One read-only turn over the codex app-server JSON-RPC protocol (Codex CLI 0.160; the isolation checks were measured on 0.162).
Remarks
Messages are newline-delimited JSON-RPC 2.0 without the jsonrpc field. The session
performs the initialize/initialized handshake, starts or resumes the thread, fails
closed unless the server reports a read-only sandbox with approvalPolicy: "never",
starts one turn and closes stdin when the turn completes, which ends the server. An
interrupt sends turn/interrupt; the server then completes the turn with
status: "interrupted". Server-initiated requests (approvals, user input, tool calls)
are answered with a JSON-RPC error: this client never grants anything.
Inherited tools are removed before the turn (CUR-002). The server starts with the
features in CODEX_DISABLED_FEATURES turned off; the thread starts with every
MCP server of the effective configuration (config/read for the turn's directory,
project layers included) disabled. An empty mcp_servers table cannot do this, because
Codex merges configuration layers. The turn starts only after the server reports, for
that thread, each of those features off and every MCP server, plugin servers included,
disabled.
One read-only turn over the
codex app-serverJSON-RPC protocol (Codex CLI 0.160; the isolation checks were measured on 0.162).Remarks
Messages are newline-delimited JSON-RPC 2.0 without the
jsonrpcfield. The session performs theinitialize/initializedhandshake, starts or resumes the thread, fails closed unless the server reports a read-only sandbox withapprovalPolicy: "never", starts one turn and closes stdin when the turn completes, which ends the server. An interrupt sendsturn/interrupt; the server then completes the turn withstatus: "interrupted". Server-initiated requests (approvals, user input, tool calls) are answered with a JSON-RPC error: this client never grants anything.Inherited tools are removed before the turn (
CUR-002). The server starts with the features in CODEX_DISABLED_FEATURES turned off; the thread starts with every MCP server of the effective configuration (config/readfor the turn's directory, project layers included) disabled. An emptymcp_serverstable cannot do this, because Codex merges configuration layers. The turn starts only after the server reports, for that thread, each of those features off and every MCP server, plugin servers included,disabled.