AI coding tools
Codex CLI 0.151.0 Opens MCP Result Interception, Letting Plugins Rewrite Tool Output Before the Model Reads It
The new release adds the `on_mcp_tool_result` lifecycle interface, allowing plugins to inspect or replace successful and error results from MCP. This provides a new control point for data masking and output normalization, while also elevating plugins into an agent trust boundary that requires auditing.
OpenAI released Codex CLI 0.151.0 on August 29. Its most important architectural change is not a user interface feature, but the ability for plugins to intervene in the data path before MCP tool results are sent to the model. The new `ToolLifecycleContributor::on_mcp_tool_result` receives the executed tool’s context, rewritten arguments, plugin data storage, and a mutable server result. It handles both successful responses and structured errors.
This hook runs before the MCP completion event is published and before model input is prepared. Tests show that it can preserve the original result, replace the entire result, or handle errors; both direct MCP calls and Code Mode are covered. For enterprise agent platforms, this means sensitive-field masking, legacy tool-output conversion, result summarization, policy tagging, and test injection no longer require modifying every MCP server. However, a plugin capable of rewriting the facts seen by the model could also conceal errors, tamper with evidence, or inject instructions. Deployments should therefore pin plugin versions, restrict installation sources, and retain both raw and processed results separately for auditing.
Version 0.151.0 also fixes several permission-state issues. Restored conversations now retain their original permission profile, and `/cd` is rejected when the previous sandbox mode cannot be mapped safely. Remote execution now also uses the executor’s actual home directory, operating system, and path semantics. Stale Guardian classifications can no longer be reused after permissions change, while tool lists and reasoning effort during model switching or fallback have also been corrected. These updates show that agent security cannot be limited to checking the final shell command: tool results, model routing, working directories, and cached approvals are all part of the same authorization chain. Key questions going forward are whether plugins will receive more granular permission declarations and whether raw MCP results can be turned into standardized audit records without exposing sensitive content.