |
| alwaysApprove | No | Pass --always-approve only when explicitly true. | |
| includeModels | No | ||
| reasoningEffort | No | Pass --reasoning-effort only for non-default models where the plugin does not know it is unsupported. | |
| disableWebSearch | No | Pass --disable-web-search. | |
| allowCodexPrivatePaths | No | Allow prompts that mention Codex private runtime paths such as ~/.codex. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, and the description does not disclose behavioral traits such as read-only nature, side effects, or authentication needs. The actions described (run, detect) imply reading but are not explicitly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but lacks structure. It fails to prioritize key information or provide a clear summary upfront.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 12 parameters, no output schema, and 12 sibling tools, the description is insufficient. It does not explain how parameters affect behavior, what the output is, or how this tool fits into the broader toolset.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 83% schema description coverage, the schema already describes most parameters. The tool description adds no additional parameter context, so a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description lists specific actions (Discover CLI, run version, detect model availability), but it is vague about the overall purpose and does not distinguish this tool from siblings like grok_models, which also deals with model detection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as grok_models or grok_run. The description lacks context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_continueContinue Grok SessionB
Continue a Grok session with --resume or, only when explicitly requested, --continue.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| model | No | Grok model ID to pass with -m/--model. | |
| prompt | Yes | Prompt to send while continuing the Grok session. | |
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| maxTurns | No | Pass --max-turns. | |
| sessionId | No | ||
| timeoutMs | No | ||
| background | No | Run as a background job using --output-format streaming-json. | |
| noSubagents | No | Pass --no-subagents. | |
| alwaysApprove | No | Pass --always-approve only when explicitly true. | |
| continueLatest | No | ||
| reasoningEffort | No | Pass --reasoning-effort only for non-default models where the plugin does not know it is unsupported. | |
| disableWebSearch | No | Pass --disable-web-search. | |
| allowCodexPrivatePaths | No | Allow prompts that mention Codex private runtime paths such as ~/.codex. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It only mentions command-line flags without explaining side effects, return values, permissions, or whether the operation is destructive. This is insufficient for a tool with 14 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise but lacks structure. Given the tool's complexity (14 parameters), it could include more organized information such as usage patterns or prerequisites without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 14 parameters, no output schema, and no annotations. The description does not cover return behavior, error conditions, or whether the session runs synchronously. This incompleteness leaves the agent with insufficient context to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is high (79%), so the baseline is 3. The description adds modest value by clarifying that '--continue' should be used only when explicitly requested, likely referring to the 'continueLatest' parameter. However, many parameters remain unaddressed, and the description does not compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's purpose: continuing a Grok session, using '--resume <sessionId>' or '--continue'. It distinguishes from likely sibling 'grok_run' (which starts a new session) through the verb 'continue', though it does not explicitly name the alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description specifies using '--resume <sessionId>' or '--continue' only when explicitly requested, giving some usage guidance. However, it lacks explicit when-not-to-use advice or references to alternative tools like 'grok_run' for new sessions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_exportExport Grok SessionB
Wrap grok export and return Markdown from stdout by default.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| sessionId | Yes | ||
| timeoutMs | No | ||
| outputFile | No | Optional filesystem output path. Omit to return Markdown. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals that the tool wraps a shell command and returns stdout as Markdown, and mentions an optional output file. However, it does not disclose side effects, required permissions, or what happens in error cases. Given no annotations, this is moderately transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently conveys the core function. No unnecessary words, though it could be slightly more structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 5 parameters and no output schema, the description provides minimal completeness. It explains the default return behavior but omits details like error handling or default values for optional parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers 60% of parameters with descriptions. The tool description does not add any new semantic information beyond what is in the schema, so the baseline score applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool exports a Grok session and returns Markdown. The verb 'export' and resource 'Grok session' are specific, but it does not distinguish from siblings like 'grok_run' or 'grok_result'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. The description does not provide context for when exporting is appropriate or mention any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_modelsList Grok ModelsD
Return raw and parsed grok models output.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| model | No | Grok model ID to pass with -m/--model. | |
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| maxTurns | No | Pass --max-turns. | |
| timeoutMs | No | ||
| background | No | Run as a background job using --output-format streaming-json. | |
| noSubagents | No | Pass --no-subagents. | |
| alwaysApprove | No | Pass --always-approve only when explicitly true. | |
| reasoningEffort | No | Pass --reasoning-effort only for non-default models where the plugin does not know it is unsupported. | |
| disableWebSearch | No | Pass --disable-web-search. | |
| allowCodexPrivatePaths | No | Allow prompts that mention Codex private runtime paths such as ~/.codex. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only says 'Return', which weakly implies a read operation, but fails to explain side effects, authorization needs, rate limits, or other important behaviors for a tool with many parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short but under-specifies the tool. It lacks necessary detail, making it more inadequate than concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is insufficient for a tool with 11 parameters and no output schema. It does not explain return values, parameter interactions, or how the raw/parsed outputs differ.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 91%, so the schema already describes parameters well. The description adds no additional meaning beyond the schema, meeting the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Return raw and parsed grok models output' is vague. While the title suggests listing models, the description does not clearly state that it lists available models, nor does it distinguish from sibling tools like grok_run or grok_check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives. There is no mention of context, prerequisites, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_rescueGrok RescueA
Ask Grok for an independent read-only diagnosis and minimal path forward.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| model | No | Grok model ID to pass with -m/--model. | |
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| problem | Yes | Problem statement and visible context to diagnose. | |
| maxTurns | No | Pass --max-turns. | |
| timeoutMs | No | ||
| background | No | Run as a background job using --output-format streaming-json. | |
| noSubagents | No | Pass --no-subagents. | |
| alwaysApprove | No | Pass --always-approve only when explicitly true. | |
| reasoningEffort | No | Pass --reasoning-effort only for non-default models where the plugin does not know it is unsupported. | |
| disableWebSearch | No | Pass --disable-web-search. | |
| allowCodexPrivatePaths | No | Allow prompts that mention Codex private runtime paths such as ~/.codex. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears full transparency burden. It clearly communicates that the tool is read-only and provides a 'minimal path forward,' indicating no destructive actions. It does not elaborate on behaviors like background execution or timeouts (covered in parameters), but the core behavioral trait is well-disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that immediately conveys the core purpose. It is front-loaded and contains no redundant or extraneous words. Every part of the sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 12 parameters, 1 required, and no output schema, the description is minimal. It does not explain what the output looks like (e.g., text diagnosis) or how 'minimal path forward' is structured. For a crisis-oriented tool ('rescue'), more context on expected output or success criteria would be beneficial. Adequate but with gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 92%, so the schema already documents 11 of 12 parameters well. The description adds no parameter-specific information beyond the schema. Baseline 3 is appropriate since the description does not compensate for the 8% undocumented parameter (timeoutMs lacks a description in schema) nor adds extra meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Ask Grok for an independent read-only diagnosis and minimal path forward.' It uses a specific verb ('Ask'), a specific resource ('Grok'), and qualifies the interaction as read-only and minimal. This distinguishes it from sibling tools like grok_run (full execution) or grok_review (comprehensive review).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for quick, safe diagnosis without modifications ('read-only'). However, it does not explicitly state when to use this tool over alternatives or provide exclusion criteria. Given the context of siblings, the guidance is clear enough but lacks explicit when-not-to-use instructions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_resultGrok Job ResultC
Read stdout/stderr tails and parsed outputSummary for a background Grok job.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| jobId | Yes | ||
| maxChars | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description indicates a read operation but lacks details on side effects, permissions, error states (e.g., job not found), or limits. Without annotations, the description carries the full burden and fails to disclose important behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no redundancy. However, it is overly brief and omits critical information, making it less effective despite being short.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 3 parameters, no output schema, and no annotations, the description is insufficient. It does not explain the output format, what 'parsed outputSummary' entails, or how maxChars affects results, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not explain any of the three parameters (cwd, jobId, maxChars). It provides no semantic meaning beyond what the schema's property names imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Read' and resources 'stdout/stderr tails' and 'parsed outputSummary' for a background Grok job. It effectively distinguishes from sibling tools like grok_run or grok_status by specifying it retrieves results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as grok_status or grok_check. The description does not mention prerequisites like job completion or that this should be used after grok_run.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_reviewGrok ReviewC
Ask Grok for a bounded findings-first review of a target such as the current diff.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| model | No | Grok model ID to pass with -m/--model. | |
| target | No | Review target. Defaults to current working tree. | |
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| maxTurns | No | Pass --max-turns. | |
| timeoutMs | No | ||
| background | No | Run as a background job using --output-format streaming-json. | |
| noSubagents | No | Pass --no-subagents. | |
| alwaysApprove | No | Pass --always-approve only when explicitly true. | |
| reasoningEffort | No | Pass --reasoning-effort only for non-default models where the plugin does not know it is unsupported. | |
| disableWebSearch | No | Pass --disable-web-search. | |
| allowCodexPrivatePaths | No | Allow prompts that mention Codex private runtime paths such as ~/.codex. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must disclose behavioral traits. It only mentions 'bounded findings-first review' without explaining side effects, authorization needs, output format, or whether the tool runs synchronously or in background.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundant words. It is concise, but could benefit from additional context without losing efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 12 parameters, no output schema, and no behavioral transparency. The description fails to explain return values, execution behavior, or how to use the results, which is insufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is high (92%), so by baseline, the description need not detail parameters. However, the description adds no context about parameter significance or defaults, leaving the agent to rely solely on the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Ask Grok for a bounded findings-first review' and provides an example target ('the current diff'). It distinguishes the tool as a review tool among siblings, but the term 'bounded findings-first' may not be universally clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use grok_review versus sibling tools like grok_check, grok_run, or grok_adversarial_review. The description does not specify prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_runRun GrokA
Run a Grok prompt in foreground JSON mode or background streaming-json mode.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| model | No | Grok model ID to pass with -m/--model. | |
| prompt | Yes | Prompt to send to Grok. Put task text here; do not ask Grok to read Codex private runtime paths such as ~/.codex unless explicitly authorized. | |
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| maxTurns | No | Pass --max-turns. | |
| timeoutMs | No | ||
| background | No | Run as a background job using --output-format streaming-json. | |
| noSubagents | No | Pass --no-subagents. | |
| alwaysApprove | No | Pass --always-approve only when explicitly true. | |
| reasoningEffort | No | Pass --reasoning-effort only for non-default models where the plugin does not know it is unsupported. | |
| disableWebSearch | No | Pass --disable-web-search. | |
| allowCodexPrivatePaths | No | Allow prompts that mention Codex private runtime paths such as ~/.codex. Default false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the burden. It mentions foreground and background modes but does not disclose side effects, authentication needs, rate limits, or what happens during execution. Minimal behavioral context beyond schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, zero wasted words, front-loaded with action and resource. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 12 parameters (though well-documented in schema), no output schema, and no mention of how to retrieve results or handle background jobs, the description is incomplete. It lacks guidance on output format, result retrieval via sibling tools, and error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 92%, so the schema already documents most parameters. The description adds no new meaning beyond what schema provides; the background mode is implied but not elaborated. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (run) and resource (Grok prompt), and distinguishes between foreground JSON mode and background streaming-json mode, which differentiates it from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies two modes but provides no explicit guidance on when to use each mode or when to prefer this tool over siblings like grok_continue or grok_check. No when-not-to-use or alternatives mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_sessionsGrok SessionsC
Wrap grok sessions list/search and return raw output.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory for Grok. Defaults to the MCP server cwd. | |
| limit | No | ||
| query | No | ||
| grokBin | No | Explicit Grok binary path. Defaults to GROK_BIN, ~/.grok/bin/grok, ~/.local/bin/grok, Homebrew paths, then PATH. | |
| timeoutMs | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only mentions returning raw output, but does not disclose side effects, authentication requirements, or rate limits. Lack of behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise, but lacks structure. It could be improved with sections or bullet points. Adequate but not exceptional.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters, no output schema, and no annotations, the description is too brief. It does not explain what a session is, what raw output contains, or how parameters affect behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 40% (2 of 5 parameters have descriptions). The tool description does not add any parameter meaning beyond what the schema provides, failing to compensate for low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states it wraps grok sessions list/search and returns raw output, but it's ambiguous whether it lists, searches, or both. It does not distinguish from sibling tools like grok_status or grok_check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description does not mention prerequisites or use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grok_statusGrok Job StatusC
Read a background Grok job record.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| jobId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It says 'Read', implying idempotent and non-destructive behavior, but does not disclose any side effects, authentication requirements, or rate limits. It lacks details about what happens if the job does not exist or how recent the data is.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise. However, it is too brief and lacks structure. It could be expanded to include key details without becoming verbose. The sentence earns its place but misses opportunities to add value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the absence of an output schema and annotations, the description should explain what the tool returns (e.g., job status, progress). It does not, leaving the agent to guess the response format. For a simple read tool, completeness is lacking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any parameters. There are two parameters (cwd and jobId) with no meaning added beyond the schema's type and required flag. The description should clarify, for example, the format of jobId or the role of cwd.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Read a background Grok job record', which uses a specific verb and resource. However, 'background Grok job record' is somewhat generic; a job status is implied. It distinguishes from sibling tools like grok_run or grok_cancel, but could be more explicit about what a 'job record' entails.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. Given sibling tools like grok_check or grok_result, there is no context about the typical workflow or conditions under which grok_status should be called first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
12 tool updates
v0.1.0- First observed
grok_adversarial_review - First observed
grok_cancel - First observed
grok_check - First observed
grok_continue - First observed
grok_export - First observed
grok_models - First observed
grok_rescue - First observed
grok_result - First observed
grok_review - First observed
grok_run - First observed
grok_sessions - First observed
grok_status
TDQS
Each tool has a clearly distinct purpose, from running prompts to managing jobs and sessions. Overlaps like review/adversarial_review are differentiated by descriptions.
All tools follow the consistent 'grok_verb' or 'grok_noun' snake_case pattern, making it easy to predict tool names.
12 tools is well-scoped for a CLI wrapper, covering setup, execution, session management, and review without being excessive.
The tool surface covers the full lifecycle: check, run, manage sessions, review, and retrieve results. No obvious missing operations for the domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Remote MCP server exposing SMI Aware tools, resources, and skills over Streamable HTTP.
An MCP server that gives your AI access to the source code and docs of all public github repos
Related MCP Servers
- AlicenseAqualityCmaintenanceMCP server that wraps the Grok CLI to enable code review, adversarial testing, and chat with xAI's Grok model, integrating into any MCP host as a peer reviewer, adversary, and consultant.49111MIT
- AlicenseNot gradedqualityBmaintenanceAn MCP server that wraps the local Grok Build CLI, enabling Codex to delegate code reviews, bounded coding tasks, and setup diagnostics to Grok for a second opinion or parallel processing.4Apache 2.0
- AlicenseNot gradedqualityAmaintenanceLocal-first MCP server that provides project context, verification gates, and structured tools for coding agents to discover knowledge, run diagnostics, and execute allowlisted commands within a repository.35MIT
- FlicenseAqualityBmaintenanceMCP server that exposes grok-ask and grok-workflow tools, enabling Claude Code to delegate to Grok for consult/worker tasks and run adversarial multi-agent workflow panels.3-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/handong66/grok-plugin-codex'
If you have feedback or need assistance with the MCP directory API, please join our Discord server