codex

[MCP] Redact environment variable values in /mcp and mcp get (#5648 )

Fixes #5524

Gabriel Peal · 2025-10-24 18:30:20 -04:00

817d1508bc

[MCP] Add configuration options to enable or disable specific tools (#5367 )

Some MCP servers expose a lot of tools. In those cases, it is reasonable
to allow/denylist tools for Codex to use so it doesn't get overwhelmed
with too many tools.

The new configuration options available in the `mcp_server` toml table
are:
* `enabled_tools`
* `disabled_tools`

Fixes #4796

Gabriel Peal · 2025-10-20 15:35:36 -07:00

740b4a95f4

[MCP] Allow specifying cwd and additional env vars (#5246 )

This makes stdio mcp servers more flexible by allowing users to specify
the cwd to run the server command from and adding additional environment
variables to be passed through to the server.

Example config using the test server in this repo:
```toml
[mcp_servers.test_stdio]
cwd = "/Users/<user>/code/codex/codex-rs"
command = "cargo"
args = ["run", "--bin", "test_stdio_server"]
env_vars = ["MCP_TEST_VALUE"]
```

@bolinfest I know you hate these env var tests but let's roll with this
for now. I may take a stab at the env guard + serial macro at some
point.

Gabriel Peal · 2025-10-17 00:24:43 -04:00

bdda762deb

[MCP] Allow specifying custom headers with streamable http servers (#5241 )

This adds two new config fields to streamable http mcp servers:
`http_headers`: a map of key to value
`env_http_headers` a map of key to env var which will be resolved at
request time

All headers will be passed to all MCP requests to that server just like
authorization headers.

There is a test ensuring that headers are not passed to other servers.

Fixes #5180

Gabriel Peal · 2025-10-16 23:15:47 -04:00

a5d48a775b

[MCP] Add auth status to MCP servers (#4918 )

This adds a queryable auth status for MCP servers which is useful:
1. To determine whether a streamable HTTP server supports auth or not
based on whether or not it supports RFC 8414-3.2
2. Allow us to build a better user experience on top of MCP status

Gabriel Peal · 2025-10-08 17:37:57 -04:00

3c5e12e2a4

[MCP] Add an enabled config field (#4917 )

This lets users more easily toggle MCP servers.

Gabriel Peal · 2025-10-08 16:24:51 -04:00

d3820f4782

[MCP] Add support for streamable http servers with codex mcp add and replace bearer token handling (#4904 )

1. You can now add streamable http servers via the CLI
2. As part of this, I'm also changing the existing bearer_token plain
text config field with ane env var

```
mcp add github --url https://api.githubcopilot.com/mcp/ --bearer-token-env-var=GITHUB_PAT
```

Gabriel Peal · 2025-10-07 23:21:37 -04:00

a43ae86b6c

add(core): managed config (#3868 )

## Summary

- Factor `load_config_as_toml` into `core::config_loader` so config
loading is reusable across callers.
- Layer `~/.codex/config.toml`, optional `~/.codex/managed_config.toml`,
and macOS managed preferences (base64) with recursive table merging and
scoped threads per source.

## Config Flow

```
Managed prefs (macOS profile: com.openai.codex/config_toml_base64)
                               ▲
                               │
~/.codex/managed_config.toml   │  (optional file-based override)
                               ▲
                               │
                ~/.codex/config.toml (user-defined settings)
```

- The loader searches under the resolved `CODEX_HOME` directory
(defaults to `~/.codex`).
- Managed configs let administrators ship fleet-wide overrides via
device profiles which is useful for enforcing certain settings like
sandbox or approval defaults.
- For nested hash tables: overlays merge recursively. Child tables are
merged key-by-key, while scalar or array values replace the prior layer
entirely. This lets admins add or tweak individual fields without
clobbering unrelated user settings.

Fouad Matin · 2025-10-03 13:02:26 -07:00

a5b7675e42

[MCP] Add experimental support for streamable HTTP MCP servers (#4317 )

This PR adds support for streamable HTTP MCP servers when the
`experimental_use_rmcp_client` is enabled.

To set one up, simply add a new mcp server config with the url:
```
[mcp_servers.figma]
url = "http://127.0.0.1:3845/mcp"
```

It also supports an optional `bearer_token` which will be provided in an
authorization header. The full oauth flow is not supported yet.

The config parsing will throw if it detects that the user mixed and
matched config fields (like command + bearer token or url + env).

The best way to review it is to review `core/src` and then
`rmcp-client/src/rmcp_client.rs` first. The rest is tests and
propagating the `Transport` struct around the codebase.

Example with the Figma MCP:
<img width="5084" height="1614" alt="CleanShot 2025-09-26 at 13 35 40"
src="https://github.com/user-attachments/assets/eaf2771e-df3e-4300-816b-184d7dec5a28"
/>

Gabriel Peal · 2025-09-26 21:24:01 -04:00

3a1be084f9

initial mcp add interface (#3543 )

Adds `codex mcp add`, `codex mcp list`, `codex mcp remove`. Currently writes to global config.

easong-openai · 2025-09-15 04:30:56 +00:00

6a8e743d57

60 Commits