OpenAI Codex

Why scan OpenAI Codex?

Codex is a local coding agent holding shell, file-patching and plugin authority in the same session, so an MCP server registered in its config.toml is reachable from a process that can already edit your working tree and run commands in it.

Usage

CallLint can auto-discover and scan OpenAI Codex configurations:

calllint scan --agent codex

How to start

Install nothing globally — run CallLint straight from npm:

npx calllint scan --auto

Then scan OpenAI Codex specifically:

calllint scan --agent codex

How to verify it worked

Check that the report names each server from the `mcp_servers` table. Codex config is TOML, not JSON — if a server you expected is missing, the table was not read, and absence of a finding is not absence of risk.

What CallLint does to OpenAI Codex

Offline by default. Deterministic. Never executes the server it judges. SAFE means no blockers observed, not a proof of runtime safety.

A No blockers observed verdict means exactly that — no blocker under the evidence CallLint could collect. It is not a guarantee, and Insufficient evidence never becomes it on its own. See Coverage Boundary for what this scan does not look at.

Configuration Paths

CallLint looks for OpenAI Codex configurations in:

• ~/.codex/config.toml
• <project>/.codex/config.toml

Authority Surfaces

OpenAI Codex can grant tools the following authority surfaces:

• mcp
• tools
• filesystem
• shell
• plugins

Distribution

CallLint is available for OpenAI Codex through:

• mcp-stdio (via officialMcpRegistry) — Listing not yet verified
• openai-plugin — Not available here
  ⚠️ Do not create remote MCP just for public listing eligibility

Support Status

Auto-detects — CallLint finds this host’s config on its own.

The commands under Usage are the ones CallLint actually supports for OpenAI Codex today. Anything not listed there is not claimed.

Official Sources

• https://developers.openai.com/codex/extend/mcp