codex-mcp-go

The server itself is a thin wrapper over the external OpenAI Codex CLI. It explicitly defaults to 'read-only' sandbox mode, preventing direct file modifications by Codex unless overridden. It also prohibits arbitrary 'model' and 'profile' parameters unless allowlisted, enhancing security. Input prompts for the underlying Codex CLI are escaped for Windows environments to mitigate shell quoting issues. The recommended agent system prompts strongly advise agents to use 'read-only' mode and review/apply changes manually, further bolstering security. The primary security considerations shift to the trustworthiness and behavior of the underlying 'codex' CLI and the AI agent's adherence to the recommended safety protocols. The npm installation method downloads a pre-compiled binary, introducing a supply chain risk if the GitHub releases or repository were compromised.