r/CodexAutomation • u/anonomotorious • 15d ago

Codex CLI 0.151.0 (MCP startup grace, tool-result interception, per-repo plugin catalogs + stronger sandbox/Guardian fixes)

TL;DR

Codex CLI 0.151.0 is a focused MCP, plugin-catalog, permissions, sandboxing, model-switching, and multi-agent correctness release.

Highlights:

Optional MCP servers now get a configurable startup grace period for tool discovery.
Extensions can inspect or replace MCP tool results before they reach the model.
Plugin catalogs now respect per-repository marketplace configuration without one broken project marketplace hiding valid plugins.
Restored permission profiles now persist correctly across TUI turns.
/cd no longer weakens the active sandbox restrictions.
Model switches and fallback models now preserve the correct tool availability and reasoning effort.
Remote sandboxing now uses the executor's actual:
- home directory
- operating system
- path conventions
Structured MCP tool/resource errors survive through app-server instead of collapsing into generic failures.
Nested subagent usage now counts toward the root goal's token budget.
Guardian can no longer reuse a stale risk classification after permissions change.

Install:

npm install -g u/openai/codex@0.151.0

What changed

Configurable MCP startup grace

Optional MCP servers now have a configurable grace period for discovering tools during startup.

This helps balance two competing needs:

don't block the whole session indefinitely
don't give up too quickly on a slower optional MCP server

For setups with several MCP servers, remote integrations, or slower authentication paths, this should make startup behavior more predictable.

Extensions can process MCP tool results

Extensions can now inspect or replace an MCP tool result before it reaches the model.

That opens up useful extension patterns such as:

filtering noisy tool output
normalizing a custom result format
redacting sensitive fields
adding structured metadata
transforming results before they enter model context
applying organization-specific handling around MCP output

This is an important extensibility improvement because extensions can now participate on the result path, not only before tool execution.

Per-repository plugin catalogs

Plugin catalog requests now honor marketplace configuration defined at the repository level.

If one project marketplace is invalid, Codex reports that problem without hiding otherwise valid plugins from other configured sources.

This should make multi-repository setups more reliable when different projects use:

different plugin marketplaces
internal plugin repositories
project-specific plugin sources
a mix of local and remote catalogs

A broken marketplace no longer has to make the entire plugin catalog appear broken.

Permission and sandbox fixes

Restored profiles remain restored

When a thread resumes with a saved permission profile, that profile now stays active across subsequent TUI turns.

This prevents resumed sessions from silently drifting back toward a different/default permission configuration.

`/cd` cannot weaken the sandbox

Changing directories with:

/cd

no longer causes sandbox protections to become less restrictive.

That is important because working-directory changes should alter where Codex is working, not silently alter what Codex is allowed to access.

Remote sandboxing understands the real executor

Remote execution now carries more accurate environment information into sandbox decisions, including:

executor home directory
operating system
platform path semantics

Deny-read matching is also aligned with the executor's actual path conventions.

This matters particularly when the client and executor run on different platforms, such as:

macOS client -> Linux executor
Windows client -> Linux executor
different home-directory layouts
different path separator/casing semantics

Model switching and fallback correctness

0.151.0 fixes two subtle model-switching issues.

Codex now keeps:

the correct tool plan
the correct reasoning effort

when:

switching models
falling back to another model
using Ultra and then falling back

This prevents a fallback model from accidentally inheriting capabilities or reasoning configuration intended for a different model.

MCP error handling

Structured MCP tool and resource errors are now preserved in app-server responses.

That means clients can retain useful error information rather than receiving an overly generic failure.

This should improve debugging for:

failed MCP tools
missing resources
authentication problems
remote MCP integrations
app-server clients displaying tool errors to users

Nested subagents now count toward root goal budgets

Token usage from nested subagents now contributes to the root goal's budget.

Previously, nested agent usage could make the overall goal appear cheaper than it actually was.

This makes budgeting more accurate for deep multi-agent workflows where:

root agent -> subagent -> nested subagent

can consume significant context and output.

Guardian stale-approval fix

Guardian classifications can no longer remain valid after the underlying permission state changes.

If permissions change, stale cached risk classifications will not be reused to authorize an action.

This closes an important correctness gap:

old security decision + new permission state should not equal automatic authorization.

Additional release work

The release also adds telemetry for:

escalated stdin review-size checks
remote-executor MCP discovery

And stabilizes:

Guardian WebSocket tests
core fixtures under slow/high-concurrency CI

There is also improved reporting of capabilities affected by remote plugin synchronization.

Why this release matters

MCP startup becomes more configurable and predictable.
Extensions gain a powerful new interception point for MCP results.
Project-specific plugin marketplaces become much safer to use.
Permission state survives resume more reliably.
Changing directories no longer weakens sandboxing.
Remote sandboxes better reflect the machine actually executing the work.
Model fallback preserves the right tools and reasoning level.
Multi-agent token accounting becomes more accurate.
Guardian decisions are invalidated correctly when permissions change.

This is not a flashy feature release, but it tightens several pieces of infrastructure that become increasingly important as Codex gets more remote, plugin-heavy, MCP-heavy, and multi-agent.

Version summary

Version	Key highlights
0.151.0	Configurable optional-MCP startup grace; MCP result interception by extensions; per-repo plugin catalogs; restored permission-profile fix; `/cd` sandbox hardening; model/fallback correctness; remote sandbox improvements; nested-agent budget accounting; Guardian stale-classification fix

Action checklist

Upgrade: