io.github.Lykhoyda/ask-codex
NPM · @ASK-LLM/CODEX-MCP · SCANNED AUG 3
Bridge Claude with OpenAI Codex CLI for AI-to-AI collaboration, code review, and second opinions
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security86
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (94 of 98), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 9 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability76
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 850 tokens (~170/item across 5 items; 4 tools + 1 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (50% of tools); any adoption earns full credit.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @ask-llm/codex-mcp
claude mcp add lykhoyda-ask-codex -- npx -y @ask-llm/codex-mcp
codex mcp add lykhoyda-ask-codex -- npx -y @ask-llm/codex-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"lykhoyda-ask-codex": {
"type": "local",
"command": [
"npx",
"-y",
"@ask-llm/codex-mcp"
],
"enabled": true
}
}
} openclaw mcp add lykhoyda-ask-codex --command npx --arg -y --arg @ask-llm/codex-mcp
mcp_servers:
lykhoyda-ask-codex:
command: "npx"
args: ["-y", "@ask-llm/codex-mcp"] {
"mcpServers": {
"lykhoyda-ask-codex": {
"command": "npx",
"args": [
"-y",
"@ask-llm/codex-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 3 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 2 Aug 26 +48
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Schema quality: unverified → good ▲ functional
- Stability: unverified → 0.23 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Maintenance: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- License: unverified → pass ▲ functional
- Tool coverage: unverified → 100 ▲ functional
- Schema quality: unverified → 100 ▲ functional
- Licence: MIT functional
- 1 Aug 26 −5
- Malware scan: unverified → pass ▲ security
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 31 Jul 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 −27
- Security disclosure: fail → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- 27 Jul 26 51
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@ask-llm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 94 packages
94 packages in the resolved dependency tree · 94 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
ask-codex ~455
Send a prompt to OpenAI Codex CLI (defaults to gpt-5.6-sol with automatic fallback on quota errors). Use for code review, second opinions, analysis, and AI-to-AI collaboration. Do not override the model parameter unless the user explicitly asks. Returns both human-readable text and a structured response (provider, model, sessionId, usage) via outputSchema. The returned sessionId field maps to Codex's thread_id and can be passed back as sessionId to continue the conversation.
| Name | Type | Req | Description |
|---|---|---|---|
| includeDirs | array | — | Additional directories Codex may access alongside the working directory (maps to codex `--add-dir`, repeatable). Must be relative paths (e.g., 'packages/api'). Useful in monorepos where relevant cont… |
| model | string | — | DO NOT set this parameter. The tool automatically uses gpt-5.6-sol and falls back to gpt-5.6-terra on quota errors. Only set this if the user explicitly requests a specific model. |
| preferred | boolean | — | Opt into ASK_CODEX_PREFERRED_MODEL when it is configured to differ from the gpt-5.6-sol default. The built-in preferred value is also gpt-5.6-sol, so normal calls and review skills should leave this… |
| prompt | string | yes | The question, code review request, or analysis task to send to Codex CLI |
| reasoningEffort | string | — | Codex reasoning effort for this call. Defaults to medium; /codex-review and /brainstorm use high for quality-first work. |
| sandbox | string | — | Codex sandbox mode for this call. Defaults to 'read-only', which enforces the core review contract (Codex reads and proposes, the MCP client edits). Set 'workspace-write' ONLY as an explicit opt-out… |
| sessionId | string | — | Optional Codex thread ID to resume a prior conversation. Use the [Thread ID: ...] value from a previous response to continue the same chat with full prior context. |
| Name | Type | Req | Description |
|---|---|---|---|
| model | string | yes | — |
| provider | string | yes | — |
| response | string | yes | — |
| sessionId | string | — | — |
| usage | object | — | — |
No examples provided.
ask-codex-edit ~253
Send a code edit request to OpenAI Codex CLI and get structured search/replace edit blocks back (via codex --output-schema). Codex reads the existing files (read-only) and proposes precise, applyable changes for Claude to apply. Use this when you want Codex to suggest specific code modifications to existing files rather than just analysis. Mirrors ask-gemini-edit.
| Name | Type | Req | Description |
|---|---|---|---|
| includeDirs | array | — | Additional directories Codex may read alongside the working directory (maps to codex `--add-dir`). Must be relative paths (e.g., 'packages/api'). Useful in monorepos where relevant context spans sibl… |
| model | string | — | DO NOT set this parameter. The tool automatically uses gpt-5.6-sol and falls back to gpt-5.6-terra on quota errors. |
| prompt | string | yes | Describe the code changes you want against existing files. Codex returns structured search/replace edit blocks (via --output-schema) that can be applied directly. |
| sessionId | string | — | Optional Codex thread ID to resume a prior conversation. Use the [Thread ID: ...] value from a previous response to refine the same edit session. |
No output schema declared.
No examples provided.
get-usage-stats ~81
Get the current MCP server's session usage stats: total LLM calls, token totals (input/output/thinking/cached), wall time, and breakdowns per provider and per model. No data leaves your machine — counts are tracked in-memory for the lifetime of the server process. Returns both human-readable markdown and a structured JSON snapshot via outputSchema.
Input schema present but exposes no named parameters.
| Name | Type | Req | Description |
|---|---|---|---|
| byModel | object | yes | — |
| byProvider | object | yes | — |
| fallbackCount | number | yes | — |
| totalCachedTokens | number | yes | — |
| totalCalls | number | yes | — |
| totalDurationMs | number | yes | — |
| totalInputTokens | number | yes | — |
| totalOutputTokens | number | yes | — |
| totalThinkingTokens | number | yes | — |
No examples provided.
ping ~30
Test connectivity with the MCP server
| Name | Type | Req | Description |
|---|---|---|---|
| message | string | — | A message to echo back to test the connection |
No output schema declared.
No examples provided.