MCP Integration

Key takeaways

• Codex CLI 0.143.0 makes MCP tool search the default and lets ChatGPT-hosted MCP servers explicitly use session authentication; 0.144.0 enables interactive authentication requests without an experimental opt-in.

• MCP expands what Codex can see and do, which makes it valuable for enterprise workflows and risky when tool permissions are vague.

• Decide server scope, tool allowlist, data exposure, auth model, and audit trail before connecting a server.

• Prefer read-only resources first, gate write or side-effect tools behind approval, and mask secrets and customer data by default.

• Audit plugins and servers with codex plugin list --json, --available --json, and codex plugin marketplace list --json, and treat JSON Schema fixtures (with preserved oneOf/allOf) as part of the MCP contract.

• Any tool that could change money, permissions, customer records, or production state needs human approval and audit evidence.

MCP expands what Codex can see and do. That makes it useful for enterprise workflows and risky when tool permissions are vague.

Integration Decisions

Tool Policy

• Prefer read-only resources first.
• Gate write or side-effect tools with approval.
• Return structured data instead of broad text dumps.
• Mask secrets and customer data by default.
• Version tool schemas and document breaking changes.

Current Codex Notes

• Use codex plugin list --json, codex plugin list --available --json, and codex plugin marketplace list --json for plugin/MCP inventory audits.
• Tool and connector input schemas now preserve oneOf and allOf, and large schemas keep more shallow structure when compacted. Treat JSON Schema fixtures as part of the MCP contract.
• MCP startup warnings from subagents are scoped to the owning thread, so monitoring should record parent and child thread identifiers separately.
• Track marketplaceSource, bundled hooks, remote MCP servers, install policy, and auth policy when approving plugins.
• App and app-server surfaces can show richer MCP server state; do not collapse "missing", "disabled", "auth required", and "no tools" into the same operational error.
• Treat marketplace install/upgrade output as release evidence and preserve selected/upgraded/error fields in automation logs.

0.146.0 Connection and Tool Refresh

In 0.146.0, refresh MCP connections and App tools after auth, config, plugin, or enablement changes without restarting the CLI. Then verify server state with /mcp or /mcp verbose and the exposed surface with /apps and /skills; proxy environments must also test auth redirects and WebSockets.

MCP 2026-07-28 Protocol Opt-in (0.147.0+)

Codex 0.147.0 can opt in to the MCP 2026-07-28 revision, including pagination, multi-round interaction, and nonblocking server startup. Test the old and new protocol paths for upgraded servers. Codex 0.148.0 further improves reconnect and MCP OAuth flows and lets hooks invoke MCP tools; smoke-test first/next pages, multi-round responses, OAuth refresh, and hook calls separately.

MCP server entry-point removal (0.154.0)

The September 5 announcement and 0.154.0 release remove codex mcp-server and the standalone codex-mcp-server. Update callers before upgrading. Connecting to external MCP servers through codex mcp remains supported. The replacement integration, codex app-server, is experimental and not supported for production workloads. Validate transport, authentication, and reconnect behavior before migration.

In 0.154.0, failed OAuth refreshes surface sign-in challenges without automatically replaying rejected tool calls.

공식 Changelog

Review Checklist

If a tool could change money, permissions, customer records, or production state, it needs human approval and audit evidence.