OpenAI Codex

MCP connects external services with approved server lists under enterprise control, plugins and connectors extend the agent with side effecting tool calls that require approval when they advertise destructive annotations, and documented third party integrations cover GitHub, GitLab, Slack and Linear; the agent runs shell commands under an OS sandbox, uses a web search tool with cached, live and disabled modes, and reaches the browser and computer use surfaces.

Sourcelearn.chatgpt.com/codex/extend/mcp, /codex/third-party and /codex/agent-approvals-securityread 2026-08-30

The agent sustains long autonomous sessions across many sequential tool calls, with configurable subagents, git worktrees for parallel work, projects and chats organizing multi step work, long running work and scheduled tasks documented, and the desktop app running agent threads side by side; the cloud agent works asynchronously in isolated containers so many tasks proceed in parallel, and multi agent tooling is listed among stable CLI surfaces.

Sourcelearn.chatgpt.com/codex/agent-configuration/subagents, /codex/environments/git-worktrees and /codex/long-running-workread 2026-08-30

Context is assembled per run: the agent reads the repository, resolves @ mentioned files, calls MCP servers for external sources and uses a web search tool whose cached mode draws on an OpenAI maintained web index. AGENTS.md and Rules are instructions the product applies rather than a knowledge source. No maintained retrieval structure over the customer's own code or documents is documented.

Sourcelearn.chatgpt.com/docs/agent-configuration/agents-md, /docs/extend/mcp and the docs llms.txt indexread 2026-09-29

Two independent layers govern the agent: sandbox mode controlling what it can technically do, and approval policy controlling when it must ask, with presets from read-only through workspace-write to danger-full-access and a granular policy that keeps chosen approval categories interactive while auto rejecting others.

An Auto-review reviewer agent can evaluate eligible approval requests against a published policy checking for data exfiltration, credential probing, security weakening and destructive actions, failing closed on parse or session errors. Destructive MCP and app tool calls always require approval,.git,.agents and.codex are protected read-only inside writable roots, and enterprise managed requirements override local settings.

Sourcelearn.chatgpt.com/codex/agent-approvals-security and /codex/sandboxing/auto-reviewread 2026-08-30

trust.openai.com lists SOC 2 Type 2, SOC 3, ISO/IEC 27001, 27017, 27018, 27701 and 42001, CSA STAR and FedRAMP 20x, with the SOC 2 report scoped to the API Platform, ChatGPT Enterprise, ChatGPT Edu and ChatGPT Team, the plans and API key path Codex runs on; the portal does not name Codex separately. The access surface is documented: managed configuration that overrides local settings, roles and workspace permissions, SCIM and EKM on Enterprise, workload identity federation, service accounts, plugin, connector and skill controls, approved MCP server lists, a Compliance API with audit events, Private Link, IP allowlisting and mutual TLS.

Sourcetrust.openai.com and learn.chatgpt.com/docs/enterprise/managed-configurationread 2026-09-29

Opt in OpenTelemetry export emits a documented event catalog including codex.tool_decision recording approved or denied and whether the source was configuration or the user, codex.tool_result with duration, success and output snippet, codex.api_request, codex.sse_event and codex.user_prompt, with counter and duration histogram metrics, exportable to a customer controlled collector over OTLP; enterprise adds a Compliance API and audit events, workspace analytics and an Analytics API. Telemetry is off by default and prompt text is redacted unless explicitly enabled.

Sourcelearn.chatgpt.com/codex/agent-approvals-security and /codex/enterprise/compliance-apiread 2026-08-30

Codex writes its own memories: once enabled, it turns useful context from eligible prior chats into local memory files under CODEX_HOME, redacting secrets and updating in the background after a chat goes idle.

Scope is stated (the local Codex home, with /memories choosing per chat whether a chat may read existing memories or feed future ones, and managed configuration able to pin the feature on or off), lifetime is stated (memories.max_unused_days, default 30 and clamped to 365, retires unused memories from consolidation; memories.max_rollout_age_days bounds the chats considered), and the files are inspectable for review. Off by default. AGENTS.md holds rules rather than memory.

Sourcelearn.chatgpt.com/docs/customization/memories and /docs/config-file/config-referenceread 2026-09-29

Local environments run entirely on the developer's machine through the CLI, IDE extension and desktop app under an OS enforced sandbox using Seatbelt on macOS, bwrap and seccomp on Linux and a native Windows sandbox or WSL2, with dev container support and a published secure devcontainer reference; cloud environments run in isolated OpenAI managed containers with configurable internet access and domain allow lists. Enterprise adds Private Link, IP allowlisting, mutual TLS, IP egress ranges and Amazon Bedrock as a model provider.

Sourcelearn.chatgpt.com/codex/environments/modes, /codex/agent-approvals-security and /codex/amazon-bedrockread 2026-08-30

Skills and plugins are first class extensibility surfaces with dedicated build guides, a plugin architecture and submission path, enterprise plugin management, plugin controls and skill controls for administering approved catalogs, and documented support for submitting a Claude Code plugin; subagents are configurable per project and Codex Micro ships as a packaged capability.

Sourcelearn.chatgpt.com/codex/skills-and-plugins, /codex/build-plugins and /codex/enterprise/plugin-managementread 2026-08-30

Codex runs in the ChatGPT desktop app, a Codex CLI, an IDE extension, ChatGPT on the web, Codex cloud, and a Remote mode driven from a phone, with scheduled tasks running work on a timetable, long running work supported, a GitHub Action and non-interactive mode for CI, and documented third party integrations for GitHub, GitLab in beta, Slack and Linear; notifications close the loop.

Sourcelearn.chatgpt.com/codex/automations, /codex/github-action and /codex/third-partyread 2026-08-30

The customer chooses the model maker.

Local Codex clients accept custom model providers in config.toml, each defined by base URL, wire API and authentication, and the vendor's own example configures Mistral's API and a local Ollama endpoint beside an OpenAI proxy; OSS mode runs Codex against a local open source provider, Ollama or LM Studio, chosen per run with --local-provider or set as the default.

Within OpenAI's own family the model is selectable per session and per workspace. Amazon Bedrock is a built-in provider serving OpenAI models on AWS, which is a hosting choice rather than a different model maker.

Sourcelearn.chatgpt.com/docs/config-file/config-advanced (Custom model providers, OSS mode) and /docs/modelsread 2026-09-29

A Codex SDK, an App Server, an MCP Server, a GitHub Action and a non-interactive mode are all documented build surfaces, alongside MCP client support with approved server lists, hooks firing on lifecycle events, Site tools via WebMCP, Record and Replay, and a Python SDK with auth; the CLI is open source in Rust at github.com/openai/codex with a published default reviewer policy, and the docs expose an llms.txt index and markdown versions of every page.

Sourcelearn.chatgpt.com/codex/codex-sdk, /codex/mcp-server and /codex/open-sourceread 2026-08-30

Codex reviews code changes before commit, a Codex Security plugin and CLI run scans, deep scans and bulk scans in CI with a security workbench and finding export, and the agent runs tests and iterates on failures; Auto-review evaluates individual agent actions against a risk policy at runtime. These verify the customer's code and gate the agent's actions rather than providing a harness to evaluate, replay or regression test agent behavior itself.

Sourcelearn.chatgpt.com/codex/code-review and /codex/securityread 2026-08-30

Browser and Computer use are documented capabilities with dedicated pages, alongside a browser extension for signed in browser workflows and Appshots; the security documentation treats browser and Computer Use activity as a distinct traffic surface outside the command network proxy, requiring its own feature settings and workspace policies, and managed configuration lets administrators set feature requirements for browsers and Computer Use.

Sourcelearn.chatgpt.com/codex/computer-use, /codex/browser and /codex/agent-approvals-securityread 2026-08-30