Codex App Server MCP
An MCP server that makes Codex CLI a concurrent, steerable subagent pool inside an MCP host.
Start background Codex workers with agent_start, including model, cwd, sandbox/permissions, effort, output schema, and watchdog settings.
Dispatch native code review as a worker with agent_review, or hand off the host conversation with agent_handoff.
Resume persisted Codex threads with agent_resume and branch new workers with agent_fork.
Steer active turns with agent_steer, send follow-ups with agent_send, interrupt workers with agent_interrupt, and set persistent thread goals with agent_goal_set.
Collect lean results fleet-wide in one call with agent_result, inspect one worker deeply with agent_status, page through reduced events with agent_events, and block on any/all workers with agent_wait.
Answer pending approvals, permissions, user-input, dynamic-tool, or MCP elicitation requests via agent_request_resolve.
List all managed and discovered workers with agent_list, archive idle threads with agent_archive, and optionally expose raw_rpc for new app-server methods.
Includes optional worker watchdogs, Claude Code plugin integration, and a Pi extension for a codex_ subagent tool.
Provides tools for managing and coordinating multiple OpenAI Codex agents as a subagent pool, including starting, steering, inspecting, interrupting, resuming, and collecting results from Codex workers.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Codex App Server MCPStart two Codex agents to investigate this bug and propose fixes in parallel."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Codex App Server MCP
An MCP server that makes Codex a usable subagent pool inside an MCP host: a supervisor agent can create, coordinate, steer, inspect, and interrupt multiple Codex agents through the stateful Codex app-server protocol, and run them alongside the host's own subagents.
It works directly with MCP hosts such as Claude Code. A bundled Pi extension bridges the same MCP tools into Pi, whose core currently does not load MCP servers directly.
What it provides
Concurrent independent Codex threads through one long-lived app-server process
Non-blocking dispatch and fleet-wide collection, so supervising many workers costs one call
New, resumed, and forked workers
Protocol-level steering of active turns
Follow-up turns on completed workers
Bounded event history and reduced status instead of raw transcript flooding
Correlated command, file, permission, user-input, dynamic-tool, and MCP elicitation requests
Interruption, persistent goals, and archiving
Discovery of Codex-created descendant threads when the app-server event stream identifies them
An explicitly opt-in raw RPC escape hatch for new app-server methods
The implementation uses codex app-server, not codex exec.
Related MCP server: AnyRouter Spawn Agent
Requirements
Node.js 24 or newer
A current Codex CLI available as
codexA working Codex login or configured model provider
Check the local setup:
node --version
codex --version
codex login statusInstall and build
git clone https://github.com/j-pollack/codex-app-server-mcp.git
cd codex-app-server-mcp
npm install
npm run buildThe MCP entry point is:
./dist/index.jsClaude Code setup
Add it as a user-scoped stdio MCP server:
claude mcp add --scope user codex-agents -- \
node "$(pwd)/dist/index.js"Run this command from the repository root. $(pwd) is expanded when the server is registered, so Claude Code stores an absolute path to your checkout.
For only the current project, use --scope local instead. Confirm it is present:
claude mcp listRestart Claude Code after adding the server. Its tools will be namespaced by the MCP server name in Claude's internal tool catalog.
Pi setup
Pi currently uses an extension for MCP integration. This package includes one and declares it in the package's pi.extensions manifest.
After building, install the local package:
pi install .Or try the adapter without installing it:
pi -e ./pi-extension/index.mjsRun either command from the repository root.
The adapter starts this MCP server, discovers its tools, and registers them in Pi with a codex_ prefix, such as codex_agent_start and codex_agent_wait. Run /codex-mcp in Pi to inspect the connection.
Subagents in Pi
Pi has no agent registry to add to, so a first-class subagent there is not a registered agent type but a tool that streams while it runs and draws itself. The extension registers one:
codex { task, cwd, mode: "task" | "handoff" | "review", label?, model?, sandbox? }
codex { cwd, tasks: [ { task, label }, ... ] }It dispatches the workers, tails them through the same agent_wait loop a relay agent would run,
and pushes every tick into the tool call's own display: a status icon per worker, its recent event
summaries, and its token spend, with the whole transcript and each final answer under the expanded
view (Ctrl+O). Several tasks run concurrently and stream side by side.
Aborting the call (Ctrl+C) interrupts the workers rather than leaving them running. Pi hands the
tool a real AbortSignal, so this is a direct agent_interrupt — none of the hook plumbing the
Claude Code plugin needs, and the server's watchdog stays as the backstop for the case where even
that fails.
codex blocks for the workers it starts, which is the Pi idiom and the opposite of the non-blocking
default elsewhere in this README. The raw codex_agent_start / codex_agent_wait tools are still
registered for the fleet style, where the point is to dispatch and keep working.
Codex as a second subagent pool
The design goal is that a supervisor can treat Codex workers the way it already treats its host's native subagents, and run both pools at the same time. Three properties make that work:
Dispatch is non-blocking.
agent_startreturns as soon as the turn is accepted. A worker needs no attention to keep running, so severalagent_startcalls can be issued in one message alongside whatever host-native subagents the supervisor also wants.Collection is fleet-wide.
agent_resultwith no arguments returns a lean report for every worker in a single call, so supervising ten workers costs the same as supervising one.Blocking, when it is needed at all, is also fleet-wide.
agent_waittakesagentIdswithmode: "any"ormode: "all", so a supervisor never serialises one wait per worker.
The loop
Dispatch. One message, several
agent_startcalls, plus any host-native subagents. Each prompt must be self-contained: the worker cannot see the supervisor's conversation.Work. Do supervisor work while the fleet runs. Nothing needs to be watched.
Collect.
agent_resultreturns{status, done, message, error, tokens}per worker, and surfaces any worker blocked on an approval.Only if idle, wait.
agent_wait({agentIds, mode: "any"})wakes on the first worker to finish so its result can be used while the rest continue.Zoom in when needed.
agent_statusfor one worker's plan and diff,agent_eventsfor its event history,agent_sendto steer or follow up,agent_interruptto stop redundant work.
Choosing what to send where
Codex workers are worth using where a different model is the point: an independent implementation pass to compare against, a second-opinion diagnosis, adversarial review of the supervisor's own work. Split the task so both pools run concurrently rather than in sequence.
An example request to the supervisor host:
Use Codex workers to investigate this failure. Start separate agents for the
runtime path, the test coverage, and a skeptical review. Let them run in
parallel, steer them if their scopes overlap, and synthesize their verified
findings. Do not approve destructive or externally visible actions.Codex workers as first-class subagents
An MCP server cannot register an agent type, so a Codex worker dispatched with agent_start renders
as a tool call in whichever transcript called it. The bundled Claude Code plugin in
plugin/ closes that gap the only way a host allows: a real host-native
subagent, codex-worker, that does nothing but drive one Codex worker and print its events. The
user gets a subagent row, an openable transcript, a /tasks entry, and an address they can message
— messages are forwarded to the worker with agent_send.
The cost is honest: the relay is a live model context that wakes on each tick to echo reduced events, so the transcript is a relay at up to 55-second granularity, not Codex's own stream. Pin it to a small model and forbid it from doing any thinking of its own.
The plugin also carries the hooks that stop a worker when the subagent driving it is interrupted. See Abandoned workers.
The repository root is a plugin marketplace, so installing it from a checkout is two commands:
claude plugin marketplace add "$(pwd)"
claude plugin install codex-agents@codex-app-server-mcpRestart Claude Code afterwards. The MCP server must be registered as codex-agents: the subagent's
tool list and the hook matchers both name mcp__codex-agents__*.
Abandoned workers
A worker keeps running whether or not anyone watches it, which is the point — and also a hazard
when the supervisor is interrupted mid-turn. Pass watchdogSeconds to agent_start to tie a
worker's life to its supervisor's attention: any agent_result, agent_wait, agent_status,
agent_events, or agent_send resets the window, and a worker nothing has read for a full window
is interrupted. One fleet-wide agent_result keeps a whole fleet alive.
Omit it and nothing changes: a worker with no watchdog is never interrupted for going unread, which is right for work meant to outlive the call that dispatched it.
Two faster signals feed the same mechanism. A host that interrupts a turn cancels the in-flight MCP
call, and agent_wait treats that cancellation as evidence its caller is gone. Host hooks, which
cannot call MCP tools, reach an interrupt-only unix socket at
~/.codex-app-server-mcp/servers/<pid>.sock. Neither is load-bearing on its own — hooks can be
absent and a killed host runs none — which is why the watchdog exists behind them.
Interrupting a turn leaves its thread log intact, so the work stays recoverable with agent_resume.
MCP tools
Tool | Purpose |
| App-server health, worker counts, and unscoped pending requests |
| Start a background worker and return without waiting for completion |
| Dispatch Codex's built-in reviewer against a diff, as a worker |
| Dispatch a worker that inherits the host's conversation |
| Load and subscribe to a persisted Codex thread |
| Branch a worker or raw thread into a new worker |
| Automatically steer an active worker or start its follow-up turn |
| Explicitly append guidance to an in-flight turn |
| Interrupt an active turn |
| Collect lean per-worker results for a fleet, or for every worker, in one call |
| Read one worker's detailed reduced state, plan, diff, and pending requests |
| List all managed and discovered workers |
| Page through bounded reduced events using a cursor |
| Block for up to 55 seconds awaiting one or all of a set of workers |
| Answer a correlated app-server request |
| Set or update a persistent thread goal |
| Archive an idle worker thread |
| Send arbitrary app-server RPC when explicitly enabled |
Native review
agent_review starts a worker whose first turn is Codex's own reviewer rather than a prompt. Codex
supplies the review instructions, which is worth more than asking a model to "review this diff", and
the result is an ordinary worker: same reduced state, same agent_result, same watchdog.
{ "scope": "base-branch", "baseBranch": "main", "cwd": "/abs/path/to/repo" }scope is uncommitted (the working tree, the default) or base-branch. The thread is read-only
unless threadOptions says otherwise, and delivery: "detached" runs the review on its own thread,
registered as a child worker. Reach for agent_start with a prompt instead whenever you want a
specific lens — adversarial review, one dimension, a design critique — since the native reviewer
takes no focus text.
Handing over a conversation
agent_start and agent_review both dispatch a worker that cannot see the supervisor's
conversation, which is why their prompts have to be self-contained. agent_handoff removes that
constraint: it imports a host agent's transcript into a Codex thread and starts the worker there, so
the worker reads the conversation first and the prompt is only what to do next.
{ "prompt": "Finish the migration we just designed.", "cwd": "/abs/path/to/repo" }With no sessionId or transcriptPath, the most recently written session for cwd is taken, which
on a live host is the running one. Detection is home-scoped and covers every project, so cwd is
what selects the conversation, not a search root.
The import is a real write: it creates a durable Codex thread, resumable from any Codex client, and
it stays after the worker finishes. Prefer agent_start when the task genuinely is self-contained —
a handoff costs an import and gives the worker the whole history, including the parts of it that
have since turned out to be wrong.
Advanced app-server options
agent_start exposes common settings directly: cwd, model, effort, serviceTier, personality, sandbox, permissions, approvalPolicy, approvalsReviewer, instruction overrides, workspace roots, thread config, an output schema, and watchdogSeconds.
agent_wait can also carry each worker's new events with includeEvents, paged from the cursor the wait itself used, so a supervisor tailing a worker spends one call per tick instead of a wait followed by agent_events.
Use threadOptions, turnOptions, resumeOptions, or forkOptions for fields introduced by newer app-server versions. The server always owns identity fields such as threadId, expected active turn IDs, and user input; callers cannot replace those invariants through an options object.
The installed Codex CLI can generate its exact protocol definitions:
npm run protocol:generateGenerated files go to the ignored .generated/app-server directory.
Approvals and server requests
App-server can stop a worker and request a client response. The MCP server records the request, marks the worker waiting, and returns a public requestId through agent_status or agent_wait.
For command and file approvals, decision is shorthand:
{
"requestId": "request-1-abcd1234",
"decision": "accept"
}For permission requests, user input, dynamic tools, and MCP elicitation, pass the response object required by the installed app-server schema:
{
"requestId": "request-2-efgh5678",
"response": {
"permissions": {},
"scope": "turn"
}
}The broker does not auto-approve. A supervisor can apply policy, but destructive actions, credentials, publication, deployments, and external communication should remain human decisions.
Concurrency and filesystem isolation
Concurrent threads are independent conversations, not isolated filesystems. Multiple write-capable workers pointed at the same checkout can overwrite or invalidate one another's work.
Prefer one of these arrangements:
one Git worktree per write-capable worker;
explicit non-overlapping file ownership;
several read-only investigators and one serialized writer.
Pass each worktree as cwd and, where appropriate, in runtimeWorkspaceRoots.
Environment variables
Variable | Default | Meaning |
|
| Codex executable path |
|
| JSON array of app-server process arguments |
| MCP process cwd | App-server process working directory |
|
| RPC request timeout for cancellable calls |
|
| RPC request timeout for |
|
| Initialize with experimental app-server APIs enabled |
|
| Per-worker reduced event retention |
|
| Maximum retained live/final text, diff, or event payload |
|
| Maximum supervisor-managed workers in one MCP process |
|
| Maximum simultaneously starting, running, or waiting workers |
|
| Expose the unrestricted |
|
| Default abandonment window for every worker; |
|
| Listen on the interrupt-only control socket |
|
| Directory holding control sockets and their registry files |
| current Node executable | Pi adapter override for starting this MCP server |
| built server entry | Pi adapter command arguments |
Example enabling the raw escape hatch in Claude Code:
claude mcp add --scope user -e CODEX_MCP_ENABLE_RAW_RPC=true codex-agents -- \
node "$(pwd)/dist/index.js"raw_rpc bypasses worker-registry invariants and can invoke destructive app-server methods. Leave it disabled unless you specifically need a protocol method that does not yet have a typed orchestration tool.
Persistence model
The MCP worker registry is in memory. Codex thread logs remain managed by app-server, so non-ephemeral threads survive an MCP process restart. Keep the returned threadId and use agent_resume to recover one.
Opaque agentId values are scoped to one MCP process and are not durable identifiers.
Development and verification
npm run check
npm run build
npm run smoke:real
npm run probe:protocolnpm run check is exactly what CI runs on Node 24, in the same order: formatting, lint, type checking over src, test, and scripts, then the fake app-server integration suite, an in-memory MCP client suite, and the spawned Pi adapter test. It needs no Codex binary, account, or network. npm install also points core.hooksPath at .githooks/. On commit, lint-staged formats and auto-fixes the staged files, then lint and types are verified across the project; on push, the suite runs. See CONTRIBUTING.md.
The other two scripts do talk to a locally installed Codex and spend real model usage, which is why CI excludes them. npm run smoke:real starts three simultaneous workers, waits on the fleet in one call, collects it in one more, and archives the threads at the end; it uses durable threads deliberately, because that is the shape whose abandoned turn can be cancelled by id. npm run probe:protocol re-checks the three live protocol facts the timeout-cancellation path relies on: that turn/start answers before it emits turn/started, that thread/turns/list still names the turn a timed-out call abandoned, and that turn/interrupt with an empty turnId stops a running turn without naming it.
The implementation was verified against Codex CLI 0.151.0 and @modelcontextprotocol/sdk 1.30.0, with three concurrent real worker turns.
Architecture
See Architecture. The app-server protocol itself is documented in the official OpenAI Codex App Server documentation.
License
MIT
Available Tools
15 toolsagent_archiveArchive Codex AgentADestructiveIdempotent
Archive an idle worker thread. Active turns must be interrupted first.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose mutation, destructiveness, and idempotence. The description adds the precondition about active turns being interrupted first, which is useful. However, it does not explain what 'archive' does to the thread's state, such as recoverability, removal, or disposition, leaving a behavioral gap for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Every clause earns its place: the action, target, and usage precondition all appear in the first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter, optionally destructive tool, the description covers the main precondition but leaves the post-condition undefined—what happens after archiving and whether it is reversible. No output schema exists, so a sentence about expected outcome or state would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not mention agentId at all, so it adds no meaning beyond the bare schema property. The parameter is simple and self-descriptive, but with no schema description the description should have at least clarified that agentId identifies the idle worker thread to archive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Archive') on a specific resource ('idle worker thread') and adds a scope restriction ('idle'), which separates it from sibling tools like agent_interrupt. It is concise and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It says the tool applies to idle workers and explicitly warns that active turns must be interrupted first, effectively directing an agent to agent_interrupt when a thread is active. It does not name the alternative tool explicitly, but the guidance is actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_eventsRead Codex Agent EventsARead-only
Read a bounded page of reduced worker events after a cursor. Returns immediately. Data is omitted by default to avoid flooding the supervisor context. Use this for detail after agent_status shows something worth inspecting.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| agentId | Yes | ||
| afterCursor | No | ||
| includeData | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint=true, and the description adds useful non-obvious behaviors: 'Returns immediately' warns the agent this is not a long-poll, and 'Data is omitted by default to avoid flooding the supervisor context' explains the default includeData behavior and its rationale. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each adding distinct value: operation, latency behavior, default payload behavior, and usage guidance. The most important identifying information is front-loaded in the first sentence, and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only pagination tool, this covers operation, default data omission, immediate return, and when to use it. Since there is no output schema, the description could have described the event shape a bit more, but 'reduced worker events' plus the agent_status tie-in gives the agent enough context to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate. It does map to key parameters: 'bounded page' implies limit, 'after a cursor' implies afterCursor, and 'Data is omitted by default' clarifies includeData. However, the required agentId parameter is never mentioned, and cursor semantics are left vague, so compensation is incomplete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Read a bounded page of reduced worker events after a cursor.' It also differentiates from the sibling agent_status by framing itself as the detail-follow-up step, so an agent can tell this tool apart from related status/result tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly names the triggering context: 'Use this for detail after agent_status shows something worth inspecting.' This gives clear when-to-use guidance and points to the relevant sibling. It does not spell out when not to use it or list other alternatives, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_forkFork Codex AgentA
Branch a managed agent or persisted Codex thread into a new independent worker. An optional prompt starts work immediately on the fork.
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | ||
| prompt | No | ||
| forkOptions | No | Additional thread/fork fields passed through to app-server. | |
| turnOptions | No | Additional turn/start fields used when prompt is present. | |
| sourceAgentId | No | ||
| sourceThreadId | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already convey the mutation profile (readOnly=false, idempotent=false), and the description adds meaningful context: the fork is 'independent' and an optional prompt triggers immediate work. This helps the agent anticipate that forking can spawn active work, though details like whether the fork returns immediately or waits are not disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences, with the core operation front-loaded and the optional prompt behavior stated second. Every word contributes; there is no filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with six parameters, no required fields, and no output schema, the description is too sparse to guide correct invocation. It omits how the source agent/thread is selected, what label means, and what the caller should expect as a result of the fork.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%, and the description does not meaningfully clarify the six parameters. 'Optional prompt starts work immediately' touches on the prompt parameter, but the crucial sourceAgentId vs sourceThreadId distinction, label purpose, and forkOptions/turnOptions semantics are left unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Branch') and names the exact resource ('a managed agent or persisted Codex thread') plus the outcome ('a new independent worker'). This clearly distinguishes agent_fork from lifecycle siblings like agent_start or agent_resume.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes clear context: use this when you already have a managed agent or persisted Codex thread to branch, and include an optional prompt to start work immediately. It does not explicitly name alternatives or state when not to use the tool, but the source precondition is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_goal_setSet Codex Agent GoalCIdempotent
Set or update the persistent app-server goal attached to a worker thread.
| Name | Required | Description | Default |
|---|---|---|---|
| status | No | ||
| agentId | Yes | ||
| objective | No | ||
| tokenBudget | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotence, and destructive behavior. The description adds that the goal is persistent and attached to a worker thread, but it does not clarify important behaviors such as whether null values clear fields or how an update interacts with an existing goal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence with no filler. It is concise and front-loaded, though it sacrifices useful detail for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With four parameters, no schema descriptions, no output schema, and a family of closely related sibling tools, the one-sentence description is too thin. Missing parameter semantics and usage context make it incomplete for reliable tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no meaning for status, agentId, objective, or tokenBudget. An agent must rely solely on parameter names, which is insufficient for correctly invoking this tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Set or update') and identifies the resource ('persistent app-server goal attached to a worker thread'). It is clear enough to distinguish this from a message-send or status-check tool, though it does not explicitly name sibling alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'persistent app-server goal' implies when this tool is relevant, but there is no explicit guidance on when to use it versus related tools like agent_steer or agent_send. No exclusions or alternative conditions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_interruptInterrupt Codex AgentADestructiveIdempotent
Interrupt a worker's active turn. Calling this on an idle worker is a no-op.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, it discloses idle no-op behavior, which is useful and consistent with idempotentHint. However, it does not describe concrete effects of an interruption (e.g., whether work is lost or whether agent_resume is needed). With annotations already marking it destructive and not read-only, the bar is partially met.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One tightly written sentence states the action and key edge case with no filler. The most useful scoping information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with no output schema and annotations that already convey read-only/destructive/idempotent traits, the description covers the core usage and the idle edge case. It could mention how to reverse or recover from an interrupt, but this is not essential for invoking the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not mention agentId at all, so it must compensate for the missing parameter guidance. The parameter name is self-explanatory, but no additional semantics or format constraints are given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Interrupt') and resource ('a worker's active turn'), making the tool's action immediately recognizable and distinct from sibling tools like agent_start and agent_resume. It also clarifies the operational scope (active vs idle), so purpose ambiguity is minimal.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies usage when the worker is active and warns that idle calls are no-ops, but it never names alternatives or explicit when-to-use vs. when-not-to-use cases. The guidance is context rather than routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_listList Codex AgentsARead-only
List every worker known to this MCP process, including Codex-created descendant agents discovered from the event stream. Returns immediately with one compact line per worker and no full messages. Use this to see the shape of the fleet, including workers Codex spawned on its own; use agent_result when you want their output.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true; description adds behavioral specifics: returns immediately, one compact line per worker, no full messages. It doesn't mention error cases or pagination, but for a zero-param list tool this is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no wasted words; the core action is front-loaded, and subsequent sentences add genuinely useful behavioral and routing details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description covers the return shape (compact line per worker, no full messages) and the scope (all workers incl. Codex descendants). For a simple read-only list, nothing an agent needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema coverage, so there is nothing for the description to add beyond the empty input schema. With no parameters, a baseline of 4 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'List every worker known to this MCP process.' It explicitly distinguishes from agent_result and mentions Codex-created descendant agents, so an agent can tell it apart from siblings without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells when to use: 'Use this to see the shape of the fleet' and when not to: 'use agent_result when you want their output.' This is direct routing guidance to an alternative tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_request_resolveResolve Codex Agent RequestA
Answer a pending app-server approval, permission, user-input, dynamic-tool, or MCP elicitation request. For command/file approvals, decision is shorthand for {decision}. For other request types, pass the exact response object shown by the current app-server schema.
| Name | Required | Description | Default |
|---|---|---|---|
| decision | No | Shorthand for command and file approvals, typically approved, approved_for_session, denied, or abort. Use response instead for other request types. | |
| response | No | ||
| requestId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already communicate readOnlyHint=false, idempotentHint=false, and destructiveHint=false, so the mutation profile is known. The description adds that decision is a shorthand for approvals and response is used otherwise, but it does not disclose side effects, authorization needs, or consequences beyond resolving the pending request.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences lead with the tool's purpose, then provide routing detail without filler. The literal '{decision}' placeholder is an unresolved template artifact that slightly undermines precision, but the overall structure is compact and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three parameters and no output schema, the description covers the core invocation logic and the required requestId through the schema. It does not describe return values, error conditions, or how to discover the 'current app-server schema,' leaving some operational ambiguity for the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33%, and the description compensates by clarifying the core parameter split: decision applies to command/file approvals, while response is the exact object for other request types. It leaves '{decision}' as an unresolved placeholder, but the schema's decision description lists common values, making the combined picture usable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Answer a pending app-server approval, permission, user-input, dynamic-tool, or MCP elicitation request,' which names a specific verb and a clear resource class. This distinguishes the tool from sibling messaging/steering tools like agent_send and agent_steer by focusing on resolving pending app-server requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit routing guidance: 'For command/file approvals, decision is shorthand' and 'For other request types, pass the exact response object.' This tells the agent which parameter to use in which situation, though it does not explicitly name sibling tools or state exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_resultCollect Codex Agent ResultsARead-onlyIdempotent
Collect worker results. Returns immediately with a lean report per worker: status, whether it is done, its final message, any approval it is blocked on, and its token spend. Call with no arguments to sweep every worker at once — this is the normal way to check on a fleet, and it costs one call no matter how many workers are running. Use this rather than agent_status unless you need one worker's plan, diff, or event detail.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | No | Single-worker shorthand for agentIds. | |
| agentIds | No | Restrict to these workers. Omit for every non-archived worker. | |
| includeMessage | No | Default true. Set false for a cheap progress sweep that omits worker output. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint=false, and idempotentHint, so the description's job is lighter. It adds useful behavioral context beyond the annotations: the call returns immediately, costs one call regardless of fleet size, and produces a lean per-worker report. This is consistent with the annotations and adds operational traits an agent would want to know.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: the first states the action and output, the second covers default invocation and cost, and the third gives routing guidance. The key information is front-loaded and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although there is no output schema, the description enumerates exactly what the report contains (status, done, final message, approval blocker, token spend), so the agent understands the return shape. Combined with the schema and annotations, everything needed to call the tool correctly and interpret its result is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All three parameters are fully documented in the schema (100% coverage), so the baseline of 3 applies. The description adds a bit of extra semantic context by noting the no-arguments sweep and the 'costs one call' property, but it does not substantially extend the schema definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Collect worker results') and immediately enumerates the report contents, so an agent knows exactly what the tool returns. It also explicitly differentiates itself from the sibling agent_status by naming the condition that selects one over the other.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use guidance: calling with no arguments is described as the normal fleet sweep, and the description says to prefer this over agent_status unless plan/diff/event detail is needed. This is direct routing with no ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_resumeResume Codex AgentBIdempotent
Load and subscribe to a persisted Codex thread after an MCP-server restart or from another Codex client.
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | ||
| threadId | Yes | ||
| resumeOptions | No | Additional thread/resume fields passed through to app-server. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint=false, idempotentHint=true, destructiveHint=false, openWorldHint=true). The description adds useful context that the tool 'loads and subscribes' to a thread, clarifying the state change involved. It does not disclose further behavioral details like event subscription semantics or failure handling, but given the annotations, it provides moderate additional transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and resource. Every word contributes meaning, with no redundant or vague phrasing – an example of good conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters (one nested), no output schema, and only partial schema descriptions, the description is too brief. It does not explain what resumeOptions does, what happens after resuming (e.g., can the agent immediately send messages?), or any prerequisites or side effects. An agent would need to inspect the schema closely and infer behavior, making the description incomplete for confident use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% – only resumeOptions has a description. The description itself does not explain threadId or label at all, even though threadId is required. With low coverage, the description fails to compensate, leaving the agent without clear meaning for the key parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('load and subscribe') and resource ('persisted Codex thread'), and the context ('after an MCP-server restart or from another Codex client') conveys that it resumes an existing thread, distinguishing it implicitly from sibling tools like agent_start or agent_fork. However, it does not explicitly name any alternative tools, which keeps it from a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear usage context (after restart or from another client), which implies when to use this tool. It does not, however, explicitly state when not to use it or name alternative tools such as agent_start for starting new threads, so the guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_sendSend to Codex AgentA
Send guidance to a worker. In auto mode this steers its active turn, or starts a follow-up turn when it is idle. Use an explicit mode when the distinction matters. Returns once the message is delivered, not once the worker has acted on it; poll agent_status afterwards rather than blocking on agent_wait.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| prompt | Yes | ||
| agentId | Yes | ||
| turnOptions | No | Additional turn/start fields; invalid when steering. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses important non-obvious behavior beyond annotations: auto mode steers an active turn or starts a follow-up when idle, and delivery is async ('returns once delivered, not once acted'). This adds useful context beyond the readOnly/idempotent annotations, though it doesn't detail edge cases like errors or worker state transitions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three succinct sentences, front-loaded with the action. Every sentence adds distinct information: mode behavior, explicit mode guidance, and async delivery semantics. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters, a nested object, and no output schema, the description covers the most important behavioral aspects but omits full mode semantics and turnOptions usage. The agent is left to infer what 'steer' vs 'followup' explicitly mean and what additional turn/start fields are acceptable. It is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 25%, so the description must compensate. It does add meaning for mode by explaining auto mode behavior and the explicit-mode heuristic, but it doesn't explain prompt content expectations, turnOptions semantics beyond schema, or agentId resolution. The description helps but leaves significant parameter ambiguity to the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Send guidance to a worker.' It clearly describes the core action and distinguishes the delivery semantics from waiting, but does not explicitly differentiate itself from sibling tools like agent_steer or agent_topup beyond the mode discussion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides actionable guidance: use explicit mode when the distinction matters, and poll agent_status rather than using agent_wait. It clearly tells the agent what to do after calling the tool, but it could more explicitly name sibling alternatives and when agent_send is preferred over agent_steer or agent_followup.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_startStart Codex AgentA
Dispatch a Codex worker: creates an independent thread and starts its first turn. Returns as soon as the turn is accepted; the worker keeps running in the background whether or not you watch it. Treat this like spawning a background subagent — issue several in one message to run a fleet, alongside any host-native subagents you also want, then go do other work and collect with agent_result. Do not follow this call with agent_wait. The prompt should be a complete, self-contained task including the acceptance criteria, since the worker cannot see your conversation. Common fields are provided directly; threadOptions and turnOptions pass additional app-server fields through, with direct fields taking precedence.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Absolute working directory for this worker. Defaults to the directory this MCP server was started in, which is usually not the repository you are working on, so pass it explicitly. | |
| label | No | A short supervisor-facing worker label. | |
| model | No | Codex model id. Omit to use the configured default. | |
| config | No | Thread-scoped Codex config overrides. | |
| effort | No | Reasoning effort: typically low, medium, high, or ultra when the selected model supports it. | |
| prompt | Yes | The complete initial task for the worker. | |
| sandbox | No | Filesystem authority. Use read-only for investigation and review workers; workspace-write only when the worker is meant to edit files. | |
| ephemeral | No | Leave no thread log. Ephemeral workers cannot be resumed after this process restarts, and the app-server will not name their in-progress turn, so a timed-out turn is stopped bluntly rather than by id. Prefer the default for anything long-running. | |
| permissions | No | Named permission profile. Do not combine with sandbox. | |
| personality | No | ||
| serviceTier | No | Optional Codex service tier. | |
| turnOptions | No | Advanced turn/start fields passed through to app-server. | |
| outputSchema | No | JSON Schema constraining the first turn's final response. | |
| threadOptions | No | Advanced thread/start fields passed through to app-server. | |
| approvalPolicy | No | Who approves the worker's commands. on-request surfaces approvals to you via agent_result and agent_request_resolve; never runs unattended within the sandbox. | |
| baseInstructions | No | ||
| approvalsReviewer | No | ||
| developerInstructions | No | ||
| runtimeWorkspaceRoots | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description richly discloses async behavior beyond the annotations: 'Returns as soon as the turn is accepted; the worker keeps running in the background whether or not you watch it.' It also explains that the worker cannot see the conversation and that direct fields take precedence over threadOptions/turnOptions pass-through fields. No contradiction with annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence in the description earns its place: it front-loads the core dispatch behavior, then gives usage patterns, an explicit exclusion, a prompt-writing requirement, and pass-through semantics. It is dense but not bloated, and the structure follows a logical decision order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 19-parameter tool with no output schema, the description covers the key behavioral contract, usage pattern, prompt requirements, and pass-through precedence. It does not explicitly describe the return payload beyond 'returns as soon as the turn is accepted,' but it points to agent_result for collection, making the missing detail a minor gap rather than a critical one.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 74%, so the schema already documents most parameters. The description adds meaningful parameter context by explaining that the prompt must be a complete, self-contained task including acceptance criteria, and by clarifying that threadOptions and turnOptions pass through additional fields with direct fields taking precedence. It does not detail the few undocumented parameters, but the schema and general guidance are sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Dispatch a Codex worker: creates an independent thread and starts its first turn.' It clearly distinguishes this from sibling tools by emphasizing that this is a background start operation and explicitly routing collection to agent_result and warning against agent_wait.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: 'issue several in one message to run a fleet... then go do other work and collect with agent_result. Do not follow this call with agent_wait.' It also explains the prerequisite that the prompt must be self-contained because the worker cannot see the conversation, which is critical for correct invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_statusInspect Codex AgentARead-only
Detailed non-blocking snapshot of one worker: reduced current state, final or live message, plan, diff, usage, and pending approval/input requests. Use agent_result instead when you just want results or are checking more than one worker; reach for this when a single worker needs a closer look.
| Name | Required | Description | Default |
|---|---|---|---|
| agentId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, covering the safety profile. The description adds behavioral context beyond annotations: the snapshot is 'non-blocking' and captures either 'final or live message,' plus pending requests, which clarifies what state the worker could be in. It doesn't mention staleness or refresh behavior, but 'snapshot' implies a point-in-time view.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences: the first lists the snapshot contents, the second routes to the alternative tool. No filler, and the key scoping 'one worker' is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers what the tool does, how it behaves, and when to use it, with annotations covering read-only safety. Given one parameter, no output schema, and a modest complexity level, nothing critical is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 0%, the description must compensate for the undocumented agentId. It does imply that the parameter identifies 'one worker' but never explicitly connects agentId to that worker or explains where to obtain it. For a single self-explanatory parameter this is minimally adequate but not rich.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies a precise purpose: a detailed non-blocking snapshot of one worker, enumerating the exact contents (state, message, plan, diff, usage, pending requests). It clearly distinguishes itself from the sibling agent_result, leaving no ambiguity about what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit guidance: 'Use agent_result instead when you just want results or are checking more than one worker; reach for this when a single worker needs a closer look.' This names the alternative and states the conditions for selecting either tool, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_steerSteer Active Codex AgentB
Append guidance to the worker's current in-flight turn using turn/steer and its expected active turn id.
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | ||
| agentId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
It discloses an additive operation ('append') scoped to the worker's in-flight turn, which is useful beyond the annotations. However, it does not describe failure behavior when no active turn exists or whether guidance is applied synchronously.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one front-loaded, waste-free sentence that states the action and scope immediately. The turn/steer mechanism detail is extra but not padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although the tool is simple (two required string parameters), the description omits prerequisites such as requiring an existing active turn, error conditions, and expected return behavior, and there is no output schema to fill that gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the description never explicitly maps `prompt` to 'guidance' or `agentId` to the worker. The mention of 'its expected active turn id' is confusing because no turn id parameter exists in the schema, leaving parameter relationships under-specified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource: 'Append guidance to the worker's current in-flight turn.' This clearly differentiates from starting, resuming, or interrupting an agent, though it never names sibling tools explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'current in-flight turn' implies the tool is for an existing active turn and for adding guidance mid-turn, but the description does not state when to prefer this over agent_send or agent_interrupt, nor does it give exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agent_waitWait for Codex Agents (blocking)ARead-onlyIdempotent
Block until watched workers are ready. This blocks your whole turn, so use it only once you have run out of other work — while you still have anything to do, dispatch it and poll with agent_result instead. Workers do not need this call to stay alive or make progress. When you do wait, always pass every outstanding worker in agentIds rather than waiting on one at a time: waiting serially multiplies the stall by the number of workers. Returns when the mode condition is met or the timeout expires, with a lean report for each ready worker and each one still running.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | any (default) returns as soon as one watched worker is ready, so you can start using its result while the rest run. all returns when every watched worker is ready. | |
| until | No | terminal (default) waits for workers to finish, request also returns when one needs an approval answered, change returns on any new event. | |
| agentId | No | Single-worker shorthand for agentIds. | |
| agentIds | No | Watch a whole fleet in one call. Always prefer this over waiting on workers one at a time. | |
| afterCursor | No | ||
| timeoutSeconds | No | Seconds to block, default 10. A timeout is not a failure: the workers keep running and the result still reports where each one got to. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses significant behavioral traits beyond the annotations: it blocks the entire turn, workers do not need the call to stay alive, serial waiting multiplies the stall, timeout is not a failure, and the return value is a lean report for ready and still-running workers. The idempotentHint and readOnlyHint are consistent with the description, and this extra context is exactly what an agent needs before invoking a blocking call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence earns its place: the core blocking behavior is front-loaded, usage rules follow immediately, the agentIds guidance is explicit, and the return behavior closes the loop. There is no filler or repetition of the schema's plain parameter descriptions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a blocking tool with no output schema, the description covers the essential operational context: when to use it, what happens on timeout, how to batch workers, and what the report contains. The main gap is the undocumented afterCursor parameter, which could matter when paginating events/results over long waits, and which neither the schema nor the description explains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 83% schema coverage, the schema already documents most parameters, so the baseline is 3. The description adds value on top by explaining the semantic constraint around agentIds ('always pass every outstanding worker'), the distinction between agentId/agentIds, and the meaning of timeout behavior ('a timeout is not a failure'). However, afterCursor remains undocumented in both the schema and the description, preventing a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Block'), a specific resource ('watched workers'), and the defining behavior ('until ... ready'). It also directly distinguishes itself from sibling agent_result ('poll with agent_result instead'), so an agent can tell it apart without opening the sibling schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use ('only once you have run out of other work'), an explicit alternative with a condition ('while you still have anything to do, dispatch it and poll with agent_result'), and a clear best-practice for parameter usage ('always pass every outstanding worker in agentIds rather than waiting on one at a time'). This fully routes the agent's decision.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_infoCodex Orchestrator InfoARead-only
Check the Codex app-server process, worker counts, and any unscoped pending server requests.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description aligns with the readOnlyHint annotation by using 'Check,' and adds context by naming the specific server aspects inspected. It does not mention return format, pagination, or any operational caveats, but for a read-only info tool with annotations, this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single terse sentence that front-loads the verb and precisely enumerates the scope. Every word earns its place and there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless health-check tool, the description adequately identifies what is inspected and confirms the read-only nature. Since there is no output schema, a brief note on the response shape would improve completeness, but it is not essential for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so the baseline of 4 applies. No parameter documentation is needed because there are no parameters to explain.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Check') and exact resource scope: the Codex app-server process, worker counts, and unscoped pending server requests. This clearly distinguishes it from the sibling agent_* tools, which focus on agent lifecycle operations rather than server infrastructure.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a diagnostic read-only use case, and the sibling list makes its infrastructure-focused role apparent. However, there is no explicit statement about when to prefer this tool over alternatives or any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
15 tool updates
v0.1.0- First observed
agent_archive - First observed
agent_events - First observed
agent_fork - First observed
agent_goal_set - First observed
agent_interrupt - First observed
agent_list - First observed
agent_request_resolve - First observed
agent_result - First observed
agent_resume - First observed
agent_send - First observed
agent_start - First observed
agent_status - First observed
agent_steer - First observed
agent_wait - First observed
server_info
TDQS
Each tool targets a distinct agent lifecycle operation: start, resume, fork, send/steer guidance (with send covering idle follow-ups and steer specifically targeting in-flight turns), interrupt, status, list, events, wait, result, request resolution, goal setting, and archiving. While agent_send and agent_steer are closely related, their descriptions clearly differentiate when each applies, preventing ambiguity.
All tools follow a consistent agent_<verb> pattern (agent_start, agent_fork, agent_status, etc.) with the exception of server_info, which appropriately breaks the pattern as it targets the server rather than agents. The naming is uniform, predictable, and uses lowercase snake_case throughout.
15 tools is a well-scoped set for a comprehensive agent management server. Each tool covers a necessary operation without redundancy, and the count sits comfortably within the typical effective range for a domain-specific MCP server.
The lifecycle is fully covered: creation (start, fork, resume), control (send, steer, interrupt, goal_set), observation (status, list, events, wait, result), request resolution (request_resolve), and cleanup (archive). Server-level info is also provided, leaving no obvious gaps for effective fleet management.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Agent-native collaboration network: orchestrate a team of long-running agents from any MCP client.
Create and drive plori cloud agents and workflows over MCP; each agent has its own environment.
MCP-first control plane for ProAgentStore agents and private instances.
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to spawn and control Codex CLI and Claude Code sessions on the host machine, with session management and filesystem access.4MIT
- FlicenseNot gradedqualityBmaintenanceMCP fallback that launches and monitors local codex exec agents when native sub agents are unavailable.-
- FlicenseNot gradedqualityBmaintenanceAllows users to manage multiple remote AI coding agents from a single Claude Code session, with a controlled execution model where operations require moderator approval.-
- FlicenseNot gradedqualityBmaintenanceEnables MCP hosts like Claude Code and Codex to spawn, manage, and interact with persistent, reusable Pi coding-agent sessions, supporting task dispatch, status checks, and session lifecycle control.2-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/j-pollack/codex-app-server-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server