mcp-agents 0.7.0 → 0.9.0

package/README.md

@@ -47,7 +47,7 @@ Each `--provider` flag maps to a single exposed tool:
 
 | Provider | Tool name | CLI command |
 |----------|-----------|-------------|
-| `claude` | `claude_code` | `claude -p --output-format json` |
+| `claude` | `claude_code` | `claude --model claude-opus-4-8 --effort xhigh -p --output-format json` |
 | `gemini` | `gemini` | `agy --sandbox -p <prompt>` |
 | `codex` | *(pass-through)* | `codex mcp-server` |
 
@@ -58,9 +58,9 @@ Each `--provider` flag maps to a single exposed tool:
 | `prompt` | `string` | yes | The prompt to send to Claude Code |
 | `timeout_ms` | `integer` | no | Timeout in ms (default: 300 000 / 5 minutes) |
 
-Any additional `tools/call` arguments are ignored (for example `model` or `model_reasoning_effort`).
+Any additional `tools/call` arguments are ignored (for example `model`, `effort`, or `config`).
 
-Claude calls run with `--output-format json`; the server parses the JSON payload and returns the assistant `result` text (or an MCP error if `is_error=true`).
+Claude is pinned to `claude-opus-4-8` at effort `xhigh`; callers cannot change the model or effort per call. Calls run with `--output-format json`; the server parses the JSON payload and returns the assistant `result` text (or an MCP error if `is_error=true`).
 
 ### `gemini` parameters
 
@@ -89,17 +89,18 @@ or Gemini during bridge calls.
 Hardcoded defaults: `sandbox_mode=read-only`, `approval_policy=never`,
 `features.multi_agent=false`.
 
-Startup flags set server-wide defaults for the native Codex MCP server. Per-call overrides still work through the native `codex` tool schema, for example:
+Startup flags (`--model`, `--model_reasoning_effort`) set the model and effort for the native Codex MCP server. Per-call `model` and `config` arguments are stripped from `tools/call` before they reach Codex, so a client cannot override the pinned model/effort (or the read-only/never sandbox config) for a single call. For example, this request:
 
 ```json
 {
   "prompt": "Review this diff",
-  "config": {
-    "model_reasoning_effort": "medium"
-  }
+  "model": "gpt-5.5-codex",
+  "config": { "model_reasoning_effort": "medium" }
 }
 ```
 
+is forwarded to Codex as `{ "prompt": "Review this diff" }`. Change the model or effort at server startup instead.
+
 ## Integration with Claude Code
 
 Add entries to your project's `.mcp.json` (requires `npm i -g mcp-agents`):
@@ -132,7 +133,7 @@ Override codex defaults at server startup:
 }
 ```
 
-The startup default can still be overridden for a single Codex tool call by passing `config.model_reasoning_effort` to the native `codex` tool.
+The model and effort are fixed at server startup. Per-call `model` and `config` arguments sent to the native `codex` tool are stripped before reaching Codex, so they cannot override the startup defaults.
 
 Because the bridge runs in an isolated Codex home, inherited MCP servers from your normal
 `~/.codex/config.toml` are intentionally unavailable inside bridged Codex sessions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mcp-agents",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "MCP server that wraps AI CLI tools (Claude Code, Gemini CLI, Codex CLI) for use by any MCP client",
   "type": "module",
   "bin": {

package/server.js

@@ -29,6 +29,14 @@ const VERSION = JSON.parse(
 const DEFAULT_TIMEOUT_MS = 300_000;
 const DEFAULT_CODEX_MODEL = "gpt-5.5";
 const DEFAULT_CODEX_MODEL_REASONING_EFFORT = "xhigh";
+const DEFAULT_CODEX_SANDBOX_MODE = "workspace-write";
+const DEFAULT_CODEX_APPROVAL_POLICY = "never";
+const DEFAULT_CLAUDE_MODEL = "claude-opus-4-8";
+const DEFAULT_CLAUDE_EFFORT = "xhigh";
+// tools/call argument keys stripped from the codex pass-through so callers
+// cannot override the pinned model/effort (or the server's sandbox/approval
+// config) for a single call.
+const CODEX_STRIPPED_TOOL_ARGS = ["model", "config"];
 const MAX_BUFFER_BYTES = 10 * 1024 * 1024;
 const CLAUDE_EMPTY_OUTPUT_MAX_ATTEMPTS = 2;
 const SIGNAL_CODES = { SIGHUP: 1, SIGINT: 2, SIGTERM: 15 };
@@ -44,9 +52,18 @@ const CLI_BACKENDS = {
     command: "claude",
     toolName: "claude_code",
     description:
-      "Run Claude Code CLI with a prompt (via stdin). Supports prompt + optional timeout_ms only; other arguments are ignored.",
+      `Run Claude Code CLI with a prompt (via stdin), pinned to ${DEFAULT_CLAUDE_MODEL} at effort ${DEFAULT_CLAUDE_EFFORT}. Supports prompt + optional timeout_ms only; other arguments (model/effort/config) are ignored.`,
     stdinPrompt: true,
-    buildArgs: () => ["--no-session-persistence", "-p", "--output-format", "json"],
+    buildArgs: () => [
+      "--model",
+      DEFAULT_CLAUDE_MODEL,
+      "--effort",
+      DEFAULT_CLAUDE_EFFORT,
+      "--no-session-persistence",
+      "-p",
+      "--output-format",
+      "json",
+    ],
     extraProperties: {},
   },
   gemini: {
@@ -127,6 +144,10 @@ Options:
   --provider <name>              CLI backend to use (${providers}) [default: codex]
   --model <model>                Codex model [default: ${DEFAULT_CODEX_MODEL}]
   --model_reasoning_effort <e>   Codex reasoning effort [default: ${DEFAULT_CODEX_MODEL_REASONING_EFFORT}]
+  --sandbox_mode <mode>          Codex sandbox mode: read-only, workspace-write,
+                                 danger-full-access [default: ${DEFAULT_CODEX_SANDBOX_MODE}]
+  --approval_policy <policy>     Codex approval policy: untrusted, on-failure,
+                                 on-request, never [default: ${DEFAULT_CODEX_APPROVAL_POLICY}]
   --timeout <seconds>            Default timeout per call [default: 300]
   --help, -h                     Show this help message
   --version, -v                  Show version number`);
@@ -134,14 +155,17 @@ Options:
 
 /**
  * Parse CLI flags from process.argv.
- * Handles --help, --version, --provider, --model, --model_reasoning_effort, and unknown flags.
- * @returns {{ provider: string, model?: string, modelReasoningEffort?: string, defaultTimeoutMs?: number }}
+ * Handles --help, --version, --provider, --model, --model_reasoning_effort,
+ * --sandbox_mode, --approval_policy, and unknown flags.
+ * @returns {{ provider: string, model?: string, modelReasoningEffort?: string, sandboxMode?: string, approvalPolicy?: string, defaultTimeoutMs?: number }}
  */
 function parseArgs() {
   const args = process.argv.slice(2);
   let provider = "codex";
   let model;
   let modelReasoningEffort;
+  let sandboxMode;
+  let approvalPolicy;
   let defaultTimeoutMs;
 
   for (let i = 0; i < args.length; i++) {
@@ -179,6 +203,20 @@ function parseArgs() {
         }
         modelReasoningEffort = args[++i];
         break;
+      case "--sandbox_mode":
+        if (i + 1 >= args.length) {
+          process.stderr.write("error: --sandbox_mode requires a value\n");
+          process.exit(1);
+        }
+        sandboxMode = args[++i];
+        break;
+      case "--approval_policy":
+        if (i + 1 >= args.length) {
+          process.stderr.write("error: --approval_policy requires a value\n");
+          process.exit(1);
+        }
+        approvalPolicy = args[++i];
+        break;
       case "--timeout": {
         if (i + 1 >= args.length) {
           process.stderr.write("error: --timeout requires a value\n");
@@ -198,7 +236,14 @@ function parseArgs() {
     }
   }
 
-  return { provider, model, modelReasoningEffort, defaultTimeoutMs };
+  return {
+    provider,
+    model,
+    modelReasoningEffort,
+    sandboxMode,
+    approvalPolicy,
+    defaultTimeoutMs,
+  };
 }
 
 /**
@@ -342,15 +387,20 @@ function toTomlString(value) {
 
 /**
  * Build the minimal config for the isolated Codex bridge runtime.
- * @param {{ model: string, modelReasoningEffort: string }} opts
+ * @param {{ model: string, modelReasoningEffort: string, sandboxMode: string, approvalPolicy: string }} opts
  * @returns {string}
  */
-function buildCodexBridgeConfig({ model, modelReasoningEffort }) {
+function buildCodexBridgeConfig({
+  model,
+  modelReasoningEffort,
+  sandboxMode,
+  approvalPolicy,
+}) {
   return [
     `model = ${toTomlString(model)}`,
     `model_reasoning_effort = ${toTomlString(modelReasoningEffort)}`,
-    'approval_policy = "never"',
-    'sandbox_mode = "read-only"',
+    `approval_policy = ${toTomlString(approvalPolicy)}`,
+    `sandbox_mode = ${toTomlString(sandboxMode)}`,
     "",
     "[features]",
     "multi_agent = false",
@@ -360,10 +410,15 @@ function buildCodexBridgeConfig({ model, modelReasoningEffort }) {
 
 /**
  * Create an isolated Codex home that preserves auth but strips inherited MCP servers.
- * @param {{ model: string, modelReasoningEffort: string }} opts
+ * @param {{ model: string, modelReasoningEffort: string, sandboxMode: string, approvalPolicy: string }} opts
  * @returns {string}
  */
-function createIsolatedCodexHome({ model, modelReasoningEffort }) {
+function createIsolatedCodexHome({
+  model,
+  modelReasoningEffort,
+  sandboxMode,
+  approvalPolicy,
+}) {
   const codexHome = mkdtempSync(join(tmpdir(), "mcp-agents-codex-"));
   const sourceAuthPath = join(resolveCodexHome(), "auth.json");
   const targetAuthPath = join(codexHome, "auth.json");
@@ -375,7 +430,12 @@ function createIsolatedCodexHome({ model, modelReasoningEffort }) {
 
   writeFileSync(
     configPath,
-    buildCodexBridgeConfig({ model, modelReasoningEffort }),
+    buildCodexBridgeConfig({
+      model,
+      modelReasoningEffort,
+      sandboxMode,
+      approvalPolicy,
+    }),
     "utf8",
   );
 
@@ -383,19 +443,66 @@ function createIsolatedCodexHome({ model, modelReasoningEffort }) {
 }
 
 /**
- * Spawn codex mcp-server as a pass-through, piping stdio directly.
- * @param {{ model?: string, modelReasoningEffort?: string }} opts
+ * Filter a single newline-delimited JSON-RPC message on its way to the codex
+ * pass-through. Strips per-call model/config overrides from `tools/call` so the
+ * client cannot escape the pinned model/effort (or the sandbox/approval config).
+ * Non-`tools/call` and unparseable lines are returned byte-for-byte unchanged so
+ * the MCP framing is preserved.
+ * @param {string} line
+ * @returns {string}
  */
-function runCodexPassthrough({ model, modelReasoningEffort }) {
+function filterCodexToolCall(line) {
+  const trimmed = line.trim();
+  if (!trimmed) return line;
+
+  let msg;
+  try {
+    msg = JSON.parse(trimmed);
+  } catch {
+    return line; // not JSON (e.g. partial/keepalive) — pass through untouched
+  }
+
+  const args =
+    msg && typeof msg === "object" && msg.method === "tools/call"
+      ? msg.params?.arguments
+      : null;
+  if (!args || typeof args !== "object") return line;
+
+  const stripped = CODEX_STRIPPED_TOOL_ARGS.filter((key) => key in args);
+  if (stripped.length === 0) return line;
+
+  for (const key of stripped) delete args[key];
+  logErr(
+    `[mcp-agents] codex passthrough: ignoring per-call overrides: ${stripped.join(", ")}`,
+  );
+  return JSON.stringify(msg);
+}
+
+/**
+ * Spawn codex mcp-server as a pass-through. stdout/stderr flow straight back to
+ * the client, but the client's stdin is intercepted line-by-line so per-call
+ * model/config overrides are stripped before reaching codex.
+ * @param {{ model?: string, modelReasoningEffort?: string, sandboxMode?: string, approvalPolicy?: string }} opts
+ */
+function runCodexPassthrough({
+  model,
+  modelReasoningEffort,
+  sandboxMode,
+  approvalPolicy,
+}) {
   const resolvedModel = model || DEFAULT_CODEX_MODEL;
   const resolvedModelReasoningEffort =
     modelReasoningEffort || DEFAULT_CODEX_MODEL_REASONING_EFFORT;
+  const resolvedSandboxMode = sandboxMode || DEFAULT_CODEX_SANDBOX_MODE;
+  const resolvedApprovalPolicy = approvalPolicy || DEFAULT_CODEX_APPROVAL_POLICY;
   let isolatedCodexHome;
 
   try {
     isolatedCodexHome = createIsolatedCodexHome({
       model: resolvedModel,
       modelReasoningEffort: resolvedModelReasoningEffort,
+      sandboxMode: resolvedSandboxMode,
+      approvalPolicy: resolvedApprovalPolicy,
     });
   } catch (err) {
     const msg = err instanceof Error ? err.message : String(err);
@@ -420,18 +527,41 @@ function runCodexPassthrough({ model, modelReasoningEffort }) {
 
   logErr(
     `[mcp-agents] passthrough: codex ${args.join(" ")} ` +
-      `(model=${resolvedModel}, reasoning_effort=${resolvedModelReasoningEffort}, isolated_home=true)`,
+      `(model=${resolvedModel}, reasoning_effort=${resolvedModelReasoningEffort}, ` +
+      `sandbox_mode=${resolvedSandboxMode}, approval_policy=${resolvedApprovalPolicy}, ` +
+      `isolated_home=true)`,
   );
 
   const child = spawn("codex", args, {
     env: { ...process.env, CODEX_HOME: isolatedCodexHome },
-    stdio: ["inherit", "inherit", "pipe"],
+    // stdin is piped (not inherited) so we can strip per-call overrides;
+    // stdout stays inherited so codex responses reach the client untouched.
+    stdio: ["pipe", "inherit", "pipe"],
   });
 
   child.stderr.on("data", (chunk) => {
     logErr(`[codex] ${chunk.toString().trimEnd()}`);
   });
 
+  // Pump client stdin -> codex stdin, splitting on newlines (MCP stdio framing)
+  // so each JSON-RPC message can be filtered before forwarding.
+  child.stdin.on("error", () => {}); // ignore EPIPE if codex exits early
+  let stdinBuf = "";
+  process.stdin.on("data", (chunk) => {
+    stdinBuf += chunk.toString("utf8");
+    let nl;
+    while ((nl = stdinBuf.indexOf("\n")) !== -1) {
+      const line = stdinBuf.slice(0, nl);
+      stdinBuf = stdinBuf.slice(nl + 1);
+      child.stdin.write(`${filterCodexToolCall(line)}\n`);
+    }
+  });
+  process.stdin.on("error", () => {});
+  process.stdin.on("end", () => {
+    if (stdinBuf.length > 0) child.stdin.write(filterCodexToolCall(stdinBuf));
+    child.stdin.end();
+  });
+
   for (const sig of ["SIGTERM", "SIGINT", "SIGHUP"]) {
     process.once(sig, () => {
       child.kill(sig);
@@ -466,7 +596,14 @@ function runCodexPassthrough({ model, modelReasoningEffort }) {
 // ---------------------------------------------------------------------------
 
 async function main() {
-  const { provider: providerName, model, modelReasoningEffort, defaultTimeoutMs } = parseArgs();
+  const {
+    provider: providerName,
+    model,
+    modelReasoningEffort,
+    sandboxMode,
+    approvalPolicy,
+    defaultTimeoutMs,
+  } = parseArgs();
   const backend = CLI_BACKENDS[providerName];
 
   if (!backend) {
@@ -477,7 +614,12 @@ async function main() {
   }
 
   if (backend.passthrough) {
-    runCodexPassthrough({ model, modelReasoningEffort });
+    runCodexPassthrough({
+      model,
+      modelReasoningEffort,
+      sandboxMode,
+      approvalPolicy,
+    });
     return;
   }