Codex CLI 0.161.0: MCP Login and Bedrock Updates

Codex CLI 0.161.0 adds active-session MCP login, Bedrock features, and permission fixes. OpenAI announced it on October 7; this report was first published on October 8.

Codex CLI 0.161.0: choose the checks that matter

Compatible Bedrock models gain multi-agent V2 and Ultra reasoning; Mantle accepts GovCloud regions. Model and region availability still require separate checks.

GPT-6.1 Sol catalog defaults were already reported in the preceding patch train. See the original Bedrock integration report for that earlier connection work.

Our recommendation is to split upgrade validation into three questions: does the installed binary have the expected version, does the intended connection work, and does the task retain the intended permissions? Record a separate answer to each. For example, successful MCP authentication should not be entered into a release checklist as evidence that an AWS-backed model request worked. Likewise, a visible model name is not a record of the task’s write boundary.

For a Bedrock installation, write down the route, region, selected model, and reasoning setting before changing anything. Keep the last working configuration available. Exercise a capability only in an environment where the team already has authorization and a budget. If Ultra is not advertised for the selected model, record that result rather than substituting another model and reporting the original combination as verified.

Use MCP login without leaving the active session

Use /mcp login SERVER_NAME inside the active terminal session.

The MCP documentation describes local STDIO servers and remote Streamable HTTP servers, with authentication options for supported HTTP connections. It also documents the shell command codex mcp login SERVER_NAME, codex mcp list for configured servers, and /mcp for the terminal’s active servers. The desktop app, CLI, and IDE extension share MCP configuration on the same Codex host.

Use the exact configured server name, not a product nickname. Our suggested validation starts with an already approved server: inspect the server list, identify the expected account, complete its supported authentication flow, and request one harmless read-only operation. This is a proposed check, not a test result from this release.

For instance, ask the agent to retrieve one public documentation page through an existing documentation server and summarize its heading. Compare the returned page with the intended source. Avoid using a write-capable customer database as the first connectivity test; a documentation read answers the connection question without creating business records.

Keep three outcomes separate in your notes: the server is configured, authentication completed, and a tool returned useful data. If login succeeds but the read fails, preserve the server name and exact error. Do not repeatedly add duplicate server entries to solve an authentication or authorization problem. Never paste access tokens into the verification report. A concise record should identify the account boundary without exposing credentials.

Check permissions separately from authentication

Approved broader writes now retain denied reads and network restrictions. Background work preserves originating permissions; explicit launch settings survive reconnection, while implicit settings respect server and saved web-search settings.

The security guide distinguishes the sandbox’s technical limits from the approval policy’s decisions about when an action needs approval. Local CLI defaults constrain writes to the active workspace and keep command network access off. MCP connections and other service surfaces have separate controls; the command network proxy is not a universal filter for every tool.

Our recommended regression check uses a disposable repository and an existing restricted profile. Before starting, list an allowed scratch location, a denied fixture, and a prohibited destination. Use dummy data rather than production secrets. Observe an allowed action, then check that the prohibited actions remain blocked under the same policy. Run only checks permitted by the organization’s testing rules.

Repeat the relevant observations after reconnecting, and record whether the intended explicit settings remain in effect. If your workflow uses a background task, include that path in the checklist rather than assuming a foreground result covers it. Consult the 0.160 recovery report for the preceding release’s context; the new concern is preservation of these specific boundaries.

A failed blocked-action check is a reason to stop the exercise and inspect configuration. Do not widen the policy until the test passes: that would change the acceptance condition instead of demonstrating the intended protection.

Pin the release and keep a small verification record

The CLI overview recommends Git checkpoints around tasks. It documents /status for session details, /permissions for access controls, /model for model selection, and /review for reviewing changes. These commands can help capture an upgrade’s operating context.

The release-specific npm installation is:

npm install -g @openai/codex@0.161.0
codex --version

Our suggested handoff record has five fields: installed version, provider and model, MCP check outcome, permission check outcome, and repository diff. Record failures as failures, with the command and environment needed to reproduce them. If the version output is older, investigate binary selection before drawing conclusions about the new behavior.

Review the diff before promoting any experiment into a normal workflow. Keep account eligibility separate from client installation; the access guide addresses that different question. An upgrade report is useful when it tells the next operator which exact path worked and which remains unverified, without turning one successful observation into a claim about every supported environment.