Ecosystem Update - 2026-04-25

TL;DR

• Official Codex docs expose per-MCP startup_timeout_sec and tool_timeout_sec; local stdio MCPs now use explicit conservative timeouts.
• OpenAI Codex releases are ahead of the installed CLI (0.123.0 was visible upstream, local CLI is 0.122.0); worth upgrading separately, not as a config edit.
• The most relevant research signal is tool/schema gating and policy re-injection under long-context pressure, but both need deliberate runtime work rather than quick config changes.

Quick Wins

Auto-Implemented

• Added explicit timeouts to mcp_servers.omni-mem and mcp_servers.stitch in ~/.codex/config.toml.
• Backed up config, hooks, and agent TOML files under ~/.codex/backups/2026-04-25/.

Build Queue

• Codex CLI release upgrade check (config/runtime) - openai/codex releases - local CLI is 0.122.0, while upstream release notes show newer MCP diagnostics and plugin handling. Upgrade intentionally not auto-run because it changes the installed runtime.
• MCP verbose integration in doctor (diagnostic) - openai/codex releases - once the local CLI supports /mcp verbose, extend codex-runtime-doctor to include richer MCP resource/template diagnostics.
• Tool schema gating for MCP-heavy sessions (research) - arXiv 2604.21816 - current setup has several MCP servers; lazy schema/tool gating is relevant but needs native Codex support or a focused wrapper design.
• Policy re-injection after compaction (hook/research) - arXiv 2604.20911 and Boris's PostCompact note - Codex currently has PreCompact, not confirmed PostCompact; keep as a watch item unless Codex exposes a matching hook.

Research

• Tool Attention Is All You Need - directly relevant to reducing MCP/tools context tax with multiple configured servers.
• Security-Recall Divergence - supports the existing PreCompact memory/policy emphasis and argues for future post-compaction policy re-injection when Codex supports it.
• AgentFlow / multi-agent harness synthesis - relevant to governed runtime design, but too heavyweight for config-only adoption.

Already Have

OpenAI developer docs MCP, plugin feature enabled, custom subagents, read-only reviewer/validator agents, lifecycle hooks for SessionStart/Stop/PreCompact, omni-mem persistence, route manifest, planning-gate/governed autonomy rules, security/review skills, runtime doctor, conservative cleanup tool.

Rejected

• Large Claude toolkit import - overengineering; current skills already cover the useful categories and outside skills require strict audit first.
• PostCompact hook wiring - not pulled into Codex config because current verified Codex hooks are SessionStart/PreToolUse/PermissionRequest/PostToolUse/UserPromptSubmit/Stop, while current config already has PreCompact through the app runtime.
• Native Codex memories feature - current memory policy intentionally uses omni-mem, and enabling a second memory substrate would add drift.
• Direct plugin/skill packs from search results - require external-skill audit and are not quick config changes.

Sources checked: https://github.com/hesreallyhim/awesome-claude-code, https://howborisusesclaudecode.com/, https://github.com/shanraisshan/codex-cli-best-practice, https://arxiv.org/search/?searchtype=all&query=LLM+agent+coding&order=-announced_date_first, https://github.com/rohitg00/awesome-claude-code-toolkit, https://developers.openai.com/codex/, https://developers.openai.com/codex/mcp, https://developers.openai.com/codex/hooks, https://github.com/openai/codex/releases Tier 2 fetched: yes Tier 3 fetched: yes Run at: 2026-04-25T04:38:23Z