CodexPro
Allows ChatGPT (through OpenAI's ChatGPT Developer Mode / Apps surface) to access a local repository via MCP, enabling it to inspect files, edit code, search, run safe verification commands, and use Codex-style context such as AGENTS.md and git state.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@CodexProCheck my current git diff and update AGENTS.md with the next steps."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Unfinished project: S3dat Relay was stopped before development was completed. It is published as-is for reference and experimentation, is not production-ready, and may contain incomplete or disabled functionality.
S3dat Relay is an experimental relay and desktop-automation layer built as a
fork of rebel0789/codexpro. The
original CodexPro bridge remains the upstream base; Relay-specific code and
documentation live primarily under src/relay/, relay-docs/, desktop/,
and chrome-extension/s3dat-relay/.
This repository is distributed under the MIT License. The original CodexPro license notice and attribution are retained.
What is included
Relay orchestration, policy, safety, state-machine, persistence, and handoff modules under
src/relay/.An Electron-based macOS control panel and a Chrome native-messaging bridge.
Project packs, readiness checks, diagnostics, fixtures, and an extensive smoke-test suite.
The original CodexPro MCP bridge for local workspace access and ChatGPT Developer Mode integration.
Related MCP server: Agentic MCP
Try it locally
Requirements: Node.js 20+ and npm.
git clone https://github.com/sedatustunova/S3dat-Relay.git
cd S3dat-Relay
npm ci
npm run build
npm run smokeOn macOS, the development control panel can be opened with:
npm run relay:desktopSee src/relay/README.md for the Relay module map. The
longer CodexPro documentation below describes the inherited bridge and setup
workflow.
CodexPro turns ChatGPT Developer Mode into a local coding agent for the folder on your machine. Install it globally, run setup in a repo, paste the copied Server URL into ChatGPT Create App, and ChatGPT can inspect files, edit code, run safe verification commands, and load the same explicit context you normally give Codex through AGENTS.md, .ai-bridge, git status, git diff, and source files.
CodexPro is not a rate-limit bypass. It uses ChatGPT's official Developer Mode and MCP app path to connect your own ChatGPT session to your own local repo. ChatGPT and Codex remain separate product surfaces, each subject to its own plan limits, safety rules, and availability.
If one workflow is unavailable and another product surface you already have access to is still available, CodexPro lets you keep working against the same local repo without modifying or evading either product's limits.
npm install -g codexpro
codexpro setupWhy
ChatGPT web can see Codex-style context:
AGENTS.md
.ai-bridge plans and status
git status and diff
selected source files
ChatGPT web can act on your repo:
read files
write files
exact-edit files
search code
run safe verification commands
Codex stays useful:
execute plans locally
handle deeper terminal-heavy work
review or continue a handoffWhat it gives you:
Normal coding mode ChatGPT reads, writes, edits, searches, and verifies directly.
Handoff mode ChatGPT writes .ai-bridge/current-plan.md for a local implementation agent.
Pro planning mode Export a durable context bundle for sessions that cannot call MCP tools.
Stable URLs Use an ngrok free dev domain or Cloudflare named tunnel so the ChatGPT app URL stays fixed.If your ChatGPT account exposes a stronger model in the web app, and that model/surface can call Developer Mode apps, CodexPro lets it work against your local repo through MCP. Some ChatGPT model surfaces may not be able to call connectors or MCP tools directly. CodexPro does not provide, proxy, resell, or unlock models; it gives compatible ChatGPT sessions local coding tools and repo context.
CodexPro is not an OS sandbox. It is a local developer bridge with safety defaults. Read SECURITY.md before exposing it through a tunnel.
Requirements
Node.js 20+
ChatGPT Plus or Pro account with Apps / Developer Mode access
Developer mode enabled from Settings -> Apps -> Advanced settings
Enforce CSP in developer mode kept enabled
One public tunnel option: Cloudflare quick tunnel, ngrok free dev domain, or Cloudflare named tunnelCurrent testing shows free / Go ChatGPT accounts do not expose the app flow needed for CodexPro. Use Plus or Pro for the best experience.
Account tier and model tool support are separate things. Plus/Pro can expose Apps / Developer Mode, but a specific model surface may still be unable to call the connector. Use Pro context fallback for those sessions.
Status
CodexPro is a public open-source MCP bridge with conservative defaults: workspace-only writes, safe bash by default, blocked secret paths, token-protected public URLs, and compact visual cards for every tool result.
CodexPro does not bypass, avoid, increase, pool, resell, or modify ChatGPT, Codex, OpenAI, or third-party model limits. It does not provide models or account access. It only exposes local repo tools to the ChatGPT session the user already controls through official MCP and Developer Mode.
ChatGPT can do MCP-backed agentic coding in your local repo, while Codex remains available for terminal execution, review, or handoff workflows. Model, tool, and quota behavior are controlled by the product and account you connect CodexPro to.
Compliance boundary
CodexPro is designed for the official ChatGPT Developer Mode / MCP app path:
It exposes local workspace files, git state, safe verification commands, and
.ai-bridgehandoff files selected by the user.It does not ask for raw ChatGPT transcripts or broad conversation history. Context exports use explicit workspace files and bounded previews.
It does not scrape or act as pass-through middleware for third-party services unless the user connects an authorized local integration that follows that service's terms.
It does not automate ChatGPT, Codex, or terminal approval flows to bypass product security, rate limits, quota limits, account access, or review prompts.
Remote MCP tools do not execute Codex/OpenCode/Pi/local agents. Agent execution is a separate user-started CLI/watch process on the user's machine.
Relevant OpenAI references: ChatGPT Developer Mode, MCP servers for ChatGPT Apps, and Apps SDK submission guidelines.
Tools exposed to ChatGPT
CodexPro defaults to CODEXPRO_TOOL_MODE=standard, which keeps ChatGPT's tool picker focused on the normal coding loop plus handoff/export workflows. Use --tool-mode minimal for the tightest demo surface, or --tool-mode full when you want every compatibility and debugging tool exposed.
The smaller default tool list is deliberate. ChatGPT behaves better when routine work goes through a few high-signal tools instead of a large action catalog. Installed user/plugin skills are still discovered during workspace open; they are surfaced as context in the workspace card and can be loaded on demand with load_skill, not exposed as dozens of separate ChatGPT actions.
Standard mode exposes:
server_config— show safety modes, limits, blocked globs, and allowed roots.codexpro_self_test— run one local-only diagnostic for modes, expected tools, safe bash policy,.ai-bridgewrite/edit, and selected-only Pro context.open_current_workspace— open the configured default workspace without accepting a path. Fastest/safest first call.open_workspace— open a local project directory usingrootorpathand return workspace id, git status, AGENTS.md status, optional skill discovery, and optional file tree.tree— inspect files.search— search code with ripgrep or a Node fallback.load_skill— load boundedSKILL.mdinstructions for a discovered workspace, user, or plugin skill by name, with optional source/path disambiguation.read— read text files with line numbers.write— create/overwrite files and return a diff. Controlled byCODEXPRO_WRITE_MODE.edit— exact text replacement and return a diff. Controlled byCODEXPRO_WRITE_MODE.bash— run allowlisted shell commands in the workspace. Controlled byCODEXPRO_BASH_MODE.show_changes— one review-oriented summary with git status, diff stats, and optional diff.read_handoff— read.ai-bridgefiles.export_pro_context— write.ai-bridge/pro-context.mdfor models that cannot call MCP tools directly.handoff_to_agent— write.ai-bridge/current-plan.mdfor Codex, OpenCode, Pi, or a custom local implementation agent without executing local commands.
Minimal mode exposes only:
server_config
codexpro_self_test
open_current_workspace / open_workspace
read / write / edit
bash
show_changesFull mode adds:
codexpro_inventory— list discovered skill names and configured MCP server names without exposing MCP command arguments or secrets.list_workspaces— show opened workspaces in the current MCP session.workspace_snapshot— project status plus.ai-bridgehandoff context.git_status— inspect git status.git_diff— inspect current diff.codex_context— load Codex-style context in one call: AGENTS instructions for a target path,.ai-bridgefiles, and optional git status/diff.handoff_to_codex— compatibility wrapper forhandoff_to_agentwithagent=codex.
Local-only companion command:
codexpro execute-handoff— run a previously written.ai-bridge/current-plan.mdthrough a local agent, then collect status, logs, and git diff. This is intentionally a CLI command, not a remote MCP tool.codexpro watch-handoff— watch.ai-bridge/current-plan.mdlocally and run a new plan through a configured agent when its content hash changes. This is also CLI-only and is not exposed as a remote MCP tool.
The watcher is the safer way to automate handoff execution from ChatGPT Web. ChatGPT writes the plan through handoff_to_agent; the user-started local watcher notices the new plan and runs Pi, OpenCode, Codex, or a restricted custom command from the terminal:
codexpro start --mode handoff
codexpro watch-handoff --agent opencode --model provider/model --yesFor custom local agents:
codexpro watch-handoff \
--agent custom \
--command "node ./agent.js --task-file {{plan_file}}" \
--yesUseful watcher flags:
--once check one new plan and exit
--dry-run show the command without executing it
--poll-interval-ms 2000 polling interval
--debounce-ms 500 wait for the plan file to become stable
--state-file <path> duplicate-run state, default .ai-bridge/watch-handoff-state.jsonThe watcher writes the same review files as execute-handoff:
.ai-bridge/agent-status.md
.ai-bridge/implementation-diff.patch
.ai-bridge/execution-log.jsonlVisual ChatGPT cards
v0.28.5+ registers a reusable Apps SDK widget resource:
ui://widget/codexpro-tool-card-v9.htmlEvery CodexPro tool descriptor attaches that resource through _meta.ui.resourceUri and the ChatGPT compatibility key _meta["openai/outputTemplate"]. In ChatGPT Developer Mode this renders compact cards for:
server_config and codexpro_self_test
open_current_workspace / open_workspace project summaries
codexpro_inventory, list_workspaces, workspace_snapshot
tree, search, load_skill, read
write/edit diffs
bash verification commands
git_status, git_diff, show_changes review summaries
read_handoff, codex_context
handoff/pro-context exportsCards stay compact by default. Git details, discovered skills, file trees, terminal output, context bundles, and raw diffs are folded or bounded so the chat does not fill with project inventory unless you open it.
ChatGPT may still show some raw tool transcript around a card depending on the host UI and model behavior. CodexPro minimizes that by returning structured data, bounded previews, and a v9 card for every tool, but the ChatGPT client controls final transcript rendering.
The visual cards are not unlocked by "normal coding mode" alone; the MCP server has to register an HTML resource with text/html;profile=mcp-app and point tool descriptors at it.
The widget sets both domain and CSP metadata surfaces:
_meta.ui.domain
_meta["openai/widgetDomain"]
_meta.ui.csp
_meta["openai/widgetCSP"]CODEXPRO_WIDGET_DOMAIN defaults to https://rebel0789.github.io for this package. For app submission, set it to a dedicated HTTPS origin you control, for example https://widgets.yourdomain.com. The CSP lists are intentionally strict because the widget has no external fetches, fonts, scripts, images, or iframes.
After upgrading or changing widget metadata, open the CodexPro app settings in ChatGPT Developer Mode and click Refresh / Refresh actions so ChatGPT reloads the tool descriptors and resource URI.
Install
Recommended install:
npm install -g codexproFirst run from the repo you want ChatGPT to work on:
codexpro setupDaily start after setup:
codexpro startNo-install fallback:
npx codexpro@latest start --root /absolute/path/to/your/repoFrom source:
cd codexpro
npm install
npm run buildCodexPro Start
From the project folder you want ChatGPT to work on:
codexpro setupThat is the intended low-friction first-run path. It:
- uses the current folder as the workspace root
- asks for the local port, mode, tunnel provider, and stable URL choice
- saves the workspace profile for future codexpro start runs
- starts the local HTTP MCP server
- generates a private CodexPro token
- supports Cloudflare quick tunnel, ngrok free dev domain, Cloudflare stable tunnel, or local-only mode
- installs cloudflared into ~/.codexpro/bin if Cloudflare is selected and it is missing
- waits for the public HTTPS tunnel URL
- copies the exact ChatGPT Server URL to your clipboard
- starts in normal coding mode with workspace edits enabled
- shows a compact terminal control panel
- lets you press Enter to open ChatGPT in your browser
- lets you press `o` to open a local setup/status pageAfter setup, daily use from the same repo is:
codexpro startChatGPT app setup
Before you paste the CodexPro URL, turn on Developer Mode in ChatGPT:
ChatGPT Settings
-> Apps
-> Advanced settings
-> Developer mode: on
-> Enforce CSP in developer mode: on
-> Create appThis is a one-time ChatGPT setting. Keep CSP enabled; CodexPro widgets are built for that path.
In Create App, use:
Name: CodexPro
Description: Local workspace bridge for ChatGPT coding
Connection: Server URL
Server URL: paste the copied URL
Authentication: No Authentication / NoneThe copied Server URL already includes the private CodexPro token. Do not paste the token separately unless your ChatGPT UI supports custom headers.
Keep the terminal running while ChatGPT uses the connector. When you stop it, the quick-tunnel URL stops working.
If cloudflared is missing, CodexPro downloads the official Cloudflare binary into ~/.codexpro/bin on supported macOS, Windows, and Linux machines. No sudo, admin shell, Homebrew, apt, or winget step is required. To skip that behavior:
codexpro start --no-install-cloudflaredOS behavior:
macOS auto-installs ~/.codexpro/bin/cloudflared, copies with pbcopy, opens ChatGPT with open
Windows auto-installs ~/.codexpro/bin/cloudflared.exe, copies with clip, opens ChatGPT with start
Linux auto-installs ~/.codexpro/bin/cloudflared, opens ChatGPT with xdg-open when availableLinux clipboard copy requires one of wl-copy, xclip, or xsel. If none is installed, CodexPro prints the URL clearly so it can be copied manually.
First-run tunnel choice:
cloudflare Cloudflare quick tunnel. Easiest demo path, new URL each restart.
ngrok ngrok free dev domain. Recommended stable URL for most users.
stable Cloudflare named tunnel. Stable URL with your own Cloudflare domain.
local No public tunnel. Only for local MCP clients.If you use quick mode, the Server URL changes every time the tunnel restarts. That means you must update the ChatGPT app Server URL each time. Use quick mode for demos, not daily work.
Recommended daily path: create a free ngrok account, use the dev domain assigned to your account, save it in codexpro setup, and keep the same ChatGPT app Server URL across restarts.
CodexPro saves the selected tunnel provider, hostname, port, mode, and auth token for that workspace. Future launches from the same folder reuse it:
codexpro startIf you start CodexPro in a new folder and already have saved setups, it shows a numbered list. Press Enter to reuse the first saved setup, type another number, or type new to choose a fresh tunnel.
If you are running this repository from source instead of npm:
npm run connect:chatgpt -- --root /absolute/path/to/your/repoGuided onboarding:
codexpro setupsetup asks for the workspace folder, local port, mode, and public URL strategy, then prints the exact codexpro start ... command and can launch it immediately. It saves the selected tunnel provider, hostname, local port, mode, and generated CodexPro auth token for that workspace under ~/.codexpro/profiles/, so future codexpro start runs from the same folder can reuse the stable URL setup automatically.
From a source checkout:
npm run connect:setupPreflight diagnostics:
codexpro doctordoctor does not start the MCP server or open a tunnel. It checks the local package build, Node version, workspace profile, port availability, tunnel prerequisites, clipboard support, and browser-open support. Run it before filing setup bugs or before recording a demo.
Use --no-copy-url if you do not want CodexPro to copy the connector URL. Add --open-chatgpt if you want the browser to open automatically instead of pressing Enter.
Local setup/status page:
press o in the CodexPro terminal control panelThe page shows the active workspace, local MCP endpoint, safety modes, allowed roots, and the exact ChatGPT setup steps. It is served by the local CodexPro process and stays token-protected when auth is enabled.
Saved workspace profile behavior:
codexpro setup
choose quick, stable, ngrok, or local
enter the Cloudflare/ngrok hostname when needed
accept the generated CodexPro auth token
save the profile
future codexpro start
loads the saved profile for the current folder
reuses the saved tunnel provider, hostname, port, mode, and tokenIf setup finds a saved ngrok or Cloudflare stable profile, CodexPro prints the saved hostname and the short daily command:
codexpro startThat is enough from the same workspace folder. Use codexpro setup again only when you want to change the port, mode, tunnel provider, hostname, or CodexPro auth token.
Useful profile flags:
codexpro start --no-profile # ignore saved profile for this run
codexpro setup --no-save-config # run setup without saving
codexpro setup --save-config # explicitly save setup choicesWorkspace settings:
codexpro settings
codexpro settings show
codexpro settings list
codexpro settings set --tunnel ngrok --hostname your-domain.ngrok-free.dev
codexpro settings use --from-root /path/to/another/repo
codexpro settings set --tunnel cloudflare
codexpro settings delete --yesUse codexpro settings when you want to make ngrok the default, switch back to Cloudflare quick tunnels, reuse a saved setup from another repo, or delete the saved workspace preference. The saved token is redacted when settings are shown.
Terminal controls:
Enter open ChatGPT connector settings in your browser
c copy Server URL again
o open local setup/status page
h show controls
q stop CodexProAdvanced controls such as u for printing the full URL, p for Create App fields, and m for mode help are still available through h.
Startup modes:
codexpro start # normal coding mode: read/write/edit/search/bash
codexpro setup # guided onboarding for new users
codexpro start --mode handoff # planning-only .ai-bridge handoff
codexpro start --mode pro # export context for models without MCP tools
codexpro stable --hostname codexpro.example.com --tunnel-name codexpro
codexpro ngrok --hostname your-domain.ngrok-free.devEasiest run mode
This is the lightweight launcher so you do not have to manually start the MCP server, generate a token, start Cloudflare, and copy/paste multiple fields by hand.
If you are running from source, use npm run connect -- --root /absolute/path/to/your/repo.
By default this:
- starts the local HTTP MCP server
- generates a bearer token
- starts a Cloudflare quick tunnel
- installs `cloudflared` into `~/.codexpro/bin` on supported OSes when it is missing
- copies the exact /mcp endpoint with a codexpro_token query parameter
- copies the public HTTPS Server URL to your clipboard when clipboard support is available
- tells ChatGPT Developer Mode to use No Authentication / None
- uses CODEXPRO_WRITE_MODE=workspace so ChatGPT can edit files directlyIn ChatGPT Developer Mode, use the printed fields:
Name: CodexPro
Connection: Server URL
Server URL: https://<cloudflare-host>/mcp?codexpro_token=<token>
Authentication: No Authentication / NonePlanning-only handoff mode:
codexpro start \
--root /absolute/path/to/your/repo \
--bash safe \
--mode handoff \
--tunnel cloudflareIn handoff mode, ChatGPT can create a plan for a local implementation agent without getting direct source-write access. Use handoff_to_agent from ChatGPT with agent=opencode, agent=pi, agent=codex, or a custom agent id. CodexPro writes:
.ai-bridge/current-plan.md
.ai-bridge/agent-status.md
.ai-bridge/implementation-diff.patch
.ai-bridge/execution-log.jsonlThen run the implementation locally with codexpro execute-handoff:
codexpro execute-handoff --agent opencode --model provider/cheap-modelDry-run first if you want to inspect the exact command:
codexpro execute-handoff --agent opencode --model provider/cheap-model --dry-runPi adapter:
codexpro execute-handoff --agent pi --model provider/cheap-modelCustom adapter:
codexpro execute-handoff \
--agent custom \
--command "my-agent --model {{model}} --task-file {{plan_file}}" \
--model provider/cheap-modelTemplate placeholders:
{{model}} model passed with --model
{{plan_file}} absolute path to .ai-bridge/current-plan.md
{{plan_text}} full plan text as one argument
{{root}} workspace rootBy default, execute-handoff asks for local confirmation before running. Use --yes only in trusted scripts. After execution, CodexPro writes:
.ai-bridge/agent-status.md
.ai-bridge/implementation-diff.patch
.ai-bridge/execution-log.jsonlThen let ChatGPT review those files through read_handoff or codex_context.
Manual fallback:
opencode run --model provider/cheap-model "$(cat .ai-bridge/current-plan.md)"
git diff --no-ext-diff -- > .ai-bridge/implementation-diff.patchFor debugging whether ChatGPT is actually reaching the local server, add:
--log-requestsTo open ChatGPT settings automatically:
codexpro start --root /absolute/path/to/your/repo --open-chatgptTo prevent automatic cloudflared installation:
codexpro start --root /absolute/path/to/your/repo --no-install-cloudflaredRequest logs print method, path, status, and duration. CodexPro also logs tool name, success/error state, and duration as [CodexProTool] ... lines. Query strings, file contents, and prompts are not logged, so the codexpro_token and source content are not printed.
For faster ChatGPT runs, keep the first call narrow:
Call open_current_workspace with include_tree=false unless you need the tree immediately.
Use tree with max_depth=2 and max_entries=100 when you need file structure.
Use load_skill only for the specific discovered skill needed for the task.
Use --tool-mode full and call codexpro_inventory only when you want ChatGPT to see full global skill and MCP server inventory.
Do not call open_workspace after open_current_workspace unless you are switching to a different root.
Use tree/search/read for inspection, one targeted search plus show_changes for review, and bash only for focused build/test/lint verification.open_current_workspace and open_workspace discover workspace, user, and plugin skills by default. Use include_global_skills=false when you only want repo-local instructions, or include_skills=false when you want the fastest possible open call. load_skill only accepts a discovered skill name plus optional source and exact displayed path, then reads that skill's SKILL.md with a bounded byte limit; it does not accept arbitrary file paths. If multiple discovered skills still match, CodexPro returns an ambiguity error instead of guessing. workspace_snapshot stays narrower by default for speed. In --tool-mode full, use codexpro_inventory for global/user/plugin skills and MCP server names. codexpro_inventory reports names/descriptions and sanitized paths only; it does not expose MCP command arguments or environment values.
Codex-style context
CodexPro is not reading Codex's private runtime memory. It gives ChatGPT explicit workspace context through tools:
open_current_workspace root, safety mode, AGENTS.md status, git status
codex_context AGENTS chain, .ai-bridge handoff files, optional git status/diff
read_handoff .ai-bridge files only
workspace_snapshot larger project snapshot plus .ai-bridge contextcodex_context is the closest match to "load what Codex should know." It reads AGENTS-style instruction files from the workspace root down to a target path:
AGENTS.override.md
AGENTS.md
agents.md
.agents.mdThen it adds:
.ai-bridge/current-plan.md
.ai-bridge/agent-status.md
.ai-bridge/implementation-diff.patch
.ai-bridge/codex-status.md
.ai-bridge/decisions.md
.ai-bridge/open-questions.md
.ai-bridge/execution-log.jsonl
git status
optional git diffUse it before planning or review:
Call open_current_workspace with include_tree=false.
Call codex_context with target_path="src/App.tsx" and include_diff=false.
Then inspect only the files needed for the task.This keeps ChatGPT closer to Codex's instruction model without hidden state, browser memory, or repeated broad file scans.
Demo/Codex-like mode, where ChatGPT can use write and edit on source files:
codexpro start \
--root /absolute/path/to/your/repo \
--bash safe \
--write workspace \
--tunnel cloudflareLocal-only mode, for local MCP clients that can reach 127.0.0.1 directly:
codexpro start --root /absolute/path/to/your/repo --tunnel noneThe local endpoint is usually:
http://127.0.0.1:8787/mcpPro context fallback
Some ChatGPT models or product surfaces may not be able to call Developer Mode apps, connectors, or MCP tools directly. This can include stronger planning-model surfaces even when the same ChatGPT account can create and use the CodexPro app from other chats. When that happens, use a durable context bundle instead of fighting the tool boundary.
Generate a bundle:
codexpro pro-bundle --root /absolute/path/to/your/repo --copyThis writes:
.ai-bridge/pro-context.mdThe bundle includes the file tree, git status, current diff, recent commits, selected important config files, changed files, and existing .ai-bridge handoff context. --copy also copies the bundle to the macOS clipboard when pbcopy is available.
For an exact selected-file bundle, disable the automatic config/docs and changed-file inclusions:
codexpro pro-bundle \
--root /absolute/path/to/your/repo \
--path README.md \
--path package.json \
--no-important-files \
--no-changed-files \
--no-diff \
--no-ai-bridge \
--copyUseful options:
codexpro pro-bundle \
--root /absolute/path/to/your/repo \
--path src/App.tsx \
--glob "src/**/*.ts" \
--max-files 32 \
--max-total-bytes 300000 \
--copyPaste the bundle into any model that cannot call MCP tools directly and ask it to produce a narrow implementation plan. Save the returned plan to a file, then apply it:
codexpro pro-apply --root /absolute/path/to/your/repo --file plan.mdOr pipe from stdin:
cat plan.md | codexpro pro-apply --root /absolute/path/to/your/repo --stdinThat writes:
.ai-bridge/current-plan.mdThen run Codex, OpenCode, Pi, or another local implementation agent against .ai-bridge/current-plan.md.
Cloudflare options
The launcher uses Cloudflare quick tunnels when you pass or default to:
--tunnel cloudflareQuick tunnels are good for demos, but the trycloudflare.com URL changes whenever the tunnel restarts. Do not use quick tunnels if you want a URL users can keep in ChatGPT.
CodexPro needs cloudflared for public HTTPS tunnels. The launcher first uses cloudflared from PATH, then ~/.codexpro/bin, then downloads the official Cloudflare release into ~/.codexpro/bin when it is missing.
codexpro startTo force a fresh local install:
codexpro install-cloudflaredYou can also force a refresh during normal startup with codexpro start --install-cloudflared.
To manage Cloudflare Tunnel yourself, opt out and pass a path:
codexpro start --no-install-cloudflared --cloudflared /path/to/cloudflaredAutomatic install currently supports:
macOS: arm64, x64
Windows: x64, 32-bit
Linux: x64, 32-bit, arm64, armOther platforms can still work by installing cloudflared manually and passing --cloudflared <path>.
Stable URL mode
For daily use, use ngrok's free dev domain, a Cloudflare named tunnel, or a Cloudflare dashboard-managed tunnel token. This gives you one stable ChatGPT connector URL, for example:
https://codexpro.example.com/mcp?codexpro_token=<your-codexpro-token>There is one unavoidable boundary: a permanent public URL needs a tunnel provider such as Cloudflare or ngrok and a hostname reserved with that provider. CodexPro can run the tunnel after that setup, but a quick tunnel cannot be made permanent.
If you use quick mode, you will need to edit the ChatGPT app every restart because the copied Server URL changes.
One-time Cloudflare CLI setup with your own domain:
cloudflared tunnel login
cloudflared tunnel create codexpro
cloudflared tunnel route dns codexpro codexpro.example.comThen daily startup is one command:
codexpro stable \
--root /absolute/path/to/your/repo \
--hostname codexpro.example.com \
--tunnel-name codexpro \
--token keep-this-codexpro-token-stable \
--bash safePut this stable Server URL into ChatGPT Developer Mode once:
https://codexpro.example.com/mcp?codexpro_token=keep-this-codexpro-token-stableAfter that, users only restart the local command. They do not need to edit the ChatGPT connector unless they change the hostname or token.
If you create a remotely managed tunnel in the Cloudflare dashboard instead, save its tunnel token to a local file and run:
codexpro start \
--root /absolute/path/to/your/repo \
--tunnel cloudflare-named \
--hostname codexpro.example.com \
--cloudflare-token-file ~/.codexpro/cloudflare-tunnel-token \
--token keep-this-codexpro-token-stable \
--bash safeToken naming matters:
--cloudflare-token-file Cloudflare's tunnel connector token.
--token CodexPro's MCP auth token used in the ChatGPT URL.Stable URL with ngrok
If you already installed ngrok and authenticated it:
ngrok config add-authtoken <your-ngrok-token>Create a free ngrok account, find your assigned dev domain in the ngrok dashboard under Universal Gateway -> Domains, then start CodexPro with:
codexpro ngrok \
--root /absolute/path/to/your/repo \
--hostname your-domain.ngrok-free.dev \
--token keep-this-codexpro-token-stableEquivalent explicit form:
codexpro start \
--root /absolute/path/to/your/repo \
--tunnel ngrok \
--hostname your-domain.ngrok-free.dev \
--token keep-this-codexpro-token-stableCodexPro runs ngrok in the background with:
ngrok http http://127.0.0.1:8787 --url https://your-domain.ngrok-free.devPut this Server URL into ChatGPT Developer Mode once:
https://your-domain.ngrok-free.dev/mcp?codexpro_token=keep-this-codexpro-token-stableAfter that, keep using the same hostname and token. You do not need to recreate the ChatGPT app unless you change either one.
After saving this in codexpro setup, daily startup from that repo is just:
codexpro startCodexPro will reuse the saved ngrok hostname and saved CodexPro token.
Running two repositories at the same time
You can run CodexPro for multiple repositories at once, but each running workspace needs its own local port:
# repo A
codexpro setup # choose port 8787
# repo B
codexpro setup # choose port 8788If both repositories use quick tunnels, different local ports are enough because each run gets a different temporary public URL.
If both repositories use stable ngrok or Cloudflare URLs, each repository also needs its own public hostname:
repo A port 8787 codexpro-a.ngrok-free.dev
repo B port 8788 codexpro-b.ngrok-free.devDo not point two running repositories at the same local port or the same ngrok/Cloudflare hostname. The second process will fail because the port or public hostname is already owned by the first process.
For Namecheap and custom-domain setup, read DOMAIN_SETUP.md. The key point is that a stable domain can solve your own repeated ChatGPT connector setup now, but a single shared URL for every future user needs a hosted relay or per-user tunnel routing.
If ChatGPT does not let you edit an existing app's Server URL, do not use quick tunnels for daily work. Use codexpro stable with a Cloudflare named tunnel and put the stable URL into ChatGPT once:
codexpro stable-helpFor a less manual daily workflow, create a shell alias:
alias codexpro-local='codexpro start --root /path/to/your/repo --bash safe'Then run:
codexpro-localManual HTTP MCP mode
CODEXPRO_ROOT=/absolute/path/to/your/repo \
CODEXPRO_ALLOWED_ROOTS=/absolute/path/to/your \
CODEXPRO_BASH_MODE=safe \
CODEXPRO_WRITE_MODE=workspace \
CODEXPRO_HTTP_TOKEN='replace-with-long-random-token' \
npm run start:httpHealth check:
curl 'http://127.0.0.1:8787/healthz?codexpro_token=replace-with-long-random-token'MCP endpoint:
http://127.0.0.1:8787/mcp?codexpro_token=replace-with-long-random-tokenStdio MCP mode
For clients that launch local MCP commands:
node /absolute/path/to/codexpro/dist/stdio.js \
--root /absolute/path/to/your/repo \
--allow-root /absolute/path/to/your \
--bash safe \
--write workspaceExample MCP config:
{
"mcpServers": {
"CodexPro": {
"command": "node",
"args": [
"/absolute/path/to/codexpro/dist/stdio.js",
"--root",
"/absolute/path/to/your/repo",
"--allow-root",
"/absolute/path/to/your",
"--bash",
"safe",
"--write",
"handoff"
]
}
}
}Write modes
CODEXPRO_WRITE_MODE=workspace is the default normal coding mode. Use handoff when you want planning-only behavior and do not want ChatGPT to edit source files directly.
off write/edit tools are disabled; handoff_to_agent and handoff_to_codex still write .ai-bridge/current-plan.md
handoff write/edit can only write inside .ai-bridge/
workspace write/edit can write workspace files, except blocked pathsThe launcher defaults to workspace in normal coding mode and handoff in handoff/pro planning modes.
Tool modes
CODEXPRO_TOOL_MODE=standard is the default. It exposes the normal coding loop plus show_changes, Pro context export, and generic agent handoff.
minimal smallest surface for demos and simple coding: open/read/write/edit/bash/show_changes
standard default surface for normal coding plus handoff/export
full all tools, including inventory, workspace snapshots, raw git tools, codex_context, and compatibility wrappersLauncher examples:
codexpro start --tool-mode minimal
codexpro start --tool-mode fullBash modes
CODEXPRO_BASH_MODE=safe is the default. It allows common inspection and test commands, including:
pwd, ls, find
git status, git diff, git log, git show, git branch, git rev-parse, git ls-files
npm/pnpm/yarn/bun test/build/lint/typecheck/check, including suffix scripts such as npm run build:clients
pytest, go test, cargo test, cargo check, cargo clippy, tsc, eslint, biome checkUse the MCP read and search tools for file contents. The safe shell blocks obvious destructive commands, redirects, pipes, curl, wget, ssh, docker, git push/reset/clean/checkout/switch/restore, find -exec, find -delete, and file-content shell readers such as cat, grep, rg, head, and tail.
CODEXPRO_BASH_MODE=off disables bash completely.
CODEXPRO_BASH_MODE=full allows arbitrary shell commands. Use this only for trusted local repos; MCP itself is not an OS sandbox.
By default the bash environment is sanitized. To inherit your full local environment:
CODEXPRO_INHERIT_ENV=1 CODEXPRO_BASH_MODE=full npm run start:httpSafety boundaries
Blocked by default:
.env, .env.*
.git internals
node_modules
private key patterns such as *.pem, *.key, id_rsa, id_ed25519
build/cache outputs such as dist, build, .next, coverage, .cache
paths outside the opened workspace root
workspace roots outside CODEXPRO_ALLOWED_ROOTS
symlinks that resolve outside the workspace root
symlinks that resolve to blocked pathsExtra blocked globs can be added with a comma-separated env var:
CODEXPRO_BLOCKED_GLOBS='**/secrets/**,**/*.sqlite,**/*.db' codexpro start --root /repoFirst ChatGPT prompt
Use CodexPro.
Call server_config first, then codexpro_self_test.
If self-test fails, stop and report the failed checks.
Then call open_current_workspace with include_tree=false.
Act as a coding agent. Inspect the relevant files, make the requested source edits with write/edit, then verify with search/read/bash and show_changes when useful. Use bash only for focused verification commands such as build, test, lint, or typecheck.
Keep changes scoped to the request. Do not use handoff_to_agent unless I explicitly ask for planning-only handoff.After upgrading CodexPro or changing the Server URL, refresh the app actions in ChatGPT before judging the card UI. Existing cards do not retroactively re-render after a widget URI change.
Prompt for a local agent
Read .ai-bridge/current-plan.md and execute it in small, reviewable steps.
After each meaningful change, update .ai-bridge/agent-status.md with:
- what changed
- files touched
- tests, lint, or typecheck commands run
- results
- blockers or questions
- what ChatGPT or another reviewer should review next
Keep .ai-bridge/decisions.md aligned with implementation choices. Save the final review diff to .ai-bridge/implementation-diff.patch when practical. Do not overwrite .ai-bridge/current-plan.md unless asked.Demo prompt matching the screenshots
Default codexpro start is already workspace-write normal coding mode.
Use CodexPro.
Open ~/tmp/codexpro-example as the active workspace. Demonstrate each tool call while you work:
1. server_config
2. open_workspace
3. tree
4. read the relevant HTML/table file
5. write README.md explaining the demo
6. edit the repeated table row so each tool appears once
7. run one final targeted search and show_changes to verify
Narrate which CodexPro tool you are using before each call.Recommended workflow
Start CodexPro MCP against your repo with
codexpro start --root /repo.Connect the printed endpoint in ChatGPT Developer Mode.
Ask ChatGPT to inspect the repo, edit files directly, and verify the work with search/read/bash/git tools.
If your chosen ChatGPT model cannot call tools, run
codexpro pro-bundle --root /repo --copy, paste the bundle into that model, then apply its plan withcodexpro pro-apply --root /repo --file plan.md.Use
codexpro start --mode handoffonly when you want ChatGPT to write.ai-bridge/current-plan.mdfor Codex, OpenCode, Pi, or another local implementation agent instead of editing source files itself.
Development
npm install
npm run build
npm run smoke
npm run doctor -- --tunnel noneBefore publishing or opening a pull request, check:
npm pack --dry-runThe package should not include local runtime reports, .ai-bridge, .env files, tunnel tokens, or generated tarballs.
For public release gates, see PUBLIC_LAUNCH_CHECKLIST.md. For contribution and security boundaries, see CONTRIBUTING.md and SECURITY.md.
License
MIT
Available Tools
15 toolsbashBashADestructive
Run one allowlisted verification command in the workspace, such as tests, build, lint, typecheck, or a project script. Do not use for git status/diff or file inspection; use show_changes, tree, search, and read instead. Do not chain commands with &&, pipes, redirects, or shell file readers.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory relative to workspace root. Default: . | |
| command | Yes | Command to run. | |
| timeout_ms | No | Timeout in milliseconds. Default: 30000. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, openWorldHint=true, and idempotentHint=false. The description adds useful behavioral constraints beyond annotations: it restricts to a single allowlisted command and bans command chaining. It does not explicitly mention that commands may modify the workspace, but the destructiveHint annotation already covers that, so the description adds value without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, each earning its place. The first sentence states the core purpose, the second gives exclusions with alternatives, and the third imposes a critical safety constraint. It is front-loaded with the primary action and uses no filler or redundant phrasing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a command execution tool with no output schema, this description is complete. It tells the agent what can be run, what cannot, names alternatives, and sets boundaries on command composition. The workspace context is implied via open_workspace and cwd parameters. An agent can call this tool correctly without further information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented with clear descriptions (command, cwd, timeout_ms, workspace_id). The description provides example command types (tests, build, lint) but does not add meaning beyond the schema's 'Command to run.' The schema carries the burden, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Run') and resource ('allowlisted verification command'), and explicitly distinguishes from siblings by naming alternatives for other operations. It is clear that this tool is for executing verification commands like tests, build, lint, typecheck, or project scripts, not for general file operations or git inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool (verification commands), gives concrete examples, and provides direct exclusions with named alternatives ('use show_changes, tree, search, and read instead'). It also prohibits chaining commands with &&, pipes, redirects, or shell file readers, which is a precise usage constraint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codexpro_self_testCodexPro Self TestA
Run one controlled, local-only CodexPro diagnostic. It checks modes, expected tools, workspace access, skills, git, safe bash policy, selected-only Pro context, and optional .ai-bridge write/edit without touching source files.
| Name | Required | Description | Default |
|---|---|---|---|
| bash_probe | No | Check bash policy with safe local commands only. Default: true. | |
| max_skills | No | Maximum skills to inspect during the inventory check. Default: 40. | |
| write_probe | No | Create/edit only .ai-bridge/codexpro-self-test.md. Default: true. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. | |
| pro_context_probe | No | Build a selected-only Pro context bundle in memory without writing pro-context.md. Default: true. | |
| include_global_skills | No | Include user/plugin skill discovery in the inventory check. Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses key behavioral traits: it is local-only, does not touch source files, and can write/edit a single .ai-bridge file. It also mentions in-memory operations (Pro context bundle) without side effects. Annotations are all false, so the description carries the burden; it covers safety and side-effect boundaries well, though it omits exact return format or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence, front-loaded with the core verb and scope. It lists numerous checks without excessive detail, and every listed item adds informational value. Minor verbosity in the enumeration is acceptable given the tool's broad scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains what the tool does but fails to mention what the tool returns — no output schema exists, so the description should hint at result format or interpretation. An agent has no guidance on how the diagnostic output is presented (e.g., JSON, plain text, exit codes) or how to handle failures. This is a notable gap for a diagnostic tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% — every parameter has a description in the schema. The tool description does not add significant parameter-specific meaning beyond what the schema already provides. It references the `.ai-bridge` write/edit generally, but that maps to the `write_probe` parameter which is already described. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a controlled, local-only diagnostic and enumerates the specific checks it performs (modes, tools, workspace, skills, git, bash policy, Pro context). This distinguishes it from siblings like read, bash, or open_workspace by presenting it as a comprehensive self-test rather than a single operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied: it is a diagnostic to verify environment capabilities. The description notes it avoids source files but does not explicitly state when to use it versus alternatives, nor does it provide exclusions or conditions. Some guidance is present, but it is not explicit about when an agent should invoke this over other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
editEdit FileBDestructive
Apply a targeted exact text replacement inside a workspace text file. Returns a unified diff.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | File path relative to workspace root. | |
| new_text | Yes | Replacement text. | |
| old_text | Yes | Exact text to replace. Must match once unless replace_all=true. | |
| replace_all | No | Replace all occurrences. Default: false. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. | |
| expected_replacements | No | Fail if actual replacement count differs. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, and idempotentHint=false. The description adds 'Returns a unified diff,' which is a useful behavioral detail about the output. It does not contradict annotations, but it does not go beyond them significantly—no mention of failure modes, atomicity, or safety considerations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no filler. The primary action is front-loaded in the first sentence, and the return type is mentioned in the second. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 parameters and no output schema, the description covers the core operation and return format but omits usage context (when to prefer this over 'write'), edge-case behavior (e.g., what if old_text not found), and dependencies like workspace_id. The schema fills in some parameter details, but the description alone leaves an agent guessing about selection context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters are already documented. The description adds no additional semantic context (e.g., typical values, relationships between parameters). It meets the baseline because the schema handles the parameters, but there is no extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear and specific: 'Apply a targeted exact text replacement inside a workspace text file.' The verb 'apply' and resource 'workspace text file' are explicit, and 'targeted exact text replacement' distinguishes it from siblings like 'write' (whole file) and 'search'/'read' (non-mutating).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'write' or 'search'. The description does not mention exclusions, prerequisites, or typical scenarios. An agent has to infer that 'edit' is for small targeted changes, which is not explicitly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
export_pro_contextExport Pro ContextA
Create .ai-bridge/pro-context.md with repo tree, git state, selected files, and handoff context for high-context ChatGPT planning without live MCP tool calls.
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Markdown title for the context bundle. | |
| max_depth | No | Repository tree depth. Default: 3. | |
| max_files | No | Maximum file contents to include. Default: 24. | |
| extra_globs | No | Additional workspace-relative glob patterns to include, for example src/**/*.ts. | |
| include_diff | No | Include the current git diff. Default: true. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. | |
| max_file_bytes | No | Maximum bytes per included file. Default: 60000. | |
| selected_paths | No | Specific workspace-relative files to include. | |
| max_total_bytes | No | Maximum bytes in the generated bundle. | |
| include_ai_bridge | No | Include existing .ai-bridge planning files. Default: true. | |
| include_changed_files | No | Auto-include currently changed files from git status. Default: true. | |
| include_important_files | No | Auto-include important root config/docs such as AGENTS.md, README.md, and package.json. Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover read-only/destructive safety (both false), so the description does not need to repeat that. It adds useful context by listing the bundle's components (repo tree, git state, selected files, handoff context), which goes beyond annotations. However, it does not disclose potential overwrite behavior if the file already exists, nor mention any I/O side effects beyond file creation, leaving a minor transparency gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly worded sentence that fronts the action and purpose. It has zero waste and directly communicates the tool's function without tangential details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 12 parameters and no output schema, the description succinctly covers the overall purpose, the file's contents, and the intended use case (offline ChatGPT planning). It does not explain return values or failure modes, but those are less critical for a file-generation tool. The mention of 'without live MCP tool calls' provides key context for selection. Overall, it is sufficiently complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 12 parameters are documented in the schema. The description does not add semantic detail beyond what the schema already provides (e.g., it mentions 'selected files' but that maps directly to selected_paths). With full schema coverage, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Create'), a specific resource ('.ai-bridge/pro-context.md'), and enumerates the contents (repo tree, git state, selected files, handoff context). It clearly distinguishes itself from generic write tools by focusing on the pro-context bundle for ChatGPT planning.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly frames when to use it: 'for high-context ChatGPT planning without live MCP tool calls.' This gives a clear use case and implies when it's appropriate (when you need offline context). It does not name specific alternatives or exclusions, but the context is strong enough to guide an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
handoff_to_agentHandoff To AgentA
Write .ai-bridge/current-plan.md for Codex, OpenCode, Pi, or another local implementation agent. This only creates handoff files; it does not execute local agent commands.
| Name | Required | Description | Default |
|---|---|---|---|
| plan | Yes | Detailed implementation plan for the local agent. | |
| agent | No | Target agent id, for example codex, opencode, pi, or custom. Default: custom. | |
| model | No | Optional model identifier to include in the handoff plan. | |
| title | No | Short task title. | |
| append | No | Append to existing current-plan.md instead of overwriting. Default: false. | |
| agent_name | No | Human-readable agent name for custom agents. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish it's a write operation (readOnlyHint=false), but the description adds valuable context: it only creates handoff files and does not execute local agent commands. This is a key behavioral clarification beyond what annotations provide, preventing an agent from expecting side effects like running commands. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero fluff. The first sentence states the core action and target, the second clarifies the scope limitation (no command execution). Information is front-loaded and every word earns its place. Excellent conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 7 parameters (1 required) and no output schema, but it's a straightforward write operation. The description covers the purpose, target file, and a critical limitation. It doesn't explain the return value or error behavior, but for a file-creation tool this is typically obvious and not essential. One could argue it might mention that the plan should be comprehensive since the local agent will read it, but that's a minor omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema fully documents all 7 parameters. The tool description adds no additional parameter-specific guidance. Baseline of 3 is appropriate because the schema carries the semantic weight; the description doesn't enhance or clarify parameters beyond what is already structured.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Write'), a concrete resource ('.ai-bridge/current-plan.md'), and the intended audience (local agents like Codex, OpenCode, Pi). It clearly distinguishes this from generic write/edit tools by specifying the file and purpose, and even clarifies it does not execute commands. This leaves no ambiguity about the tool's function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is clear: use this to create a handoff plan for a local agent. It implies the primary use case without explicitly naming alternatives or exclusions. While it doesn't say 'use this instead of write when creating a handoff file,' the purpose is distinct enough that an agent can infer when to call it. A missing explicit 'when not to use' keeps it at 4 rather than 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
load_skillLoad SkillARead-only
Load the bounded SKILL.md body for a discovered workspace, user, or plugin skill by name. Does not accept arbitrary paths; use after open_current_workspace/open_workspace shows skill_inventory.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact skill name from skill_inventory or codexpro_inventory. | |
| path | No | Exact sanitized path from skill_inventory when name/source are still ambiguous. | |
| source | No | Optional source when multiple skills share a name. | |
| max_bytes | No | Maximum bytes to return from SKILL.md. Default: 40000. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. | |
| include_global_skills | No | Also scan installed user/plugin skills. Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable context: the tool returns a 'bounded' body (not the full file), and it only works with discovered skills, not arbitrary paths. This clarifies what happens beyond the annotation's implied read-only nature. No contradiction detected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero filler. The core purpose is stated first, followed by the key usage prerequisite. Every word contributes value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 parameters (only 1 required), the description covers the primary usage context (after opening workspace, referencing inventory) and the key constraint (no arbitrary paths). Since the output is simply the SKILL.md content, no output schema is needed. The only minor gap is not explicitly stating that the return value is the raw SKILL.md text, but it's implied by the name and context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented in the schema (e.g., 'name', 'path', 'source', 'max_bytes'). The description does not add additional parameter-specific meaning beyond the general usage note that it operates on inventory. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('load'), the resource ('bounded SKILL.md body'), and the scope ('discovered workspace, user, or plugin skill by name'). It explicitly contrasts with arbitrary path access and references the discovery flow (open_current_workspace/open_workspace + skill_inventory), effectively distinguishing it from sibling tools like 'read' and 'search'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear when-to-use instruction: 'use after open_current_workspace/open_workspace shows skill_inventory.' It also states a constraint ('Does not accept arbitrary paths'), implying the proper flow. However, it doesn't explicitly name which sibling tools are alternatives or when not to use it beyond the path restriction, so it's not a full 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_current_workspaceOpen Current WorkspaceARead-only
Use this once at the start to open the configured default workspace without accepting a path. Do not call open_workspace after this unless switching roots.
| Name | Required | Description | Default |
|---|---|---|---|
| max_depth | No | Tree depth when include_tree=true. Default: 2. | |
| include_tree | No | Include a compact file tree. Default: false for speed. | |
| include_skills | No | Discover workspace, user, and plugin skills by name/description. Default: true. | |
| include_global_skills | No | Also scan installed user/plugin skills when include_skills=true. Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds that it targets the 'configured default workspace' without a path, but does not cover return behavior or side effects. Given annotation coverage, the description carries sufficient but not extra-rich behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero wasted words. The critical usage direction is front-loaded, and the sibling exclusion is clearly stated. Very efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for a simple, parameterless-required tool with annotations covering safety and schema covering all optional parameters. The description covers usage timing and sibling differentiation. A minor gap is that 'configured default workspace' is not elaborated, but that is not essential for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All four parameters have schema descriptions (100% coverage), so the description does not need to explain them. The baseline of 3 applies because the schema fully documents parameters; the description adds no additional parameter context, which is acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the specific action (open the configured default workspace) and explicitly distinguishes it from the sibling `open_workspace` by noting it does not accept a path. This makes the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit timing ('once at the start') and an exclusion ('Do not call open_workspace after this unless switching roots'), directly guiding the agent on when and when not to use it relative to an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_workspaceOpen WorkspaceARead-only
Open a local project directory as a CodexPro workspace. Returns a workspace_id plus git status, AGENTS.md, skills, and a compact file tree.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Alias for root. Useful for clients that naturally send path instead of root. | |
| root | No | Project directory to open. Omit to use CODEXPRO_ROOT/current working directory. Supports ~/ paths. | |
| max_depth | No | Tree depth. Default: 3. | |
| max_files | No | Alias for maximum tree entries. Default: 500. | |
| include_tree | No | Include a compact file tree. Default: true. | |
| include_skills | No | Discover workspace, user, and plugin skills by name/description. Default: true. | |
| bootstrap_context | No | Deprecated and ignored. Use handoff_to_agent to create .ai-bridge files. | |
| include_global_skills | No | Also scan installed user/plugin skills when include_skills=true. Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, signaling a non-mutating operation. The description adds return-value context (workspace_id, git status, skills) but no additional behavioral traits such as authentication needs, rate limits, or potential side effects beyond what annotations already cover. It neither contradicts annotations nor introduces new behavioral caveats.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the action ('Open') and followed by a concise list of return items. It is free of filler, repetition, or unnecessary details, making it immediately scannable and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 8 parameters and no output schema, the description is minimal but adequate: it conveys the core purpose and return data. Parameter details are fully covered by the schema, so the description doesn't need to repeat them. However, it omits any guidance on parameter interactions or defaults, which could be useful for an agent deciding how to invoke the tool. A slightly richer description could mention that omitting root uses the current directory and that several flags control tree and skill inclusion.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All 8 parameters are fully described in the input schema (100% coverage), and the description adds no parameter-specific meaning beyond that. The description simply names the operation; the schema already explains each parameter's purpose, defaults, and constraints. Baseline 3 applies because the schema carries the full semantic load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Open') and a precise resource ('a local project directory as a CodexPro workspace'), and lists the exact return content (workspace_id, git status, AGENTS.md, skills, compact file tree). This clearly distinguishes it from the sibling open_current_workspace, which targets the current directory rather than a specified path.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives. While the sibling open_current_workspace suggests a complementary use case, the description provides no direct comparison, conditions, or when-not-to-use guidance. The intent is only implied by the name and schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
readRead FileARead-only
Read a specific text file with line numbers. Avoid rereading files after write/edit unless exact final content is needed.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | File path relative to workspace root. | |
| end_line | No | Last line to read. Default: end of file. | |
| max_bytes | No | Maximum file bytes. Capped by server config. | |
| start_line | No | First line to read. Default: 1. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds the 'line numbers' output detail and the 'avoid rereading' advice, which provides some context beyond the annotations. However, it does not disclose operational behavior such as pagination, handling of large files, or workspace-specific constraints. With annotations present, the description's additional context is useful but not rich, so 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with zero filler. The core purpose ('Read a specific text file with line numbers') is front-loaded, and the usage guideline follows immediately. Every word adds value, making it an ideal length for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description is complete for a tool of this simplicity. It covers the essential action (read a file), the output feature (line numbers), and a key efficiency guideline. The schema covers parameter details, and annotations cover safety. There is nothing an agent needs to know to invoke this correctly that is missing, especially given the presence of rich sibling context (e.g., read_handoff) which the description implicitly avoids.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters (path, start_line, end_line, max_bytes, workspace_id) are already documented in the schema. The description does not add any further parameter-level semantics, such as edge cases, default behaviors, or relationships between parameters. Baseline 3 is thus correct when the schema carries the full parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Read') and resource ('a specific text file') with an explicit output feature ('with line numbers'). This distinguishes it from sibling tools like search, write, and edit without needing to open the schema. The wording 'specific text file' implies it is not for listing or searching contents, making its purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit when-not-to-use guideline: 'Avoid rereading files after write/edit unless exact final content is needed.' This gives the agent clear conditional logic for when to skip calling read. However, it does not explicitly name alternative tools (e.g., search, tree) or state when to prefer them, so it misses the full 'alternatives' part of the highest bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_handoffRead HandoffARead-only
Read the shared .ai-bridge planning files used for ChatGPT-to-agent coordination.
| Name | Required | Description | Default |
|---|---|---|---|
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations (readOnlyHint, destructiveHint) already disclose that this is a safe read operation. The description adds context about the file type and coordination purpose, which is useful. However, it doesn't disclose the return format or error behavior, but with annotations covering the safety profile, this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, clear sentence that front-loads the key action and resource. There is no redundant wording or filler, making it concise and easily parseable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since there is no output schema, the description should clarify what the agent receives when the tool succeeds. It doesn't mention return format, possible errors, or what happens if files are missing. The parameter is optional and uses a default, which is covered in the schema, but the read operation's output is left ambiguous. This is a moderate gap for a tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameters with a description ('Workspace id from open_workspace. Omit to use default workspace.'), so the tool description adds no additional semantic weight. Baseline 3 is appropriate because the schema already documents the parameter well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('read') and names a distinct resource ('.ai-bridge planning files'), while adding the purpose ('ChatGPT-to-agent coordination'). This clearly differentiates it from the generic 'read' sibling tool by specifying the exact file type and scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys when to use the tool—when reading shared coordination files—but does not explicitly mention alternatives or when not to use it. The context is clear enough for an agent to infer its intended use, though it lacks explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
searchSearch FilesARead-only
Use this for targeted verification or code lookup. Prefer one specific final search instead of repeated broad verification searches.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | Optional glob, for example src/**/*.ts. | |
| path | No | Directory or file relative to workspace root. Default: . | |
| query | Yes | Text or regex to search for. | |
| regex | No | Treat query as a regular expression. Default: false. | |
| max_results | No | Maximum results. Default from config. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. | |
| include_hidden | No | Include hidden files that are not blocked. Default: false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds the 'targeted verification' nuance, implying a read-only investigative use case, but it does not disclose return format, performance characteristics, or any other behavioral details. With annotations covering safety, the added context is modest.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The primary purpose is front-loaded, followed by a direct usage preference. Every word earns its place, making it highly efficient and scannable for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool with 7 well-documented parameters and no output schema, the description adequately covers usage context. It explains the scenario (verification) and an efficiency guideline. While it doesn't describe what the tool searches (files) explicitly, the title and schema imply it, and the description is sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all parameters (query, glob, path, regex, max_results, workspace_id, include_hidden) are already documented. The description does not add parameter-specific meaning beyond what the schema provides. Baseline 3 is appropriate when schema carries the full parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear purpose—'targeted verification or code lookup'—which indicates the tool searches for information. The title 'Search Files' reinforces the resource. However, it does not explicitly say 'searches files for text or regex,' leaving some implicit. It distinguishes itself from siblings by focusing on targeted searches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says when to use it ('targeted verification or code lookup') and provides a strong preference ('Prefer one specific final search instead of repeated broad verification searches'). It does not mention when not to use it or name alternatives, but the guidance is clear and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_configServer ConfigARead-only
Show CodexPro server configuration, safety modes, limits, and blocked paths. Does not reveal auth tokens.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safe read-only nature is known. The description adds concrete behavioral detail: it lists what is shown (safety modes, limits, blocked paths) and explicitly states 'Does not reveal auth tokens,' which supplements the annotations with useful security context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, crisp sentence that front-loads the primary action and resource. It lists the key content categories and the one exclusion, with no filler or redundancy. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only tool with annotations covering its safety profile and no output schema, the description provides all necessary context: what it shows, what it omits, and that it is a non-destructive lookup. An agent can invoke it correctly without further information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the schema coverage is effectively complete (100% of 0 parameters are described). Per the rubric, a 0-parameter tool gets a baseline of 4. The description does not discuss parameters, but none exist, so no additional clarification is required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Show') and resource ('CodexPro server configuration'), and enumerates the content (safety modes, limits, blocked paths). It also clarifies what is intentionally excluded (auth tokens), which makes the tool's scope unmistakable and distinguishes it from generic read tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is given about when to use this tool versus siblings such as `read`, `search`, or `server_config` itself. Context implies it is for configuration lookup, but no alternatives or exclusions are mentioned. The description provides no usage context beyond its own purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
show_changesShow ChangesARead-only
Summarize the current workspace changes in one review-oriented result with git status, diff stats, and optional diff. Use this instead of bash git status, bash git diff, git_status, or git_diff when reviewing work.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Optional file path relative to workspace root. | |
| staged | No | Show staged diff. Default: false. | |
| include_diff | No | Include the unified diff. Default: true. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the agent knows this is a safe read operation. The description adds behavioral context by specifying that it combines git status and diff stats with an optional diff, and that it's 'review-oriented.' However, it doesn't disclose potential edge cases (e.g., empty workspace, invalid path) or any authentication nuances. Given the annotations cover the safety profile, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no fluff. The first sentence states the purpose and content of the result, and the second gives direct usage guidance. The key information is front-loaded, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description explains what the tool returns and when to use it. The schema covers all parameter semantics. It does not mention behavior for edge cases like no changes or when the workspace is not open, but those are minor gaps given the tool's simplicity and the annotations. Overall, it's complete enough for an agent to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for all four parameters, each with a clear description (path, staged, include_diff, workspace_id). The tool description adds no parameter-specific meaning beyond what the schema already provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (summarize) and resource (current workspace changes) with explicit details on what the result contains: git status, diff stats, and optional diff. It also differentiates from alternatives like bash git status and git_diff by naming them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly says 'Use this instead of bash git status, bash git diff, git_status, or git_diff when reviewing work.' This gives clear when-to-use guidance and names the alternatives to avoid, leaving no room for ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
treeFile TreeARead-only
List files and directories inside the workspace, excluding blocked paths.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Directory relative to workspace root. Default: . | |
| max_depth | No | Maximum depth. Default: 4. | |
| max_entries | No | Maximum entries. Default: 800. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. | |
| include_hidden | No | Include dotfiles/dotfolders that are not blocked. Default: false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds the behavioral detail that blocked paths are excluded, which is useful. However, it does not mention output format, pagination, or limits, but these are partially covered by parameter descriptions. This is adequate given the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the primary action ('List files and directories') and adds a meaningful qualifier ('excluding blocked paths'). There is no wasted text; every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with full schema coverage and annotations that specify safety, the description is sufficient. It states the scope and the key constraint. The absence of an output schema is not a concern because the tool's output is obvious from its purpose, and the description already clarifies the scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage of parameter descriptions (each parameter has a description), so the baseline is 3. The tool description itself does not add any parameter-specific meaning beyond what the schema already documents. There is no need for compensation since coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and a clear resource ('files and directories inside the workspace'), and adds the constraint 'excluding blocked paths.' This clearly distinguishes it from siblings like 'read' and 'search' by defining its own scope and purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating what it does, but does not explicitly specify when to use it over alternatives such as 'search' or 'read.' There is no mention of scenarios where it would be preferable or when not to use it, leaving the agent to infer from the tool name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
writeWrite FileBDestructive
Create or overwrite a meaningful text file inside the workspace. Returns a unified diff; do not create empty placeholder files.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | File path relative to workspace root. | |
| content | Yes | Complete file contents to write. | |
| overwrite | No | Allow overwriting existing files. Default: true. | |
| create_dirs | No | Create parent directories if missing. Default: true. | |
| workspace_id | No | Workspace id from open_workspace. Omit to use default workspace. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
destructiveHint: true and readOnlyHint: false already flag the mutation; the description adds value beyond annotations by disclosing that it 'Returns a unified diff' and requiring meaningful content. These details go beyond what structured annotations carry and do not contradict them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with the core action front-loaded and no filler. The tail packs the return format and a usage rule into one compact clause, which is efficient though slightly dense; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a write tool whose safety profile is covered by annotations, but the sibling edit is never addressed and 'unified diff' is left undefined. For a destructive tool with no output schema, it could clarify overwrite defaults and edge behavior more.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema documentation covers 100% of the 5 parameters (path, content, overwrite, create_dirs, workspace_id), so the baseline of 3 applies. The description adds no parameter-level meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create or overwrite a meaningful text file inside the workspace') with clear scope, and the title 'Write File' reinforces it. It clearly implies whole-file creation vs. incremental edits, but stops short of naming the edit sibling explicitly, so it earns a 4 rather than a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Offers one behavioral rule ('do not create empty placeholder files') but gives no guidance on when to use this tool versus the sibling edit (or bash). The alternatives are not named and no conditions for choosing write over edit are provided, leaving the agent to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
15 tool updates
v0.28.5- First observed
bash - First observed
codexpro_self_test - First observed
edit - First observed
export_pro_context - First observed
handoff_to_agent - First observed
load_skill - First observed
open_current_workspace - First observed
open_workspace - First observed
read - First observed
read_handoff - First observed
search - First observed
server_config - First observed
show_changes - First observed
tree - First observed
write
TDQS
Each tool has a distinct purpose: workspace opening, file operations, verification, handoff, and diagnostics. Even similar tools like open_current_workspace/open_workspace and show_changes/bash are clearly differentiated through descriptions.
Mixed naming conventions: some tools use verb_noun (load_skill, show_changes), some are bare verbs (search, read, write, edit), and a few are nouns (tree, bash) or hyphenated identifiers (codexpro_self_test). Although most names are readable, the pattern is not uniform.
15 tools is well-scoped for a coding workspace MCP server. Each tool covers a distinct operation without redundancy, and the count is within the ideal 3-15 range.
The tool surface covers workspace discovery, file read/write/edit, search, verification, change review, and agent handoff. Minor gaps exist (e.g., no explicit file delete or config modification), but core workflows are fully supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Governed app access for AI agents: 1,000+ apps & 12,000+ tools via Code Mode MCP.
Roadmap, tasks, releases and user feedback your coding agent reads and writes over MCP.
Coordinate coding agents through MCP using existing AI plans, saved work, and independent checks.
An MCP server that gives your AI access to the source code and docs of all public github repos
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables ChatGPT to inspect and edit local projects through a secure MCP interface, offering workspace management, file operations, git integration, and safe command execution.4MIT
- AlicenseNot gradedqualityAmaintenanceEnables ChatGPT Web Developer Mode to interact with local repositories through MCP, providing tools for file editing, shell execution, Git worktrees, semantic navigation, and checkpoints.1612MIT
- FlicenseNot gradedqualityBmaintenanceEnables ChatGPT Web to securely access local files and run commands via MCP, with optional OpenCode agent mode for autonomous tasks.-
- AlicenseAqualityBmaintenanceEnables ChatGPT and Codex to safely work with explicitly authorized local project folders through MCP, providing constrained file reading, searching, patch editing, Git inspection, and whitelisted tasks without exposing arbitrary shell, deletion, or deployment capabilities.17MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/sedatustunova/S3dat-Relay'
If you have feedback or need assistance with the MCP directory API, please join our Discord server