Local Codex Bridge
Local Codex Bridge is a thin MCP control layer that lets ChatGPT (or other MCP clients) supervise and interact with native Codex sessions on Windows. It provides focused control primitives without replicating Codex's task system.
Manage Threads (
codex_threads): List, search, or read persistent Codex threads, optionally filtering by working directory or title, and include turns.Start/Continue Turns (
codex_turn): Create new threads or resume existing ones to start a turn, with options for sandbox mode, approval policy, model, and effort. Returns immediately; monitoring is separate.Observe Progress (
codex_observe): Read real-time events, pending requests, and terminal output, with bounded, incremental reads and optional event-driven waiting (up to 10s). Falls back to history after Bridge restarts.Steer Active Turns (
codex_steer): Append corrections or new intent to a running turn without starting a new one; requires a valid turn-id.Respond to Requests (
codex_respond): Answer pending approvals, user input prompts, or other elicitation requests using exact request IDs from the app-server.Interrupt Turns (
codex_interrupt): Stop an active turn directly without affecting the Bridge or app-server.Checkpoint Supervision (
codex_checkpoint): Save and update concise supervisor anchors (goal, constraints, acceptance criteria, current understanding, decisions) to prevent goal drift during long tasks.
Provides tools to control native Codex sessions, enabling MCP clients to create and resume threads, observe real-time events, steer active turns, respond to approval requests, interrupt execution, and save bounded supervision checkpoints for long-running development tasks.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Local Codex BridgeStart a new Codex thread in C:\projects\myapp to fix the failing tests."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Local Codex Bridge
A thin supervisory MCP bridge between external AI supervisors and native Codex.
Local Codex Bridge 是一个面向 Windows 与 macOS 的轻量 MCP stdio 适配器:
ChatGPT / external AI supervisor
↕
Local Codex Bridge
↕
native Codex app-server
↕
native Codex threads / turns它解决的不是“再造一个 Codex”,而是让擅长对话、规划和持续监督的 AI,可以直接监督本机原生 Codex 完成真实工程任务。
监督者负责目标、资源、边界、风险、审批与验收;Codex 保留原生的编码与执行自主性。
Bridge 本身保持薄层:
不创建第二套 job / task 系统;
不复制 Codex 对话历史;
不维护平行线程数据库;
不缓存“当前模型”状态;
不替代 Codex 自己的 session / thread / turn 语义。
原生 Codex thread/session 始终是执行事实源。
当前测试候选版本
V2.1.3 · CHANGELOG
V2.1.3 继续收紧 Bridge 作为 supervisory adapter 的边界,并补充:
原生
model/list的按需发现;codex_turn的可选 model / reasoning-effort override;stable permission approval response;
mutating acknowledgement timeout 的 UNKNOWN 语义;
公开工具描述与运行时约束的一致性;
统一版本锚点与升级假设检查。
Windows 与 macOS 共用同一核心 Bridge,实现差异只保留在平台原生路径、launcher、checkpoint 默认目录、进程启动与终止等系统边界。
Related MCP server: codex-mcp-server
谁负责什么
External supervisor / ChatGPT
适合负责:
理解用户目标;
拆解任务;
决定工作范围与风险边界;
选择何时继续观察、纠正、审批或中断;
判断结果是否满足验收条件;
在 Codex 无法自行安全决定时提供监督。
Native Codex
继续负责:
原生 thread / turn 生命周期;
工作区文件与命令执行;
Codex 自己的上下文与历史;
sandbox 与 approval-policy 行为;
模型和 reasoning effort 的真实运行状态;
持久化的原生执行结果。
Local Codex Bridge
只负责把两者接起来:
MCP stdio ↔ Codex app-server JSONL;
有界地暴露监督所需状态;
转发明确的控制意图;
对高风险、歧义或协议边界 fail closed;
不把自己升级成第二个 orchestration runtime。
8 个 MCP 工具
Tool | 用途 | 边界 |
| 列出、搜索、读取原生 Codex 持久线程 |
|
| 按需读取一页原生 | 不缓存模型目录,不维护 current-model registry |
| 创建或恢复原生 thread,并启动一个 turn | 返回 accepted 不等于任务完成;model / effort 都是可选 override |
| 有界读取实时事件、持久历史、pending requests、terminal state 与 cursor | 支持一次 bounded wait;安静不等于卡死 |
| 对同一个 active turn 追加语义纠正或新意图 | 不是 timer、polling 或 retry 机制 |
| 回答真实存在且 Bridge 明确支持的 approval / user-input / permission request | 必须保留原始 request id 和准确 scope;不支持 elicitation |
| 中断准确的 active thread / turn | 只发送原生 interrupt,不重启 Bridge 或 app-server |
| 保存可选、精简、有界的 supervisory anchor | 不是 transcript、job id 或 Codex history 的替代品 |
完整 schema 与运行时限制以 src/tools.ts 为准。
Model 与 reasoning effort
Bridge 不接管 Codex 的模型状态。
普通 continuation
如果 codex_turn 没有显式传入 model 或 effort:
Bridge 不调用
model/list;不推断当前模型;
不发送新的 model / effort override;
原生 Codex thread 自己继续保持已有状态。
显式 model override
如果 supervisor 明确指定 model:
Bridge 会临时读取一份新的、包含 hidden models 的原生 model/list catalog 来验证该模型是否存在。
这个 catalog:
只用于当前请求;
有分页和循环保护;
不持久化;
不形成模型 registry 或 cache。
model + effort
如果同时指定模型和 reasoning effort:
Bridge 只在原生 catalog 明确证明不兼容时本地拒绝。
如果 upstream 没有提供足够的 compatibility metadata,Bridge 不自行猜测,而把最终决定留给 native Codex。
effort-only
如果只提供 effort:
Bridge 不尝试推断当前 thread 正在使用哪个模型。
它只会拒绝一个在当前 catalog 所有已公布 reasoning-effort token 中都不存在的值;这个 effort 对当前真实模型是否可用,仍由 app-server 决定。
thread/read 也不会被 Bridge 当作 current-model registry 的来源。
监督一个 turn
codex_turn 的成功返回只表示 native turn/start 已被接受。
长任务通常应继续通过 codex_observe 监督,而不是把“请求已接受”误认为“任务已经完成”。
一个典型流程是:
codex_turn
↓
codex_observe
↓
┌───────────────┬────────────────┬─────────────────┐
│ continue │ steer │ respond │
│ observing │ same turn │ real pending │
│ │ │ request │
└───────────────┴────────────────┴─────────────────┘
↓
terminal state / acceptance几个重要原则:
长时间没有新命令输出,不足以证明 Codex 卡住;
steer 应代表新的语义信息或纠正,而不是定时催促;
respond 只能回答真实存在的 pending request;
interrupt 只在确实需要停止当前 turn 时使用;
thread_id是 native Codex thread identity,不是 Bridge 发明的永久 task ID。
UNKNOWN:不要直接重试 mutating request
以下原生请求如果已经成功写入 app-server,但等待 acknowledgement 超时:
thread/startthread/resumeturn/startturn/steerturn/interrupt
Bridge 会把结果视为:
UNKNOWN / possibly accepted
这不等于失败。
请求可能已经被 native Codex 接受,只是 acknowledgement 没有及时返回。
因此 supervisor 应:
先
codex_observe或读取 native state;判断原操作是否已经发生;
再决定是否需要后续动作。
不要因为 timeout 直接重发 mutating request。
Bridge 不自动替 supervisor 做这种 retry。
Elicitation 目前不受支持
mcpServer/elicitation/request 当前没有进入 Bridge 的 supported response surface。
如果 native Codex 发出这类 request:
Bridge 会保留并暴露它;
不会静默吞掉;
不会猜测 response schema;
不会通过
codex_respond随便构造答案。
只有未来存在明确、稳定并经过验证的上游 contract 时,才值得考虑支持。
快速开始
环境要求
Windows 或 macOS
Node.js 24+
官方 Codex executable
可以直接通过
codex找到;或使用
CODEX_EXE显式指定。
本项目不捆绑、也不依赖 @openai/codex npm package。
Clone、构建与测试
git clone https://github.com/zoeynine/Local-Codex-Bridge.git
cd Local-Codex-Bridge
npm ci
npm run typecheck
npm run build
npm test直接启动:
$env:CODEX_EXE = 'C:\path\to\codex.exe' # codex 已在 PATH 时可省略
npm start配置 MCP client
严格的 MCP stdio client 应直接启动构建后的 Node entry:
command: node
args: C:\absolute\path\to\Local-Codex-Bridge\dist\src\index.js
env: CODEX_EXE=C:\path\to\codex.exe # optionalmacOS 使用同一个构建入口,只需把 args 换成 dist/src/index.js 的绝对 POSIX path。
不同 MCP client 的配置格式可能不同,但最终应直接运行:
node <repository>/dist/src/index.js不要在 Secure MCP Tunnel 或其他严格 JSON-RPC stdio transport 后使用 npm start,因为 npm lifecycle output 可能污染 stdout 协议流。
当 Bridge 的 MCP tool set 发生变化后,已经连接的 MCP client 通常需要重新连接或重启,才能刷新自己的 tool catalog。
可选:Secure MCP Tunnel
远程 MCP 场景可以在 Bridge 前面使用 Secure MCP Tunnel:
remote MCP client
↕
Secure MCP Tunnel
↕
node <repository>/dist/src/index.js
↕
native CodexTunnel 的认证、profile、port、ready endpoint 和进程生命周期属于外部配置。
本仓库:
不创建 Tunnel profile;
不保存生产凭据;
不内置生产端口;
不把 Tunnel control plane 变成 Bridge 自己的 HTTP API。
Windows
Optional Tray
windows/ 中的 Tray 是已安装 Tunnel client 的轻量启动与状态层,不是 Bridge 核心运行时的必需组件。
Canonical launcher 名为 LocalCodexBridgeTray.*。
调试启动示例:
.\windows\LocalCodexBridgeTray.Debug.cmd `
-ReadyUrl 'http://127.0.0.1:<port>/readyz' `
-ProfileName 'your-profile' `
-TunnelExecutable 'C:\path\to\tunnel-client.exe'Local settings 模板:
windows/local-settings.example.json
实际的:
windows/local-settings.json保持 ignored,不进入 Git。
配置优先级:
显式命令行参数;
LOCAL_CODEX_BRIDGE_*环境变量;legacy
LUMEN_CODEX_V2_*环境变量;ignored local settings。
旧的 LumenCodexControlV2Tray.* launcher 和 legacy env names 目前只作为兼容入口保留,不代表第二套产品。
Tray 不自动重启 Tunnel,并且只会在 process identity、profile、PID 等信息重新核验一致后,停止由当前 Tray 实例启动的进程。
macOS
Start Mac Codex Bridge.app、launcher/ 与 bin/start-production-tunnel 提供 macOS Finder / Tunnel 平台集成。
它们只是平台外层;真正的 Bridge 仍然运行同一个:
dist/src/index.js修改 launcher 或 Finder bundle 后,应在 macOS 12+ 上重新构建并验证:
launcher/build-launcher.sh
npm run test:macosWindows 与 macOS 是同一 Bridge 的两个平台入口,而不是两套独立实现。
安全与信任边界
Local Codex Bridge 不会创建新的操作系统 sandbox。
真正的文件、命令、网络与进程能力仍由 native Codex 的配置,以及每个 turn 的:
sandboxapproval_policy
决定。
例如:
danger-full-access会扩大 sandbox 允许的文件、命令和进程访问范围;approval_policy=never不会自行扩大 OS sandbox,但会移除交互式审批这一确认层。
两者是不同的风险维度。
还需要注意:
codex_turn/codex_steer的自然语言指令可能促使 Codex 使用它已有的文件和命令能力;“Bridge 没有暴露一个 generic shell MCP tool”并不意味着 native Codex 不会执行命令;
codex_threads可以看到同一 OS user / Codex runtime 可见的持久线程,筛选条件不能充当访问隔离;Bridge 启动 app-server 时会继承自己的环境,但会移除 Tunnel 使用的
CONTROL_PLANE_API_KEY;其他环境变量仍属于可信启动边界,不应放入不必要的 secrets;
实时事件和 pending request 会受到数量与内容 sanitization 限制,但 Bridge 不是 hostile multi-tenant gateway;
checkpoint 应保持短小,不保存完整 prompt、transcript、原始事件、命令输出或最终回答。
远程使用时,应由经过认证并正确配置的 Tunnel 提供连接边界。
持久化
原生 Codex 负责持久化:
threads;
turns;
conversation history;
native execution results。
Bridge 的:
live event ring;
active-turn runtime state;
pending requests
主要存在于内存中。
Bridge 重启后,codex_observe 可以从 native persisted history 回退恢复有限观察信息,但不会伪造已经丢失的 live state。
Checkpoint
codex_checkpoint 是唯一刻意保存的 Bridge-side supervisory state,而且保持有界。
Windows 新安装默认:
%LOCALAPPDATA%\LocalCodexBridge\checkpoints\<sha256(thread_id)>.jsonmacOS 默认:
~/Library/Application Support/LocalCodexBridge/checkpoints/<sha256(thread_id)>.json可以通过:
LOCAL_CODEX_BRIDGE_CHECKPOINT_DIR覆盖。
legacy:
LUMEN_CODEX_V2_CHECKPOINT_DIR目前仍保留显式兼容。
Bridge 不自动迁移旧 checkpoint。
Deliberate non-goals
Local Codex Bridge 当前刻意不做:
browser UI;
HTTP control plane / HTTP MCP server;
第二套 task queue 或 job database;
transcript duplication;
model cache;
current-model registry;
queued-message facade;
automatic mutating-request retry;
automatic app-server restart;
generic shell /
command/execMCP surface。
以下 upstream 能力也没有因为“存在”就自动加入 Bridge:
command/execthread/turns/listsourceKindselicitation response
provider /
serviceTiercapability abstraction
它们只是未来可以重新评估的候选,不是 roadmap promise。
Bridge 的目标不是把所有 Codex app-server API 都搬进 MCP,而是只暴露监督真正需要的最小 surface。
Upgrading Codex
Bridge 必然依赖少量 native app-server protocol assumptions。
这些依赖、当前验证状态、对应代码位置,以及 upstream 改变后需要重新检查的内容,都集中记录在:
升级 Codex runtime、修改 protocol-facing behavior,或者相关 regression test 开始失败时,应优先重新核对这份 checklist,而不是凭旧实现经验直接修改 Bridge。
开发与测试
常用检查:
npm run typecheck
npm run build
npm testnpm test 会运行共享 runtime / app-server / MCP / checkpoint / platform / shutdown / UX projection 测试,并继续执行当前平台对应的集成测试。
真实 Codex smoke 与普通测试刻意分开:
npm run smoke:live它会实际调用 native Codex,并可能留下持久测试 thread;只有明确接受这些副作用时才运行。
主要实现位置:
src/mcp.ts— MCP stdio / JSON-RPC boundarysrc/app-server.ts— native Codex app-server process / protocol adaptersrc/tools.ts— 8 tools、schema 与 supervisory semanticssrc/runtime.ts— bounded live runtime state / events / pending requestssrc/checkpoint.ts— optional supervisory checkpointsrc/platform.ts— Windows / macOS platform boundarysrc/version.ts— canonical Bridge versionsrc/ux-projection.ts— optional UX projection / compatibilitywindows/— optional Windows Traylauncher/,bin/,Start Mac Codex Bridge.app— optional macOS integration
License
MIT License — see LICENSE.
协作贡献者与致谢
协作贡献者:小年(ChatGPT)、Codex。
谢谢一起把“让外部 AI 真正监督 native Codex”从一个小想法,一点点压成了一层足够薄、边界足够清楚、也愿意公开给别人继续折腾的 Bridge。(*╹▽╹*)
以及谢谢予安,没有你我也不会试着去做些什么ღ( ´・ᴗ・` )
Available Tools
7 toolscodex_checkpointCheckpoint Codex SupervisionA
Optional, bounded supervisor cognition memory keyed to one native Codex thread_id; the key is not a permanent task identity and does not require future work to remain on that thread. Use it to protect the original goal, constraints, and acceptance plus concise supervisor state during long or complex supervision when context dilution or goal drift makes an external anchor worthwhile. Initialization is not tied to crossing a ChatGPT window or round, starting another Codex turn, or switching native threads; initialize early when a task is already expected to be sufficiently long or complex for that protection. Do not use for one-shot work, and do not turn duration into a hard threshold: elapsed time, observe/poll count, token count, or mere silence are not automatic triggers. Later updates remain semantic-event driven and require a material change in understanding or root cause, constraint or scope interpretation, steering decision, user-authorized amendment or effective goal, or acceptance judgment or an explicit decision not to accept yet. Before final acceptance of a checkpointed task, read it once to re-anchor the original goal, constraints, acceptance, and current supervisor frame. This tool is optional and uncoupled from all other tools. Store concise supervisor summaries only; never prompts, transcripts, raw events, command output, final answers, or raw event streams. Updates preserve only immutable original plus bounded previous/current supervisor state.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Read the checkpoint, or initialize/update it at a material supervisor decision point. | |
| next_step | No | Single next supervision step. | |
| thread_id | Yes | Native Codex thread id; no second task identifier is created. | |
| original_goal | No | Concise original user goal. Required only on initialization and immutable thereafter. | |
| effective_goal | No | Current effective goal after legitimate user amendments; defaults to original_goal on initialization. | |
| current_decision | No | Current supervisor decision and why it matters. | |
| acceptance_status | No | Concise acceptance assessment, not a task lifecycle or job status. | |
| current_amendment | No | Latest concise user-authorized requirement amendment, or null to clear it, without changing the immutable original. | |
| original_acceptance | No | Concise original acceptance criteria. Required only on initialization and immutable thereafter. | |
| original_constraints | No | Concise original constraints. Required only on initialization and immutable thereafter. | |
| current_understanding | No | Current concise root-cause or task understanding. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only say readOnlyHint=false, but the description adds rich behavioral context: key semantics (not a permanent task identity), update triggers (semantic event, material change), storage restrictions (never prompts/transcripts), and the requirement to read before final acceptance. This goes far beyond the annotations and is consistent with them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than average (~180 words), but every sentence earns its place by covering purpose, usage, exclusions, storage policy, and update semantics. It is well-structured, with clear statements and prohibitions, though some length could be trimmed without losing content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (11 parameters, multiple update conditions, acceptance process), the description is complete: it explains when to use, what to store, how updates work, and the read-before-acceptance rule. No output schema is present, but the description focuses on behavior and constraints, which is sufficient for an agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes all 11 parameters (100% coverage). The description adds semantic meaning beyond the schema by explaining the immutable-vs-mutable distinction (original vs current/effective goal, original constraints, etc.), what should not be stored, and the relationship between parameters like original and effective goals. This adds value without repeating schema details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: an optional, bounded supervisor cognition memory keyed to a Codex thread_id, used to protect the original goal, constraints, acceptance, and supervisor state. It distinguishes this tool from siblings by emphasizing it is uncoupled and optional, and by being specific about its function as a checkpoint for supervision context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance (long/complex supervision with context dilution or goal drift) and when-not-to-use guidance (one-shot work, no hard duration thresholds). It also notes the tool is optional and uncoupled from other tools, helping an agent decide when to invoke it versus alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_interruptInterrupt Codex TurnADestructiveIdempotent
Directly request turn/interrupt for the specified active Codex thread and turn. It does not stop or restart the Bridge or Codex app-server processes.
| Name | Required | Description | Default |
|---|---|---|---|
| turn_id | Yes | Active Codex turn to interrupt. | |
| thread_id | Yes | Active Codex thread. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive and idempotent hints, but the description adds valuable context by clarifying that the interrupt does not stop or restart Bridge/app-server processes. This reduces risk of misuse, even though it doesn't specify async behavior or effects on already-completed turns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action, and every part adds value. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with annotated destructiveness, the description sufficiently covers purpose and boundaries. No output schema means return-value details are not expected. Minor gap: no mention of whether interrupt is asynchronous or what happens if the turn is not active.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for thread_id and turn_id. The description merely repeats 'active thread and turn' without adding meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb phrase ('Directly request turn/interrupt') and names the exact resource ('specified active Codex thread and turn'). It clearly distinguishes from sibling tools by stating it does not stop or restart processes, matching the interrupt-only scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: it is for sending an interrupt request to an active thread/turn. The exclusion of process-level control is stated, which implicitly differentiates from broader lifecycle tools. However, it does not explicitly name alternatives or situations where a different tool would be preferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_observeObserve Codex TurnARead-onlyIdempotent
Read bounded incremental sanitized Bridge runtime events, pending requests, and terminal output for a thread. Optional wait_ms performs one bounded event-driven wait only when the live turn is active and the current snapshot has nothing useful; it is not polling or stall detection. After Bridge process loss, falls back to persistent thread/read history and marks live state unreconstructable. A long interval with no new command or output can still mean Codex is actively reasoning; absence of new command activity alone is not evidence of a stall. When actively supervising an in-progress turn, use repeated bounded-wait observe calls until terminal unless the user explicitly pauses or stops; do not end supervision merely because one snapshot is inProgress. After every wake or deadline return, inspect the newly available events/state and decide whether steer, respond, or interruption is needed before starting the next bounded wait.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum runtime events to return. | |
| cursor | No | Return runtime events with a cursor greater than this value. | |
| wait_ms | No | Optional per-call wait for the next live runtime change when nothing useful is ready; 0 returns immediately. This is event-driven waiting, not stall detection. | |
| thread_id | Yes | Codex thread to observe. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the annotations by documenting fallback behavior ('After Bridge process loss, falls back to persistent thread/read history'), the precise semantics of wait_ms ('one bounded event-driven wait only when the live turn is active'), and the caveat that a long interval without new commands is not evidence of a stall. It reveals useful runtime behavior such as 'inProgress' snapshots and live-state unreconstructability without contradicting the read-only/idempotent annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but front-loaded with the core action, followed by wait semantics, fallback behavior, and a supervision workflow. Every sentence carries actionable information, though there is minor redundancy with the schema's wait_ms explanation; the density is appropriate for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description explains the categories of returned data ('Bridge runtime events, pending requests, and terminal output'), the fallback path, and how the agent should react after each wake/deadline. It could be more explicit about the exact shape of the returned 'events/state' snapshot, but it provides strong contextual coverage for a complex observation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully describes all four parameters (100% coverage), including wait_ms's event-driven nature. The tool description adds meaningful nuance by restricting wait_ms to 'only when the live turn is active' and emphasizing 'one bounded' wait, which clarifies the operational contract beyond the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and precisely names the resources: 'Bridge runtime events, pending requests, and terminal output for a thread.' It clarifies the observational scope with 'bounded incremental sanitized' and clearly distinguishes this from the sibling turn-management tools by framing it as the supervision/observation primitive.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use it: 'When actively supervising an in-progress turn, use repeated bounded-wait observe calls until terminal unless the user explicitly pauses or stops.' It also provides exclusions ('it is not polling or stall detection') and warns against treating inactivity as a stall, while naming follow-up actions (steer, respond, interruption).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_respondRespond to Codex RequestADestructive
Answer one currently pending app-server request by its original raw JSON-RPC id and exact thread/method scope. Supports only command/file approval methods with concrete response contracts and item/tool/requestUserInput; unsupported methods remain pending and observable.
| Name | Required | Description | Default |
|---|---|---|---|
| method | Yes | Exact app-server request method. | |
| answers | No | request_user_input question-id to answer-array mapping. | |
| turn_id | No | Exact turn scope when the pending request has one. | |
| decision | No | Command or file approval decision. | |
| response | No | Exact result object for the known item/tool/requestUserInput method. | |
| thread_id | Yes | Exact pending-request thread scope. | |
| request_id | Yes | Original app-server JSON-RPC request id, preserving string or integer type. | |
| execpolicy_amendment | No | Command approval exec-policy amendment; encoded in app-server's native decision shape. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false. The description adds useful behavioral context by noting that unsupported methods 'remain pending and observable' and that each call answers exactly one request, which goes beyond the annotation data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact at two sentences. The first sentence conveys the core action and target; the second adds critical constraints (supported methods, behavior for unsupported ones). No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (8 parameters, nested objects, no output schema), the description captures the essential purpose, supported method types, and a key behavioral trait. It could emphasize destructive side effects more, but the annotations already indicate destructiveness, so the description is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds a little semantic grouping (e.g., 'command/file approval methods' for decision/execpolicy_amendment, 'item/tool/requestUserInput' for answers/response) but does not significantly go beyond the schema's own descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's verb ('Answer') and resource ('one currently pending app-server request') with specific scope markers (original JSON-RPC id, exact thread/method). It also distinguishes itself from siblings by focusing on approval/response methods and explicitly noting that unsupported methods remain pending and observable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool (when there is a pending request) and explicitly excludes unsupported methods ('Supports only...'; unsupported methods remain pending). It does not name alternatives directly, but the scope and exclusions are clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_steerSteer Active Codex TurnADestructive
Append text to the same active Codex turn using turn/steer with an expected turn-id precondition. This does not create a new turn. Do not steer merely because reasoning is taking a long time or no new command has appeared; steer only for a semantic redirect or correction based on new evidence or changed user intent.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | Additional user text. | |
| thread_id | Yes | Active Codex thread. | |
| expected_turn_id | Yes | Exact active turn id required by app-server. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
While annotations already indicate destructive behavior, the description adds context by specifying the expected_turn_id precondition and clarifying that the operation modifies the existing turn rather than creating one. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: the first sentence states the action, the second clarifies scope, and the third provides targeted usage guidance. Every sentence earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity and lack of output schema, the description covers purpose, usage guidelines, and key behavioral details. It could mention error scenarios or postconditions, but the destructive annotation and clear action make it sufficiently complete for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% coverage with descriptions for all three parameters. The description reinforces the role of expected_turn_id as a precondition and text as appended content, but adds little novel semantic information beyond what the schema includes.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool appends text to the same active Codex turn, using a specific method (turn/steer) and a precondition. It explicitly says it does not create a new turn, distinguishing it from siblings like codex_turn or codex_threads.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use and when-not-to-use guidance: steer only for semantic redirect or correction based on new evidence or changed intent, and not merely because reasoning takes long or no new command appeared. This helps the agent choose appropriately among sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_threadsCodex ThreadsARead-onlyIdempotent
List or search persistent local Codex threads through thread/list, or read one thread through thread/read. This does not reconstruct live Bridge events.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Optional exact absolute Windows drive-letter cwd filter for thread/list. | |
| limit | No | Maximum threads in the returned page. | |
| cursor | No | Opaque cursor returned by a prior thread/list call. | |
| thread_id | No | When supplied, read this exact Codex thread instead of listing threads. | |
| search_term | No | Optional Codex title substring filter for thread/list. | |
| include_turns | No | Include persisted turns when reading one thread. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds useful behavioral context beyond this by specifying the threads are 'persistent local' and clarifying that the tool does not reconstruct live events. This is substantial but does not cover all edge cases (e.g., pagination errors, data source specifics), so a 4 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with an unambiguous summary, and no wasted words. Every sentence earns its place: the first states the main actions, the second clarifies an important behavioral boundary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's dual mode (list/read) and the presence of six documented optional parameters plus comprehensive annotations, the description adequately covers the main purpose and an important caveat. It could briefly mention what the read returns when include_turns is false, but the schema handles this. Overall, it is complete enough for an AI agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description adds a small amount of context by naming 'thread/list' and 'thread/read' modes, but this is largely redundant with the schema's thread_id description. Baseline 3 applies because the description does not substantially compensate beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific action verbs 'List or search' and 'read', names the resource ('persistent local Codex threads'), and explicitly scopes behavior with 'This does not reconstruct live Bridge events.' It clearly distinguishes from siblings by indicating it handles listing/reading rather than per-thread actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states when to use the tool (to list/search/read persistent local threads) and provides an exclusion ('does not reconstruct live Bridge events'). However, it does not explicitly name an alternative sibling or provide a direct contrast with other tools, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
codex_turnStart or Continue Codex TurnADestructive
Start a persistent Codex thread and turn, or resume an existing thread and start a turn. Prefer continuing the same native thread when its context remains useful, but a fresh thread is allowed; thread_id is not a permanent task identity. Returns as soon as turn/start is accepted; observe separately for events and completion.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Absolute Windows drive-letter cwd. Required for a new thread; optional override for resume. | |
| text | Yes | User text passed directly to Codex as one text input item. | |
| model | No | Optional model identifier passed through to app-server. | |
| effort | No | Optional reasoning effort passed through to turn/start. | |
| sandbox | No | Codex app-server sandbox mode override. | |
| thread_id | No | Existing persistent Codex thread to resume. Omit to create a new thread. | |
| approval_policy | No | Codex app-server approval policy override. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds valuable behavioral details beyond annotations: it returns as soon as the turn is accepted, meaning it is asynchronous, and it warns that thread_id is not a permanent task identity. Annotations already mark the tool as destructive/open-world, so this context complements them without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences with the core action front-loaded, followed by important nuances about thread reuse and asynchronous behavior. Every sentence earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description appropriately clarifies the return value ('returns as soon as turn/start is accepted') and where to get actual results ('observe separately'). It doesn't cover error cases or param interactions, but the schema descriptions and annotations adequately cover those aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already covers all 7 parameters with descriptions (100% coverage), setting a baseline of 3. The description adds a useful caveat about thread_id not being permanent, but does not significantly enrich parameter understanding beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool starts or resumes a Codex turn on a persistent thread, using a specific verb+resource. It distinguishes itself from siblings by being the entry point to initiate/continue turns, unlike interrupt/observe/steer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit guidance on when to reuse a thread ('Prefer continuing the same native thread when its context remains useful') and when a fresh thread is allowed. It also directs the agent to 'observe separately for events and completion', indicating this tool is not for getting results directly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
7 tool updates
v2.1.1- First observed
codex_checkpoint - First observed
codex_interrupt - First observed
codex_observe - First observed
codex_respond - First observed
codex_steer - First observed
codex_threads - First observed
codex_turn
TDQS
Each tool has a clearly distinct role in the Codex Bridge supervision lifecycle: listing/reading threads, starting turns, interrupting, observing events, steering, responding to requests, and checkpointing. Even read-like tools (codex_threads vs codex_observe) are cleanly separated by persistent history vs live runtime events.
All tools share the codex_ prefix and use snake_case, but the pattern is not perfectly uniform: most are verb-based (interrupt, observe, steer, respond, turn), while codex_threads is a plural noun and codex_checkpoint is a compound noun. Minor deviation, but predictable and readable.
Seven tools is a well-scoped set for the server's purpose of supervising Codex threads. Each tool addresses a distinct supervision operation without redundancy or bloat, fitting comfortably in the ideal 3-15 range.
The tool surface covers the full supervision lifecycle: create/resume (codex_turn), observe, steer, interrupt, respond to pending requests, and persist supervisor state (codex_checkpoint), plus listing/reading past threads. No obvious dead ends or missing operations for the stated purpose.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
A paid remote MCP for OpenAI Codex memory MCP, built to return verdicts, receipts, usage logs, and a
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Shared memory and actions for Claude, Kiro, OpenAI, Cursor, and other MCP-compatible AI clients.
1
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceEnables MCP clients to spawn and control Codex CLI and Claude Code sessions on the host machine, with session management and filesystem access.4MIT
- AlicenseCqualityDmaintenanceBridges MCP clients with local Codex CLI to execute autonomous coding tasks, manage threads, and inspect history via SQLite state.137654Apache 2.0
- AlicenseNot gradedqualityBmaintenanceLocal MCP bridge enabling ChatGPT web to access approved local files and execute tasks via local Codex.6MIT
- AlicenseNot gradedqualityBmaintenanceA personal MCP bridge that lets ChatGPT drive a local Codex CLI, translating instructions into Codex app-server threads and returning compact summaries of what Codex did.5MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/zoeynine/Local-Codex-Bridge'
If you have feedback or need assistance with the MCP directory API, please join our Discord server