Vet a Tool's "Reply" Before the Model Reads It — Codex 0.151 Adds a Rewritable Checkpoint on MCP Return Values

OpenAI's coding agent "Codex" shipped rust-v0.151.0 on August 29. The headline change: results returned by external tools (MCP servers) can now be inspected and rewritten on the extension side before the model ever reads them. Since 0.149, which this series covered last time, a run of smaller updates has continued through 0.150. Here's a recap of that arc.

Intervening on the "return," not the entry

Until now, an agent's control points sat mainly before a tool was called: insert an approval, halt execution — checkpoints on the way in. What 0.151.0 adds is on the way out: a hook that interrupts the value a tool returns before it reaches the model.

In OpenAI's own words, "extensions can inspect and replace the results of MCP tools before they reach the model." The difference is that you can now process the returned content itself on your side, not just gate whether the call happens.

Here are some cases where this pays off:

• Stripping suspicious instructions: cut out "instructions to the AI" embedded in text returned by an external page or document before the model reads it. This can serve as one countermeasure against prompt injection.
• Masking secrets: hide keys or tokens mixed into a tool's return value before handing it to the model.
• Curbing output volume: summarize or trim a huge response before passing it along, saving both context and cost.

In every case, all you get is the ability to "place" the hook — what to strip and what to keep is code you write. The mechanism has been handed out, but the judgment stays in your hands.

A grace period for "the tools aren't all there right after startup"

The same 0.151.0 lets you set a grace period for tool discovery on optionally connected MCP servers. It addresses the miss where a server that takes time to connect hasn't finished exposing its tools right after startup.

Along with that, the plugin catalog was fixed to bundle per-repository settings and to stop a broken registration from dragging valid plugins into hiding with it. The more you run things unattended, the more these "startup oversights" matter.

The groundwork laid in 0.150

Released three days earlier, 0.150.0 (August 26) was the version that beefed up terminal handling all at once. The main additions:

• Cross-referencing tasks: reference other Codex tasks with @ and direct reading, creating, and relaying from the terminal.
• Interrupt hooks: run a command or MCP handler when an in-flight turn is interrupted. Paired with this release's "exit hook," it lets you slot in cleanup at interruption time.
• Permission-mode toggle shortcut: cycle approval strength with a single key, and repeat the last edit with a Vim-style ..
• Small refinements: auto-titling for unnamed tasks, selection copy via /copy, and clickable Markdown links.

0.150.1 (August 27) was a small fix that made remote context compaction count retained images against the token budget too.

The autonomy groundwork keeps going

The other half of 0.151.0 was fixes plugging holes in setups meant to run unattended for long stretches. The notable ones:

• Permission profiles are now retained across turns, so /cd no longer weakens the sandbox's restrictions.
• Closed a hole where a stale Guardian (safety-judgment) classification would let an action through even after permissions changed.
• Tokens used by nested subagents are now rolled into the parent goal's budget.
• Switching models or falling back to a different one no longer leaves the available tools and reasoning strength out of sync.

None of these are flashy, but the more a feature assumes running without an approval step, the more this kind of "quiet drift" leads straight to accidents.

Adoption, and the flip side you don't want to miss

The exit hook is strictly a port you write and plug in yourself as an extension. It doesn't vet the contents for you by default. The safe path is to first observe return values passing through untouched, narrow down your stripping conditions, and only then enable it.

At the same time, a "checkpoint" like this is itself a new thing to watch. The power to rewrite a tool's results is potent, and some point out that a sloppily built extension could turn this into a fresh attack surface. Strip a legitimate result by mistake and the model quietly proceeds missing information. You could see it as a trade: convenience in exchange for having the implementation quality of your inspection point itself put to the test.

Even so, it's a step beyond the era of "piping externally returned strings to the model unchecked." Now that you can intervene at both a tool's entry and its exit, an agent's safety design is opening up more to the operator's discretion.

References: Codex rust-v0.151.0 release notes (GitHub) / rust-v0.150.0 release notes (GitHub) / Codex Releases list / Codex Updates (Releasebot)