Skip to main content
Glama

codex_request_async

Destructive

Submit an OpenAI Codex CLI request as a durable background job, then poll its status and collect the result asynchronously.

Instructions

Start an OpenAI Codex CLI request as a durable background job. Poll with llm_job_status, collect with llm_job_result.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
ossNoCodex --oss: use the open-source provider. New sessions only.
colorNoCodex --color: output color mode (always|never|auto). New sessions only.
modelNoModel name or alias (e.g. gpt-5.5, gpt-5.4, latest)
addDirNoCodex --add-dir <DIR>: additional writable workspace directories (repeat per entry). Emitted once per entry on new sessions only: the flag is filtered from resume argv. That does NOT pin a resumed session's writable-dir policy; do not rely on it. Stdio/local callers may pass local paths directly. Remote HTTP/OAuth callers must use relative paths inside a selected registered workspace. Do not call workspace_* tools to fix stdio/local provider path access.
enableNoCodex --enable <FEATURE> (repeatable): enable a feature for this run (equivalent to -c features.<name>=true). Accepted on resume. Local callers only, remote HTTP/OAuth requests are rejected.
imagesNoCodex -i <path>: image attachments.
promptNoPrompt text for Codex (mutually exclusive with promptParts)
searchNoDEPRECATED compatibility input: accepted but ignored because current Codex exec no longer accepts --search.
disableNoCodex --disable <FEATURE> (repeatable): disable a feature for this run (equivalent to -c features.<name>=false). Accepted on resume. Local callers only, remote HTTP/OAuth requests are rejected.
profileNoCodex --profile <name>.
fullAutoNoDEPRECATED: prefer `sandboxMode`. Expands to `--sandbox workspace-write`; current Codex no longer accepts approval-policy flags.
worktreeNoSlice λ: run this request inside a dedicated git worktree owned by the gateway. `true` creates a fresh worktree at `<repoRoot>/.worktrees/<uuid>` branched from HEAD. `{ name?, ref? }` lets the caller supply a sanitized name and/or a git ref (default: HEAD). When the request carries a sessionId and the session already has a worktree, reuse requires same-host ownership metadata and a matching live Git registration. Named path collisions never reuse manager state. Gateway-managed worktrees require the local file-backed session manager and fail closed with PostgreSQL sessions. The Grok, Devin, and Mistral adapters require an explicit provider-native sessionId; fresh, createNewSession, and resumeLatest-only worktree requests fail closed because they cannot durably reselect the worktree. The request must select a registered workspace explicitly, through caller-owned session metadata, or through the configured default. Worktrees never fall back to the gateway process cwd and cannot be combined with local workingDir, addDir, or includeDirs paths. The gateway spawns the child CLI with `cwd: <worktree-path>`; no `-w`/`--worktree` flag is ever emitted to the underlying CLI. On worktree materialization, the gateway suppresses repository, system, and global Git hooks and configured clean, smudge, and process checkout filters, sparse checkout, and lazy object fetching. Filter-dependent content such as Git LFS remains in its repository representation instead of executing host commands. On session_delete or TTL eviction the gateway hides the session and runs `git worktree remove --force`. Failed removal retains a durable cleanup-pending tombstone which blocks reuse and is retried when the file store is registered on the owning host. The tombstone is finalized only after verified Git removal. Successful responses are prefixed with `[gateway] worktree=<absolute-path>\n` so callers can use the path. For Claude approvalStrategy:mcp_managed, requesting or reusing a worktree requires approval and LLM_GATEWAY_APPROVAL_ALLOW_BYPASS=1. Other adapters reject mcp_managed before launch. NOTE: callers should `.gitignore` the `.worktrees/` directory in their repo (the gateway does NOT auto-gitignore; see slice λ spec Q4).
ephemeralNoCodex --ephemeral.
sessionIdNoCodex session UUID to resume via `codex exec resume <ID>`. Must be a real Codex session ID (from `~/.codex/sessions/` or the `codex resume` picker). Gateway-generated `gw-*` IDs are rejected. For a brand-new session no resumable sessionId is returned; continue with resumeLatest:true or a real Codex UUID.
workspaceNoRegistered workspace alias for remote HTTP/OAuth provider calls. Do not use this field, workspace_list, or workspace_register_existing_repo as a fallback for stdio/local provider path access; pass workingDir/addDir/includeDirs directly instead.
mcpServersNoThis provider does not receive gateway-managed MCP configuration. mcpServers has no effect with legacy, and mcp_managed is rejected before launch because ambient MCP configuration cannot be isolated.
workingDirNoCodex -C/--cd <DIR>: working root for this session. New sessions only: the flag is filtered from resume argv. That does NOT pin a resumed session's directory, because the child is still spawned with the gateway-resolved cwd; do not rely on it. Personal Agent Config Kit mode requires an absolute path. Stdio/local callers may pass local paths directly. Remote HTTP/OAuth callers must use relative paths inside a selected registered workspace. Do not call workspace_* tools to fix stdio/local provider path access.
ignoreRulesNoCodex --ignore-rules.
promptPartsNoCache-aware structured prompt: { system?, tools?, context?, task }. Mutually exclusive with prompt. Stable parts hash into cache_state for prefix-discipline tracking.
sandboxModeNoCodex --sandbox. NEW SESSIONS ONLY: the gateway filters --sandbox out of a resume argv, so this field has no effect on a resumed request. That is NOT a guarantee that the resumed session keeps its original posture: configOverrides still passes through and can set sandbox_mode, and Codex re-resolves configuration on a cold resume. Establish the posture on the first request and verify it when it matters. On a new session, omitting it does NOT guarantee read-only: the gateway emits no --sandbox flag and Codex resolves the policy from configuration, project trust, and its own fallback, so a trusted project can resolve to workspace-write. Pass read-only explicitly for inspection. Pass workspace-write to let Codex edit files in the working dir, or danger-full-access for unrestricted access.
forceRefreshNoBypass dedup and force a fresh CLI run even if a recent identical request exists
outputFormatNoCodex caller-facing output format. Token/cache usage is recorded in the flight recorder regardless. `text` (default) returns the plain reply; `json` returns the raw `--json` JSONL event stream.
outputSchemaNoCodex --output-schema. Pass a path (string) or an inline JSON Schema object.
resumeLatestNoResume a previous Codex session via `codex exec resume --last`. UNDER REVIEW: do not rely on which session this selects or on the resumed working directory. `--last` is filtered by cwd upstream unless `--all` is passed, which the gateway does not emit, and the child is still spawned with the gateway-resolved cwd even though `-C`/`--add-dir` are dropped from the resume argv. Verify the target, or start a fresh session when it must be certain. Ignored if sessionId is set; an explicit real Codex UUID targets that session. A brand-new session returns no resumable sessionId; continue with resumeLatest:true or a real Codex UUID.
strictConfigNoCodex --strict-config: error out when config.toml contains fields not recognized by this Codex version. New sessions only.
correlationIdNoRequest trace ID (auto if omitted)
idleTimeoutMsNoIdle timeout in ms (min 30s, max 1h, omit=CLI default)
localProviderNoCodex --local-provider: local OSS provider (lmstudio|ollama), used with oss. New sessions only.
providerFlagsNoFlags passed to the provider binary verbatim, keyed exactly as the binary spells them (e.g. {"--best-of-n": "3", "--verbatim": true, "--rules": ["a", "b"]}). Use this for any flag your installed CLI accepts that this schema does not name: the binary decides what it supports, not the gateway. true emits the flag alone; a list REPEATS the flag once per item (pass a joined string if your CLI wants a comma-separated value). Values may not start with '-', and a flag the gateway is already emitting for this request is refused rather than duplicated. LOCAL stdio callers only: remote HTTP/OAuth callers are refused every flag here and should use this tool's declared parameters, which carry their own host-path and approval gates.
approvalPolicyNoapprovalPolicy is unavailable for this provider. It has no effect with legacy, and mcp_managed is rejected before launch because ambient MCP configuration cannot be isolated.
askForApprovalNoDEPRECATED compatibility input: accepted but ignored because current Codex no longer accepts --ask-for-approval.
optimizePromptNoOptimize prompt before execution
configOverridesNoCodex -c key=value overrides. Keys: /^[a-zA-Z0-9._]+$/. Values: no CR/LF. Local callers only, remote HTTP/OAuth requests are rejected.
approvalStrategyNoApproval strategy: legacy is supported. mcp_managed is rejected before launch because this adapter cannot isolate ambient MCP configuration.legacy
compressResponseNoCompress the response display text when collected via llm_job_result (native compressor; default: [compression].enabled).
createNewSessionNoForce a fresh session (no resume)
ignoreUserConfigNoCodex --ignore-user-config.
outputLastMessageNoCodex -o/--output-last-message <FILE>: write the agent's last message to a file. New sessions only.
requestInstructionsNoPer-request Kit instructions. Available only when [personal_config].enabled = true.
useLegacyFullAutoFlagNoDEPRECATED compatibility input: accepted but ignored because current Codex no longer accepts --full-auto.
dangerouslyBypassHookTrustNoCodex --dangerously-bypass-hook-trust: run enabled hooks without persisted hook trust for this invocation. DANGEROUS.
dangerouslyBypassApprovalsAndSandboxNoRun Codex without approvals/sandbox.

Schema Changelog

Changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. Addedv3.2.0
  2. Removedv3.0.0
  3. First observedv2.16.0

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry the safety profile (destructiveHint=true, readOnlyHint=false, idempotentHint=false), so the description only needs to add context beyond that. It adds the 'durable' background-job semantics and the poll/collect lifecycle, but says nothing about the immediate return payload, subprocess side effects, cost, or approval gates — meaningful but thin for a tool that launches an external CLI.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, action first, with zero filler: the first states what the tool does and the second provides the follow-up protocol. For a tool whose 42 parameters are each thoroughly documented in the schema, this is appropriately sized and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, open-world, async tool with no output schema, the description omits what the start call returns (job ID/receipt) and never frames the sync-versus-async decision. The schema and annotations carry most of the invocation correctness burden, but the tool-level description leaves the request lifecycle only partially specified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline 3 applies and the tool description correctly adds no parameter-level detail. The schema's per-parameter prose is exceptionally rich (sandboxMode resume caveats, worktree ownership and tombstone rules, providerFlags refusal for remote callers), but that documentation lives in the schema, not in the tool description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description pairs a specific verb and resource — 'Start an OpenAI Codex CLI request' — with a clear operating mode, 'durable background job,' which implicitly separates it from the synchronous codex_request sibling. However, it never explicitly names that sibling or the other async provider variants, so differentiation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete post-invocation workflow guidance ('Poll with llm_job_status, collect with llm_job_result'), which is genuinely useful. But it gives no when-to-use versus the synchronous codex_request, no when-not-to-use, and no criteria for choosing among the eight async provider variants; selection guidance is largely implied by the word 'durable.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/verivus-oss/llm-cli-gateway'

If you have feedback or need assistance with the MCP directory API, please join our Discord server