Codex gets portable Agent Plugins, MCP 2026-07-28 support, and Bedrock caching

Codex v0.147.0, released on 7 August 2026, is a substantial update. The headline addition is support for portable Agent Plugins, but the release also catches up to the MCP 2026-07-28 protocol spec, enables Amazon Bedrock caching, overhauls approval workflows, and tidies up how conversations are organised. Here is what each of those changes actually means in practice.

Portable Agent Plugins: write once, install anywhere

The biggest shift in this release is the arrival of portable Agent Plugins, built on the Agent Plugins 1.0.0 standard published on 6 August 2026 by a Technical Steering Committee drawn from Amazon, Cursor, Microsoft, OpenAI, and Vercel, with Google joining on the same day.

The format is deliberately plain: a plugin is a directory containing a plugin.json manifest, an optional skills/ folder holding Agent Skills, and an optional mcp.json file pointing to MCP servers. A plain directory was chosen over a compressed archive so that plugins stay inspectable with standard tools (ls, cat, git) and editable in place during development.

Codex can now search across four plugin catalogs: local (on your machine), personal (your own published plugins), workspace (shared across a team), and remote (marketplace or registry sources). The same plugin you install in Codex works in ChatGPT, Cursor, GitHub Copilot, Kiro, and VS Code without rearranging files or rewriting manifests for each client.

If you have already been building Agent Skills or MCP servers, Agent Plugins is not a competing format. It is the packaging layer that sits on top of both. A deployment assistant plugin, for example, might bundle a Skill describing how your team prepares and rolls back a release alongside an MCP server that connects the agent to your deployment platform. Install the plugin once and both pieces arrive together.

One important caveat to note: version 1.0.0 defines only the package format. Permission models, sandboxing, signature verification, and secrets handling are all listed as future work. The spec is a foundation, not a finished security system.

Marketplace plugin sharing is available for ChatGPT Business from 7 August 2026. Enterprise support is described as coming soon.

MCP 2026-07-28 protocol support

Codex now offers opt-in support for the MCP 2026-07-28 revision. Three things change for servers that adopt it.

Paginated discovery means large tool catalogs stream in pages rather than arriving as one oversized listing, which previously caused performance problems for servers exposing many tools.

Multi-round requests allow a server to hold a multi-step exchange within a single logical request, which is useful for tools that require iterative back-and-forth before they can return a result.

Non-blocking server startup exposes cached MCP tools before the server finishes initialising, so a slow server no longer stalls the start of a Codex session.

Servers on the previous revision are unaffected. The opt-in design means you can migrate at your own pace.

Amazon Bedrock caching

Cached web search and remote conversation compaction are now enabled for Amazon Bedrock users. Support for Amazon Bedrock GPT-5.6 models with reasoning effort has also been added. In practice this means faster responses and lower token costs on repeated queries, which matters most in long-running or repetitive agent workflows.

Smarter approval workflows

A new --approve-for-me CLI flag lets Codex automatically review and approve certain actions without interrupting your session. Safer automatic-review defaults are applied for cyber-capable models, and Codex now explains permission changes in the terminal rather than silently adjusting them.

For solo developers working in a trusted environment, --approve-for-me removes a significant amount of friction. For teams, the new defaults for cyber-capable models provide a sensible baseline before anyone thinks to configure it manually.

Conversation organisation

Long conversations can now be browsed incrementally rather than loading everything at once, which helps with performance on extended sessions. Conversations can be grouped into persistent, manually ordered sections, giving you a way to keep related threads together without relying on search alone. Cursor-managed skills can be imported, and changes to imported Claude and Cursor conversations are synchronised without creating duplicates.

Security and reliability fixes

Secrets and complete bearer tokens are now redacted from displayed commands and replayed conversation history. Codex requires explicit trust before working with unfamiliar local projects, and it enforces managed authentication restrictions before using credentials. Plugin isolation has been hardened, and network access is denied when a policy update fails rather than proceeding with a stale policy.

On the reliability side, terminal input that was previously lost when focus returned, when MCP servers initialised, or when Ghostty handled keyboard shortcuts is now fixed. Rendering of Japanese characters, emoji, hyperlinks, and text near viewport boundaries is corrected. Windows background processes are properly interrupted, and Windows filesystem paths are handled consistently.

A few housekeeping notes

The deprecated codex exec --full-auto flag has been removed. If you were using it, switch to --sandbox workspace-write. The MCP SDK has been upgraded to 3.0.0, Ratatui to 0.30.2, and V8 to 150.4.0. macOS release notarisation now uses Azure Key Vault instead of exporting private signing keys.

One date to put in your calendar: from 31 August 2026, GPT-5.4 and GPT-5.4 mini will no longer be available in Codex for users signed in with ChatGPT. They remain available via the OpenAI API and for sessions authenticated with an API key.

What this means for you

If you use Codex regularly, the Agent Plugins addition is the one to watch. The ability to package a skill and its tooling together, install it from a searchable catalog, and have it work across six different agent clients removes a meaningful amount of repeated setup work. The standard is young and the security model is still being built, so treat third-party plugins with the same caution you would any early-stage package ecosystem.

The MCP 2026-07-28 improvements are most relevant if you maintain MCP servers with large tool catalogs or slow startup times. For everyone else, the Bedrock caching, approval workflow changes, and conversation organisation improvements are quality-of-life gains that accumulate quickly across a working day.