Codex 0.151.0

When connecting to optional MCP (Model Context Protocol) servers, tool discovery will no longer fail immediately if an external tool takes a moment to respond. Codex introduces a configurable grace period for discovering tools from optional MCP servers. This gives background or remote servers enough time to complete initialization and register their tools.

Developers who need to sanitize tool outputs or adjust formats can now intercept data directly in the pipeline. Extensions can now inspect or replace MCP (Model Context Protocol) tool execution results before they are delivered to the model. This allows custom logic to filter out sensitive data or rewrite payload structures before the model processes them.

Managing plugin sources across projects is now much more reliable. Plugin catalogs now combine per-repository configuration into their listings. Furthermore, when a project contains an invalid marketplace, the system reports the issue clearly without hiding the remaining valid plugins. You can troubleshoot broken marketplace links while continuing to use all working extensions.

Security consistency in the terminal interface is now reinforced. Restored permission profiles are properly preserved across turns in the TUI (terminal user interface). Switching directories using the /cd command is strictly prevented from loosening or bypassing active sandbox restrictions, keeping execution boundaries intact.

Switching models mid-task no longer disrupts tool setups or reasoning levels. When you manually switch models or trigger a fallback to an alternative model, Codex now keeps tool availability and reasoning effort aligned with the target model. This prevents tools from vanishing unexpectedly and ensures reasoning parameters remain valid for the active provider.

Running commands in remote environments now benefits from accurate isolation boundaries. Remote sandbox enforcement now aligns with the executor's actual home directory, operating system, and path conventions. This eliminates authorization discrepancies caused by mismatched path separators, root structures, or platform conventions between local and remote hosts.

When external services encounter issues, app-server responses now preserve structured MCP (Model Context Protocol) tool and resource errors. Rather than flattening error responses into plain text strings, the system keeps structured fields intact so client applications and developers can programmatically handle failures and identify root causes.

Budget tracking across multi-agent workflows is now strictly enforced. When a primary task delegates work to nested subagents across multiple tiers, token consumption from every child agent is counted toward the root goal budget. This prevents deep subagent branches from silently exceeding the project token allocation.

Security enforcement now reacts instantly whenever authorization rules change. Previously cached classifications from Guardian (the security component that categorizes action risks) are no longer used after permission states change. The system invalidates stale classification data immediately upon permission updates, ensuring that outdated approvals cannot authorize new actions after permission state changes.

Observability into security reviews and remote connections is now expanded. Codex introduces dedicated telemetry tracking for escalated stdin reviews whenever interactive input requires elevated approval. It also logs remote executor MCP (Model Context Protocol) discovery events, giving maintainers clearer visibility into tool registration flows.