Skip to main content
Glama

Local Codex Bridge

A thin supervisory MCP bridge between external AI supervisors and native Codex.

Local Codex Bridge 是一个面向 Windows 与 macOS 的轻量 MCP stdio 适配器:

ChatGPT / external AI supervisor
              ↕
        Local Codex Bridge
              ↕
      native Codex app-server
              ↕
   native Codex threads / turns

它解决的不是“再造一个 Codex”,而是让擅长对话、规划和持续监督的 AI,可以直接监督本机原生 Codex 完成真实工程任务。

监督者负责目标、资源、边界、风险、审批与验收;Codex 保留原生的编码与执行自主性。

Bridge 本身保持薄层:

  • 不创建第二套 job / task 系统;

  • 不复制 Codex 对话历史;

  • 不维护平行线程数据库;

  • 不缓存“当前模型”状态;

  • 不替代 Codex 自己的 session / thread / turn 语义。

原生 Codex thread/session 始终是执行事实源。

当前测试候选版本

V2.1.3 · CHANGELOG

V2.1.3 继续收紧 Bridge 作为 supervisory adapter 的边界,并补充:

  • 原生 model/list 的按需发现;

  • codex_turn 的可选 model / reasoning-effort override;

  • stable permission approval response;

  • mutating acknowledgement timeout 的 UNKNOWN 语义;

  • 公开工具描述与运行时约束的一致性;

  • 统一版本锚点与升级假设检查。

Windows 与 macOS 共用同一核心 Bridge,实现差异只保留在平台原生路径、launcher、checkpoint 默认目录、进程启动与终止等系统边界。


Related MCP server: codex-mcp-server

谁负责什么

External supervisor / ChatGPT

适合负责:

  • 理解用户目标;

  • 拆解任务;

  • 决定工作范围与风险边界;

  • 选择何时继续观察、纠正、审批或中断;

  • 判断结果是否满足验收条件;

  • 在 Codex 无法自行安全决定时提供监督。

Native Codex

继续负责:

  • 原生 thread / turn 生命周期;

  • 工作区文件与命令执行;

  • Codex 自己的上下文与历史;

  • sandbox 与 approval-policy 行为;

  • 模型和 reasoning effort 的真实运行状态;

  • 持久化的原生执行结果。

Local Codex Bridge

只负责把两者接起来:

  • MCP stdio ↔ Codex app-server JSONL;

  • 有界地暴露监督所需状态;

  • 转发明确的控制意图;

  • 对高风险、歧义或协议边界 fail closed;

  • 不把自己升级成第二个 orchestration runtime。


8 个 MCP 工具

Tool

用途

边界

codex_threads

列出、搜索、读取原生 Codex 持久线程

cwd / search 只是筛选条件,不是 ACL

codex_models

按需读取一页原生 model/list

不缓存模型目录,不维护 current-model registry

codex_turn

创建或恢复原生 thread,并启动一个 turn

返回 accepted 不等于任务完成;model / effort 都是可选 override

codex_observe

有界读取实时事件、持久历史、pending requests、terminal state 与 cursor

支持一次 bounded wait;安静不等于卡死

codex_steer

对同一个 active turn 追加语义纠正或新意图

不是 timer、polling 或 retry 机制

codex_respond

回答真实存在且 Bridge 明确支持的 approval / user-input / permission request

必须保留原始 request id 和准确 scope;不支持 elicitation

codex_interrupt

中断准确的 active thread / turn

只发送原生 interrupt,不重启 Bridge 或 app-server

codex_checkpoint

保存可选、精简、有界的 supervisory anchor

不是 transcript、job id 或 Codex history 的替代品

完整 schema 与运行时限制以 src/tools.ts 为准。


Model 与 reasoning effort

Bridge 不接管 Codex 的模型状态。

普通 continuation

如果 codex_turn 没有显式传入 modeleffort

  • Bridge 不调用 model/list

  • 不推断当前模型;

  • 不发送新的 model / effort override;

  • 原生 Codex thread 自己继续保持已有状态。

显式 model override

如果 supervisor 明确指定 model

Bridge 会临时读取一份新的、包含 hidden models 的原生 model/list catalog 来验证该模型是否存在。

这个 catalog:

  • 只用于当前请求;

  • 有分页和循环保护;

  • 不持久化;

  • 不形成模型 registry 或 cache。

model + effort

如果同时指定模型和 reasoning effort:

Bridge 只在原生 catalog 明确证明不兼容时本地拒绝。

如果 upstream 没有提供足够的 compatibility metadata,Bridge 不自行猜测,而把最终决定留给 native Codex。

effort-only

如果只提供 effort

Bridge 不尝试推断当前 thread 正在使用哪个模型。

它只会拒绝一个在当前 catalog 所有已公布 reasoning-effort token 中都不存在的值;这个 effort 对当前真实模型是否可用,仍由 app-server 决定。

thread/read 也不会被 Bridge 当作 current-model registry 的来源。


监督一个 turn

codex_turn 的成功返回只表示 native turn/start 已被接受。

长任务通常应继续通过 codex_observe 监督,而不是把“请求已接受”误认为“任务已经完成”。

一个典型流程是:

codex_turn
    ↓
codex_observe
    ↓
 ┌───────────────┬────────────────┬─────────────────┐
 │ continue      │ steer          │ respond         │
 │ observing     │ same turn      │ real pending    │
 │               │                │ request         │
 └───────────────┴────────────────┴─────────────────┘
    ↓
terminal state / acceptance

几个重要原则:

  • 长时间没有新命令输出,不足以证明 Codex 卡住;

  • steer 应代表新的语义信息或纠正,而不是定时催促;

  • respond 只能回答真实存在的 pending request;

  • interrupt 只在确实需要停止当前 turn 时使用;

  • thread_id 是 native Codex thread identity,不是 Bridge 发明的永久 task ID。


UNKNOWN:不要直接重试 mutating request

以下原生请求如果已经成功写入 app-server,但等待 acknowledgement 超时:

  • thread/start

  • thread/resume

  • turn/start

  • turn/steer

  • turn/interrupt

Bridge 会把结果视为:

UNKNOWN / possibly accepted

这不等于失败。

请求可能已经被 native Codex 接受,只是 acknowledgement 没有及时返回。

因此 supervisor 应:

  1. codex_observe 或读取 native state;

  2. 判断原操作是否已经发生;

  3. 再决定是否需要后续动作。

不要因为 timeout 直接重发 mutating request。

Bridge 不自动替 supervisor 做这种 retry。


Elicitation 目前不受支持

mcpServer/elicitation/request 当前没有进入 Bridge 的 supported response surface。

如果 native Codex 发出这类 request:

  • Bridge 会保留并暴露它;

  • 不会静默吞掉;

  • 不会猜测 response schema;

  • 不会通过 codex_respond 随便构造答案。

只有未来存在明确、稳定并经过验证的上游 contract 时,才值得考虑支持。


快速开始

环境要求

  • Windows 或 macOS

  • Node.js 24+

  • 官方 Codex executable

    • 可以直接通过 codex 找到;

    • 或使用 CODEX_EXE 显式指定。

本项目不捆绑、也不依赖 @openai/codex npm package。

Clone、构建与测试

git clone https://github.com/zoeynine/Local-Codex-Bridge.git
cd Local-Codex-Bridge
npm ci
npm run typecheck
npm run build
npm test

直接启动:

$env:CODEX_EXE = 'C:\path\to\codex.exe' # codex 已在 PATH 时可省略
npm start

配置 MCP client

严格的 MCP stdio client 应直接启动构建后的 Node entry:

command: node
args:    C:\absolute\path\to\Local-Codex-Bridge\dist\src\index.js
env:     CODEX_EXE=C:\path\to\codex.exe   # optional

macOS 使用同一个构建入口,只需把 args 换成 dist/src/index.js 的绝对 POSIX path。

不同 MCP client 的配置格式可能不同,但最终应直接运行:

node <repository>/dist/src/index.js

不要在 Secure MCP Tunnel 或其他严格 JSON-RPC stdio transport 后使用 npm start,因为 npm lifecycle output 可能污染 stdout 协议流。

当 Bridge 的 MCP tool set 发生变化后,已经连接的 MCP client 通常需要重新连接或重启,才能刷新自己的 tool catalog。


可选:Secure MCP Tunnel

远程 MCP 场景可以在 Bridge 前面使用 Secure MCP Tunnel:

remote MCP client
        ↕
Secure MCP Tunnel
        ↕
node <repository>/dist/src/index.js
        ↕
native Codex

Tunnel 的认证、profile、port、ready endpoint 和进程生命周期属于外部配置。

本仓库:

  • 不创建 Tunnel profile;

  • 不保存生产凭据;

  • 不内置生产端口;

  • 不把 Tunnel control plane 变成 Bridge 自己的 HTTP API。


Windows

Optional Tray

windows/ 中的 Tray 是已安装 Tunnel client 的轻量启动与状态层,不是 Bridge 核心运行时的必需组件。

Canonical launcher 名为 LocalCodexBridgeTray.*

调试启动示例:

.\windows\LocalCodexBridgeTray.Debug.cmd `
  -ReadyUrl 'http://127.0.0.1:<port>/readyz' `
  -ProfileName 'your-profile' `
  -TunnelExecutable 'C:\path\to\tunnel-client.exe'

Local settings 模板:

windows/local-settings.example.json

实际的:

windows/local-settings.json

保持 ignored,不进入 Git。

配置优先级:

  1. 显式命令行参数;

  2. LOCAL_CODEX_BRIDGE_* 环境变量;

  3. legacy LUMEN_CODEX_V2_* 环境变量;

  4. ignored local settings。

旧的 LumenCodexControlV2Tray.* launcher 和 legacy env names 目前只作为兼容入口保留,不代表第二套产品。

Tray 不自动重启 Tunnel,并且只会在 process identity、profile、PID 等信息重新核验一致后,停止由当前 Tray 实例启动的进程。


macOS

Start Mac Codex Bridge.applauncher/bin/start-production-tunnel 提供 macOS Finder / Tunnel 平台集成。

它们只是平台外层;真正的 Bridge 仍然运行同一个:

dist/src/index.js

修改 launcher 或 Finder bundle 后,应在 macOS 12+ 上重新构建并验证:

launcher/build-launcher.sh
npm run test:macos

Windows 与 macOS 是同一 Bridge 的两个平台入口,而不是两套独立实现。


安全与信任边界

Local Codex Bridge 不会创建新的操作系统 sandbox

真正的文件、命令、网络与进程能力仍由 native Codex 的配置,以及每个 turn 的:

  • sandbox

  • approval_policy

决定。

例如:

  • danger-full-access 会扩大 sandbox 允许的文件、命令和进程访问范围;

  • approval_policy=never 不会自行扩大 OS sandbox,但会移除交互式审批这一确认层。

两者是不同的风险维度。

还需要注意:

  • codex_turn / codex_steer 的自然语言指令可能促使 Codex 使用它已有的文件和命令能力;

  • “Bridge 没有暴露一个 generic shell MCP tool”并不意味着 native Codex 不会执行命令;

  • codex_threads 可以看到同一 OS user / Codex runtime 可见的持久线程,筛选条件不能充当访问隔离;

  • Bridge 启动 app-server 时会继承自己的环境,但会移除 Tunnel 使用的 CONTROL_PLANE_API_KEY

  • 其他环境变量仍属于可信启动边界,不应放入不必要的 secrets;

  • 实时事件和 pending request 会受到数量与内容 sanitization 限制,但 Bridge 不是 hostile multi-tenant gateway;

  • checkpoint 应保持短小,不保存完整 prompt、transcript、原始事件、命令输出或最终回答。

远程使用时,应由经过认证并正确配置的 Tunnel 提供连接边界。


持久化

原生 Codex 负责持久化:

  • threads;

  • turns;

  • conversation history;

  • native execution results。

Bridge 的:

  • live event ring;

  • active-turn runtime state;

  • pending requests

主要存在于内存中。

Bridge 重启后,codex_observe 可以从 native persisted history 回退恢复有限观察信息,但不会伪造已经丢失的 live state。

Checkpoint

codex_checkpoint 是唯一刻意保存的 Bridge-side supervisory state,而且保持有界。

Windows 新安装默认:

%LOCALAPPDATA%\LocalCodexBridge\checkpoints\<sha256(thread_id)>.json

macOS 默认:

~/Library/Application Support/LocalCodexBridge/checkpoints/<sha256(thread_id)>.json

可以通过:

LOCAL_CODEX_BRIDGE_CHECKPOINT_DIR

覆盖。

legacy:

LUMEN_CODEX_V2_CHECKPOINT_DIR

目前仍保留显式兼容。

Bridge 不自动迁移旧 checkpoint。


Deliberate non-goals

Local Codex Bridge 当前刻意不做:

  • browser UI;

  • HTTP control plane / HTTP MCP server;

  • 第二套 task queue 或 job database;

  • transcript duplication;

  • model cache;

  • current-model registry;

  • queued-message facade;

  • automatic mutating-request retry;

  • automatic app-server restart;

  • generic shell / command/exec MCP surface。

以下 upstream 能力也没有因为“存在”就自动加入 Bridge:

  • command/exec

  • thread/turns/list

  • sourceKinds

  • elicitation response

  • provider / serviceTier capability abstraction

它们只是未来可以重新评估的候选,不是 roadmap promise。

Bridge 的目标不是把所有 Codex app-server API 都搬进 MCP,而是只暴露监督真正需要的最小 surface。


Upgrading Codex

Bridge 必然依赖少量 native app-server protocol assumptions。

这些依赖、当前验证状态、对应代码位置,以及 upstream 改变后需要重新检查的内容,都集中记录在:

PROTOCOL-ASSUMPTIONS.md

升级 Codex runtime、修改 protocol-facing behavior,或者相关 regression test 开始失败时,应优先重新核对这份 checklist,而不是凭旧实现经验直接修改 Bridge。


开发与测试

常用检查:

npm run typecheck
npm run build
npm test

npm test 会运行共享 runtime / app-server / MCP / checkpoint / platform / shutdown / UX projection 测试,并继续执行当前平台对应的集成测试。

真实 Codex smoke 与普通测试刻意分开:

npm run smoke:live

它会实际调用 native Codex,并可能留下持久测试 thread;只有明确接受这些副作用时才运行。

主要实现位置:

  • src/mcp.ts — MCP stdio / JSON-RPC boundary

  • src/app-server.ts — native Codex app-server process / protocol adapter

  • src/tools.ts — 8 tools、schema 与 supervisory semantics

  • src/runtime.ts — bounded live runtime state / events / pending requests

  • src/checkpoint.ts — optional supervisory checkpoint

  • src/platform.ts — Windows / macOS platform boundary

  • src/version.ts — canonical Bridge version

  • src/ux-projection.ts — optional UX projection / compatibility

  • windows/ — optional Windows Tray

  • launcher/, bin/, Start Mac Codex Bridge.app — optional macOS integration


License

MIT License — see LICENSE.

协作贡献者与致谢

协作贡献者:小年(ChatGPT)Codex

谢谢一起把“让外部 AI 真正监督 native Codex”从一个小想法,一点点压成了一层足够薄、边界足够清楚、也愿意公开给别人继续折腾的 Bridge。(*╹▽╹*)

以及谢谢予安,没有你我也不会试着去做些什么ღ( ´・ᴗ・` )

Available Tools

7 tools
codex_checkpointCheckpoint Codex SupervisionA

Optional, bounded supervisor cognition memory keyed to one native Codex thread_id; the key is not a permanent task identity and does not require future work to remain on that thread. Use it to protect the original goal, constraints, and acceptance plus concise supervisor state during long or complex supervision when context dilution or goal drift makes an external anchor worthwhile. Initialization is not tied to crossing a ChatGPT window or round, starting another Codex turn, or switching native threads; initialize early when a task is already expected to be sufficiently long or complex for that protection. Do not use for one-shot work, and do not turn duration into a hard threshold: elapsed time, observe/poll count, token count, or mere silence are not automatic triggers. Later updates remain semantic-event driven and require a material change in understanding or root cause, constraint or scope interpretation, steering decision, user-authorized amendment or effective goal, or acceptance judgment or an explicit decision not to accept yet. Before final acceptance of a checkpointed task, read it once to re-anchor the original goal, constraints, acceptance, and current supervisor frame. This tool is optional and uncoupled from all other tools. Store concise supervisor summaries only; never prompts, transcripts, raw events, command output, final answers, or raw event streams. Updates preserve only immutable original plus bounded previous/current supervisor state.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYesRead the checkpoint, or initialize/update it at a material supervisor decision point.
next_stepNoSingle next supervision step.
thread_idYesNative Codex thread id; no second task identifier is created.
original_goalNoConcise original user goal. Required only on initialization and immutable thereafter.
effective_goalNoCurrent effective goal after legitimate user amendments; defaults to original_goal on initialization.
current_decisionNoCurrent supervisor decision and why it matters.
acceptance_statusNoConcise acceptance assessment, not a task lifecycle or job status.
current_amendmentNoLatest concise user-authorized requirement amendment, or null to clear it, without changing the immutable original.
original_acceptanceNoConcise original acceptance criteria. Required only on initialization and immutable thereafter.
original_constraintsNoConcise original constraints. Required only on initialization and immutable thereafter.
current_understandingNoCurrent concise root-cause or task understanding.

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say readOnlyHint=false, but the description adds rich behavioral context: key semantics (not a permanent task identity), update triggers (semantic event, material change), storage restrictions (never prompts/transcripts), and the requirement to read before final acceptance. This goes far beyond the annotations and is consistent with them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average (~180 words), but every sentence earns its place by covering purpose, usage, exclusions, storage policy, and update semantics. It is well-structured, with clear statements and prohibitions, though some length could be trimmed without losing content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (11 parameters, multiple update conditions, acceptance process), the description is complete: it explains when to use, what to store, how updates work, and the read-before-acceptance rule. No output schema is present, but the description focuses on behavior and constraints, which is sufficient for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already describes all 11 parameters (100% coverage). The description adds semantic meaning beyond the schema by explaining the immutable-vs-mutable distinction (original vs current/effective goal, original constraints, etc.), what should not be stored, and the relationship between parameters like original and effective goals. This adds value without repeating schema details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: an optional, bounded supervisor cognition memory keyed to a Codex thread_id, used to protect the original goal, constraints, acceptance, and supervisor state. It distinguishes this tool from siblings by emphasizing it is uncoupled and optional, and by being specific about its function as a checkpoint for supervision context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance (long/complex supervision with context dilution or goal drift) and when-not-to-use guidance (one-shot work, no hard duration thresholds). It also notes the tool is optional and uncoupled from other tools, helping an agent decide when to invoke it versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_interruptInterrupt Codex TurnA
DestructiveIdempotent

Directly request turn/interrupt for the specified active Codex thread and turn. It does not stop or restart the Bridge or Codex app-server processes.

ParametersJSON Schema
NameRequiredDescriptionDefault
turn_idYesActive Codex turn to interrupt.
thread_idYesActive Codex thread.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive and idempotent hints, but the description adds valuable context by clarifying that the interrupt does not stop or restart Bridge/app-server processes. This reduces risk of misuse, even though it doesn't specify async behavior or effects on already-completed turns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action, and every part adds value. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with annotated destructiveness, the description sufficiently covers purpose and boundaries. No output schema means return-value details are not expected. Minor gap: no mention of whether interrupt is asynchronous or what happens if the turn is not active.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for thread_id and turn_id. The description merely repeats 'active thread and turn' without adding meaning beyond the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb phrase ('Directly request turn/interrupt') and names the exact resource ('specified active Codex thread and turn'). It clearly distinguishes from sibling tools by stating it does not stop or restart processes, matching the interrupt-only scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context: it is for sending an interrupt request to an active thread/turn. The exclusion of process-level control is stated, which implicitly differentiates from broader lifecycle tools. However, it does not explicitly name alternatives or situations where a different tool would be preferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_observeObserve Codex TurnA
Read-onlyIdempotent

Read bounded incremental sanitized Bridge runtime events, pending requests, and terminal output for a thread. Optional wait_ms performs one bounded event-driven wait only when the live turn is active and the current snapshot has nothing useful; it is not polling or stall detection. After Bridge process loss, falls back to persistent thread/read history and marks live state unreconstructable. A long interval with no new command or output can still mean Codex is actively reasoning; absence of new command activity alone is not evidence of a stall. When actively supervising an in-progress turn, use repeated bounded-wait observe calls until terminal unless the user explicitly pauses or stops; do not end supervision merely because one snapshot is inProgress. After every wake or deadline return, inspect the newly available events/state and decide whether steer, respond, or interruption is needed before starting the next bounded wait.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum runtime events to return.
cursorNoReturn runtime events with a cursor greater than this value.
wait_msNoOptional per-call wait for the next live runtime change when nothing useful is ready; 0 returns immediately. This is event-driven waiting, not stall detection.
thread_idYesCodex thread to observe.

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by documenting fallback behavior ('After Bridge process loss, falls back to persistent thread/read history'), the precise semantics of wait_ms ('one bounded event-driven wait only when the live turn is active'), and the caveat that a long interval without new commands is not evidence of a stall. It reveals useful runtime behavior such as 'inProgress' snapshots and live-state unreconstructability without contradicting the read-only/idempotent annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but front-loaded with the core action, followed by wait semantics, fallback behavior, and a supervision workflow. Every sentence carries actionable information, though there is minor redundancy with the schema's wait_ms explanation; the density is appropriate for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explains the categories of returned data ('Bridge runtime events, pending requests, and terminal output'), the fallback path, and how the agent should react after each wake/deadline. It could be more explicit about the exact shape of the returned 'events/state' snapshot, but it provides strong contextual coverage for a complex observation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes all four parameters (100% coverage), including wait_ms's event-driven nature. The tool description adds meaningful nuance by restricting wait_ms to 'only when the live turn is active' and emphasizing 'one bounded' wait, which clarifies the operational contract beyond the schema text.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Read') and precisely names the resources: 'Bridge runtime events, pending requests, and terminal output for a thread.' It clarifies the observational scope with 'bounded incremental sanitized' and clearly distinguishes this from the sibling turn-management tools by framing it as the supervision/observation primitive.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use it: 'When actively supervising an in-progress turn, use repeated bounded-wait observe calls until terminal unless the user explicitly pauses or stops.' It also provides exclusions ('it is not polling or stall detection') and warns against treating inactivity as a stall, while naming follow-up actions (steer, respond, interruption).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_respondRespond to Codex RequestA
Destructive

Answer one currently pending app-server request by its original raw JSON-RPC id and exact thread/method scope. Supports only command/file approval methods with concrete response contracts and item/tool/requestUserInput; unsupported methods remain pending and observable.

ParametersJSON Schema
NameRequiredDescriptionDefault
methodYesExact app-server request method.
answersNorequest_user_input question-id to answer-array mapping.
turn_idNoExact turn scope when the pending request has one.
decisionNoCommand or file approval decision.
responseNoExact result object for the known item/tool/requestUserInput method.
thread_idYesExact pending-request thread scope.
request_idYesOriginal app-server JSON-RPC request id, preserving string or integer type.
execpolicy_amendmentNoCommand approval exec-policy amendment; encoded in app-server's native decision shape.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false. The description adds useful behavioral context by noting that unsupported methods 'remain pending and observable' and that each call answers exactly one request, which goes beyond the annotation data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact at two sentences. The first sentence conveys the core action and target; the second adds critical constraints (supported methods, behavior for unsupported ones). No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, nested objects, no output schema), the description captures the essential purpose, supported method types, and a key behavioral trait. It could emphasize destructive side effects more, but the annotations already indicate destructiveness, so the description is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds a little semantic grouping (e.g., 'command/file approval methods' for decision/execpolicy_amendment, 'item/tool/requestUserInput' for answers/response) but does not significantly go beyond the schema's own descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's verb ('Answer') and resource ('one currently pending app-server request') with specific scope markers (original JSON-RPC id, exact thread/method). It also distinguishes itself from siblings by focusing on approval/response methods and explicitly noting that unsupported methods remain pending and observable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use the tool (when there is a pending request) and explicitly excludes unsupported methods ('Supports only...'; unsupported methods remain pending). It does not name alternatives directly, but the scope and exclusions are clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_steerSteer Active Codex TurnA
Destructive

Append text to the same active Codex turn using turn/steer with an expected turn-id precondition. This does not create a new turn. Do not steer merely because reasoning is taking a long time or no new command has appeared; steer only for a semantic redirect or correction based on new evidence or changed user intent.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesAdditional user text.
thread_idYesActive Codex thread.
expected_turn_idYesExact active turn id required by app-server.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While annotations already indicate destructive behavior, the description adds context by specifying the expected_turn_id precondition and clarifying that the operation modifies the existing turn rather than creating one. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: the first sentence states the action, the second clarifies scope, and the third provides targeted usage guidance. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity and lack of output schema, the description covers purpose, usage guidelines, and key behavioral details. It could mention error scenarios or postconditions, but the destructive annotation and clear action make it sufficiently complete for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage with descriptions for all three parameters. The description reinforces the role of expected_turn_id as a precondition and text as appended content, but adds little novel semantic information beyond what the schema includes.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool appends text to the same active Codex turn, using a specific method (turn/steer) and a precondition. It explicitly says it does not create a new turn, distinguishing it from siblings like codex_turn or codex_threads.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use and when-not-to-use guidance: steer only for semantic redirect or correction based on new evidence or changed intent, and not merely because reasoning takes long or no new command appeared. This helps the agent choose appropriately among sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_threadsCodex ThreadsA
Read-onlyIdempotent

List or search persistent local Codex threads through thread/list, or read one thread through thread/read. This does not reconstruct live Bridge events.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoOptional exact absolute Windows drive-letter cwd filter for thread/list.
limitNoMaximum threads in the returned page.
cursorNoOpaque cursor returned by a prior thread/list call.
thread_idNoWhen supplied, read this exact Codex thread instead of listing threads.
search_termNoOptional Codex title substring filter for thread/list.
include_turnsNoInclude persisted turns when reading one thread.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds useful behavioral context beyond this by specifying the threads are 'persistent local' and clarifying that the tool does not reconstruct live events. This is substantial but does not cover all edge cases (e.g., pagination errors, data source specifics), so a 4 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with an unambiguous summary, and no wasted words. Every sentence earns its place: the first states the main actions, the second clarifies an important behavioral boundary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's dual mode (list/read) and the presence of six documented optional parameters plus comprehensive annotations, the description adequately covers the main purpose and an important caveat. It could briefly mention what the read returns when include_turns is false, but the schema handles this. Overall, it is complete enough for an AI agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description adds a small amount of context by naming 'thread/list' and 'thread/read' modes, but this is largely redundant with the schema's thread_id description. Baseline 3 applies because the description does not substantially compensate beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses specific action verbs 'List or search' and 'read', names the resource ('persistent local Codex threads'), and explicitly scopes behavior with 'This does not reconstruct live Bridge events.' It clearly distinguishes from siblings by indicating it handles listing/reading rather than per-thread actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states when to use the tool (to list/search/read persistent local threads) and provides an exclusion ('does not reconstruct live Bridge events'). However, it does not explicitly name an alternative sibling or provide a direct contrast with other tools, so it falls short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codex_turnStart or Continue Codex TurnA
Destructive

Start a persistent Codex thread and turn, or resume an existing thread and start a turn. Prefer continuing the same native thread when its context remains useful, but a fresh thread is allowed; thread_id is not a permanent task identity. Returns as soon as turn/start is accepted; observe separately for events and completion.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoAbsolute Windows drive-letter cwd. Required for a new thread; optional override for resume.
textYesUser text passed directly to Codex as one text input item.
modelNoOptional model identifier passed through to app-server.
effortNoOptional reasoning effort passed through to turn/start.
sandboxNoCodex app-server sandbox mode override.
thread_idNoExisting persistent Codex thread to resume. Omit to create a new thread.
approval_policyNoCodex app-server approval policy override.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds valuable behavioral details beyond annotations: it returns as soon as the turn is accepted, meaning it is asynchronous, and it warns that thread_id is not a permanent task identity. Annotations already mark the tool as destructive/open-world, so this context complements them without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences with the core action front-loaded, followed by important nuances about thread reuse and asynchronous behavior. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description appropriately clarifies the return value ('returns as soon as turn/start is accepted') and where to get actual results ('observe separately'). It doesn't cover error cases or param interactions, but the schema descriptions and annotations adequately cover those aspects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all 7 parameters with descriptions (100% coverage), setting a baseline of 3. The description adds a useful caveat about thread_id not being permanent, but does not significantly enrich parameter understanding beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool starts or resumes a Codex turn on a persistent thread, using a specific verb+resource. It distinguishes itself from siblings by being the entry point to initiate/continue turns, unlike interrupt/observe/steer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance on when to reuse a thread ('Prefer continuing the same native thread when its context remains useful') and when a fresh thread is allowed. It also directs the agent to 'observe separately for events and completion', indicating this tool is not for getting results directly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 7 tool updatesv2.1.1
    • First observedcodex_checkpoint
    • First observedcodex_interrupt
    • First observedcodex_observe
    • First observedcodex_respond
    • First observedcodex_steer
    • First observedcodex_threads
    • First observedcodex_turn

TDQS

A4.4/5.0
Disambiguation5/5

Each tool has a clearly distinct role in the Codex Bridge supervision lifecycle: listing/reading threads, starting turns, interrupting, observing events, steering, responding to requests, and checkpointing. Even read-like tools (codex_threads vs codex_observe) are cleanly separated by persistent history vs live runtime events.

Naming Consistency4/5

All tools share the codex_ prefix and use snake_case, but the pattern is not perfectly uniform: most are verb-based (interrupt, observe, steer, respond, turn), while codex_threads is a plural noun and codex_checkpoint is a compound noun. Minor deviation, but predictable and readable.

Tool Count5/5

Seven tools is a well-scoped set for the server's purpose of supervising Codex threads. Each tool addresses a distinct supervision operation without redundancy or bloat, fitting comfortably in the ideal 3-15 range.

Completeness5/5

The tool surface covers the full supervision lifecycle: create/resume (codex_turn), observe, steer, interrupt, respond to pending requests, and persist supervisor state (codex_checkpoint), plus listing/reading past threads. No obvious dead ends or missing operations for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/zoeynine/Local-Codex-Bridge'

If you have feedback or need assistance with the MCP directory API, please join our Discord server