Codex Octopus

One brain, many arms.

An MCP server that wraps the OpenAI Codex SDK, letting you run multiple specialized Codex agents — each with its own model, sandbox, effort, and personality — from any MCP client.

Why

Codex is powerful. But one instance does everything the same way. Sometimes you want a strict code reviewer in read-only sandbox. A test writer with workspace-write access. A cheap quick helper on minimal effort. A deep thinker on xhigh.

Codex Octopus lets you spin up as many of these as you need. Same binary, different configurations. Each one shows up as a separate tool in your MCP client.

Prerequisites

• Node.js >= 18
• Codex CLI — the Codex SDK spawns the Codex CLI under the hood, so you need it installed (@openai/codex)
• OpenAI API key (CODEX_API_KEY env var) or inherited from parent process

Install

npm install codex-octopus

Or use npx directly in your .mcp.json (see Quick Start below).

Quick Start

Add to your .mcp.json:

{
  "mcpServers": {
    "codex": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_SANDBOX_MODE": "workspace-write",
        "CODEX_APPROVAL_POLICY": "never"
      }
    }
  }
}

This gives you two tools: codex and codex_reply. That's it — you have Codex as a tool.

Multiple Agents

The real power is running several instances with different configurations:

{
  "mcpServers": {
    "code-reviewer": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_TOOL_NAME": "code_reviewer",
        "CODEX_SERVER_NAME": "code-reviewer",
        "CODEX_DESCRIPTION": "Strict code reviewer. Read-only sandbox.",
        "CODEX_MODEL": "o3",
        "CODEX_SANDBOX_MODE": "read-only",
        "CODEX_APPEND_INSTRUCTIONS": "You are a strict code reviewer. Report real bugs, not style preferences.",
        "CODEX_EFFORT": "high"
      }
    },
    "test-writer": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_TOOL_NAME": "test_writer",
        "CODEX_SERVER_NAME": "test-writer",
        "CODEX_DESCRIPTION": "Writes thorough tests with edge case coverage.",
        "CODEX_MODEL": "gpt-5-codex",
        "CODEX_SANDBOX_MODE": "workspace-write",
        "CODEX_APPEND_INSTRUCTIONS": "Write tests first. Cover edge cases. TDD."
      }
    },
    "quick-qa": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_TOOL_NAME": "quick_qa",
        "CODEX_SERVER_NAME": "quick-qa",
        "CODEX_DESCRIPTION": "Fast answers to quick coding questions.",
        "CODEX_EFFORT": "minimal"
      }
    }
  }
}

Your MCP client now sees three distinct tools — code_reviewer, test_writer, quick_qa — each purpose-built.

Agent Factory

Don't want to write configs by hand? Add a factory instance:

{
  "mcpServers": {
    "agent-factory": {
      "command": "npx",
      "args": ["codex-octopus@latest"],
      "env": {
        "CODEX_FACTORY_ONLY": "true",
        "CODEX_SERVER_NAME": "agent-factory"
      }
    }
  }
}

This exposes a single create_codex_mcp tool — an interactive wizard. Tell it what you want ("a strict code reviewer with read-only sandbox") and it generates the .mcp.json entry for you.

Tools

Each non-factory instance exposes:

| Tool | Purpose | | -------------- | ------------------------------------------------------ | | <name> | Send a task to the agent, get a response + thread_id | | <name>_reply | Continue a previous conversation by thread_id |

Per-invocation parameters (override server defaults):

| Parameter | Description | | ---------------- | -------------------------------------------------- | | prompt | The task or question (required) | | cwd | Working directory override | | model | Model override | | additionalDirs | Extra directories the agent can access | | effort | Reasoning effort (minimal to xhigh) | | sandboxMode | Sandbox override (can only tighten, never loosen) | | approvalPolicy | Approval override (can only tighten, never loosen) | | networkAccess | Enable network access from sandbox | | webSearchMode | Web search: disabled, cached, live | | instructions | Additional instructions (prepended to prompt) |

Configuration

All configuration is via environment variables in .mcp.json. Every env var is optional.

Identity

| Env Var | Description | Default | | -------------------- | --------------------------------------------- | ---------------- | | CODEX_TOOL_NAME | Tool name prefix (<name> and <name>_reply) | codex | | CODEX_DESCRIPTION | Tool description shown to the host AI | generic | | CODEX_SERVER_NAME | MCP server name in protocol handshake | codex-octopus | | CODEX_FACTORY_ONLY | Only expose the factory wizard tool | false |

Agent

| Env Var | Description | Default | | -------------------------- | ----------------------------------------------------- | ------------- | | CODEX_MODEL | Model (gpt-5-codex, o3, codex-1, etc.) | SDK default | | CODEX_CWD | Working directory | process.cwd() | | CODEX_SANDBOX_MODE | read-only, workspace-write, danger-full-access | read-only | | CODEX_APPROVAL_POLICY | never, on-failure, on-request, untrusted | on-failure | | CODEX_EFFORT | minimal, low, medium, high, xhigh | SDK default | | CODEX_ADDITIONAL_DIRS | Extra directories (comma-separated) | none | | CODEX_NETWORK_ACCESS | Allow network from sandbox | false | | CODEX_WEB_SEARCH | disabled, cached, live | disabled |

Instructions

| Env Var | Description | | ---------------------------- | -------------------------------------------------------- | | CODEX_INSTRUCTIONS | Replaces the default instructions | | CODEX_APPEND_INSTRUCTIONS | Appended to the default (usually what you want) |

Advanced

| Env Var | Description | | ---------------------- | -------------------------------------------------------- | | CODEX_PERSIST_SESSION| true/false — enable session resume (default: true) |

Authentication

| Env Var | Description | Default | | --------------- | ------------------------------ | --------------------- | | CODEX_API_KEY | OpenAI API key for this agent | inherited from parent |

Security

• Sandbox defaults to read-only — the agent can't write files unless you explicitly set workspace-write or danger-full-access.
• cwd overrides preserve agent knowledge — when the host overrides cwd, the agent's configured base directory is automatically added to additionalDirectories.
• Security overrides narrow, never widen — per-invocation sandboxMode and approvalPolicy can only tighten (e.g., workspace-write → read-only), never loosen.
• _reply tool respects persistence — not registered when CODEX_PERSIST_SESSION=false.
• API keys are redacted — the factory wizard never exposes CODEX_API_KEY in generated configs.

Architecture

┌─────────────────────────────────┐
│  MCP Client                     │
│  (Claude Desktop, Cursor, etc.) │
│                                 │
│  Sees: code_reviewer,           │
│        test_writer, quick_qa    │
└──────────┬──────────────────────┘
           │ JSON-RPC / stdio
┌──────────▼──────────────────────┐
│  Codex Octopus (per instance)   │
│                                 │
│  Env: CODEX_MODEL=o3            │
│       CODEX_SANDBOX_MODE=...    │
│       CODEX_APPEND_INSTRUCTIONS │
│                                 │
│  Calls: Codex SDK thread.run()  │
└──────────┬──────────────────────┘
           │ in-process
┌──────────▼──────────────────────┐
│  Codex SDK → Codex CLI          │
│  Runs autonomously: reads files,│
│  writes code, runs commands     │
│  Returns result + thread_id     │
└─────────────────────────────────┘

Known Limitations

• minimal effort + web_search: OpenAI does not allow web_search tools with minimal reasoning effort. Use low or higher if web search is needed.

Development

pnpm install
pnpm build       # compile TypeScript
pnpm test        # run tests (vitest)
pnpm test:coverage  # coverage report

License

ISC - Xiaolai Li