Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix Codex auto-mirrors Claude Code marketplaces, breaking MCP handshake for Claude-only plugins [1 participants]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…
GitHub stats
openai/codex#19372•Fetched 2026-04-25 06:10:31
View on GitHub
Comments
0
Participants
1
Timeline
6
Reactions
0
Author
Con-BenkslCon-Benksl
Participants
Con-BenkslCon-Benksl
Timeline (top)
labeled ×4cross-referenced ×1unlabeled ×1

Error Message

This is a separate error but the user experience is the same — two startup warnings before any work begins.

Root Cause

When those marketplaces contain plugins designed only for Claude Code
(using ${CLAUDE_PLUGIN_ROOT} in .mcp.json — e.g., claude-mem),
Codex tries to launch their MCP servers at startup. Because Codex does
not substitute ${CLAUDE_PLUGIN_ROOT}, the command resolves to an
invalid path and the MCP handshake fails.

Fix Action

Fix / Workaround

Workaround

  **Current workaround**

Code Example

[plugins]                                                                                                                                                      
  auto_discover_claude_marketplaces = false                                                                                                                    
  2. Skip any plugin whose .mcp.json references ${CLAUDE_PLUGIN_ROOT}
  (or any unresolved variable) instead of attempting the handshake.                                                                                              
  3. Only import marketplaces explicitly listed in config.toml.    
                                                                                                                                                                 
  Environment                                                                                                                                                    
                                                                                                                                                                 
  - Codex CLI: <your version — run codex --version>                                                                                                              
  - OS: macOS 15.4.0 / Darwin 25.4.0 (arm64)                                               
  - Claude Code installed: yes 

### What steps can reproduce the bug?

**Summary**                                                                              
                                                                                                                                                                 
  Codex CLI auto-mirrors Claude Code marketplaces into `~/.codex/.tmp/marketplaces/` even when the marketplace is **not** declared in `~/.codex/config.toml`.    
  When those marketplaces contain Claude-Code-only plugins (whose `.mcp.json` references `${CLAUDE_PLUGIN_ROOT}`), Codex tries to start their MCP servers at     
  launch, and the handshake always fails because Codex does not substitute that variable.                                                                        
                                                                                           
  **Steps to reproduce**                                                                                                                                       
                                                                                                                                                               
  1. Install Claude Code and install a plugin that uses `${CLAUDE_PLUGIN_ROOT}` in its `.mcp.json` — e.g. `claude-mem` from the `thedotmack` marketplace         
  (https://github.com/thedotmack/claude-mem).
  2. Install Codex CLI (`@openai/codex` v0.124.0). Do **not** add `thedotmack` to `~/.codex/config.toml`.                                                        
  3. Launch Codex.                                                                                                                                               
  4. Observe startup errors:            
     ⚠ MCP client for mcp-search failed to start:                                                                                                                
       MCP startup failed: handshaking with MCP server failed:                                                                                                   
       connection closed: initialize response                                                                                                                    
  5. Check the filesystem:                                                                                                                                       
  - `~/.codex/plugins/cache/thedotmack/claude-mem/12.3.9/` exists                                                                                                
  - `~/.codex/.tmp/marketplaces/thedotmack/` exists                                                                                                              
  - Neither was ever declared in `config.toml` — they were mirrored from `~/.claude/plugins/marketplaces/thedotmack/`.                                           
                                                                                                                                                                 
  **Root cause (from strings inspection of the Codex binary)**                                                                                                   
                                                                                                                                                                 
  The Rust module `core-plugins/src/marketplace_upgrade.rs` scans for `.claude-plugin/marketplace.json` files and registers them as Codex marketplaces. There is 
  no config flag to opt out.                                                                                                                                     
                                                                                           
  ---                            

### What is the expected behavior?

Codex should only load marketplaces that the user has explicitly declared in `~/.codex/config.toml`. Specifically, any of the following would fix the problem:
                                                                                                                                                                 
  1. **Preferred:** add an opt-out config flag:

---

**Current workaround**
                                                                                                                                                                 
  Adding this to `~/.codex/config.toml` for every leaked plugin:
RAW_BUFFERClick to expand / collapse

What version of Codex CLI is running?

v0.124.0

What subscription do you have?

pro 5x

Which model were you using?

No response

What platform is your computer?

macOS

What terminal emulator and version are you using (if applicable)?

Terminal.app

What issue are you seeing?

Problem

Codex CLI scans for .claude-plugin/marketplace.json files and
auto-imports any marketplace it finds into ~/.codex/.tmp/marketplaces/,
even when the marketplace is not declared in ~/.codex/config.toml.

When those marketplaces contain plugins designed only for Claude Code
(using ${CLAUDE_PLUGIN_ROOT} in .mcp.json — e.g., claude-mem),
Codex tries to launch their MCP servers at startup. Because Codex does
not substitute ${CLAUDE_PLUGIN_ROOT}, the command resolves to an
invalid path and the MCP handshake fails.

Reproduction

  1. Install Claude Code and add a marketplace that ships a plugin with
    ${CLAUDE_PLUGIN_ROOT} in its .mcp.json (e.g. thedotmack/claude-mem).
  2. Install Codex CLI. Do not declare the marketplace in config.toml.
  3. Start Codex.
  4. Observe:
    ⚠ MCP client for mcp-search failed to start:
    MCP startup failed: handshaking with MCP server failed:
    connection closed: initialize response

The offending directories ~/.codex/plugins/cache/thedotmack/ and
~/.codex/.tmp/marketplaces/thedotmack/ appear even though the user
never added thedotmack to their Codex config.

Workaround

Users currently have to either:

  • Delete the mirrored cache (will be re-created on next start), or
  • Add [plugins."<name>@<marketplace>"]\nenabled = false to config.toml
    for every leaked plugin

Neither scales as the user installs more Claude Code plugins.

Requested fix (any of)

  1. Add a config.toml flag to opt out of Claude-marketplace discovery:
[plugins]                                                                                                                                                      
auto_discover_claude_marketplaces = false                                                                                                                    
2. Skip any plugin whose .mcp.json references ${CLAUDE_PLUGIN_ROOT}
(or any unresolved variable) instead of attempting the handshake.                                                                                              
3. Only import marketplaces explicitly listed in config.toml.    
                                                                                                                                                               
Environment                                                                                                                                                    
                                                                                                                                                               
- Codex CLI: <your version — run codex --version>                                                                                                              
- OS: macOS 15.4.0 / Darwin 25.4.0 (arm64)                                               
- Claude Code installed: yes 

### What steps can reproduce the bug?

**Summary**                                                                              
                                                                                                                                                               
Codex CLI auto-mirrors Claude Code marketplaces into `~/.codex/.tmp/marketplaces/` even when the marketplace is **not** declared in `~/.codex/config.toml`.    
When those marketplaces contain Claude-Code-only plugins (whose `.mcp.json` references `${CLAUDE_PLUGIN_ROOT}`), Codex tries to start their MCP servers at     
launch, and the handshake always fails because Codex does not substitute that variable.                                                                        
                                                                                         
**Steps to reproduce**                                                                                                                                       
                                                                                                                                                             
1. Install Claude Code and install a plugin that uses `${CLAUDE_PLUGIN_ROOT}` in its `.mcp.json` — e.g. `claude-mem` from the `thedotmack` marketplace         
(https://github.com/thedotmack/claude-mem).
2. Install Codex CLI (`@openai/codex` v0.124.0). Do **not** add `thedotmack` to `~/.codex/config.toml`.                                                        
3. Launch Codex.                                                                                                                                               
4. Observe startup errors:            
   ⚠ MCP client for mcp-search failed to start:                                                                                                                
     MCP startup failed: handshaking with MCP server failed:                                                                                                   
     connection closed: initialize response                                                                                                                    
5. Check the filesystem:                                                                                                                                       
- `~/.codex/plugins/cache/thedotmack/claude-mem/12.3.9/` exists                                                                                                
- `~/.codex/.tmp/marketplaces/thedotmack/` exists                                                                                                              
- Neither was ever declared in `config.toml` — they were mirrored from `~/.claude/plugins/marketplaces/thedotmack/`.                                           
                                                                                                                                                               
**Root cause (from strings inspection of the Codex binary)**                                                                                                   
                                                                                                                                                               
The Rust module `core-plugins/src/marketplace_upgrade.rs` scans for `.claude-plugin/marketplace.json` files and registers them as Codex marketplaces. There is 
no config flag to opt out.                                                                                                                                     
                                                                                         
---                            

### What is the expected behavior?

Codex should only load marketplaces that the user has explicitly declared in `~/.codex/config.toml`. Specifically, any of the following would fix the problem:
                                                                                                                                                               
1. **Preferred:** add an opt-out config flag:                                                                                                                  
   ```toml                                                                                                                                                     
   [plugins]                                                                                                                                                   
   auto_discover_claude_marketplaces = false                                                                                                                   
                                                                                                                                                             
2. Alternative: when Codex finds an MCP server whose command references an unresolved variable like ${CLAUDE_PLUGIN_ROOT}, skip it with a warning instead of   
attempting a doomed handshake.                                                           
3. Minimal: only import marketplaces that the user has explicitly added, and treat .claude-plugin/marketplace.json discovery as purely advisory.               
                                                                              

### Additional information

```markdown                                                                                                                                                  
**Current workaround**
                                                                                                                                                               
Adding this to `~/.codex/config.toml` for every leaked plugin:                                                                                                 
```toml                                                                                                                                                        
[plugins."claude-mem@thedotmack"]                                                                                                                              
enabled = false                                                                          
This doesn't scale — users who install more Claude Code plugins keep hitting new handshake failures.                                                         
                                                                                                                                                               
Environment
                                                                                                                                                               
- Codex CLI: codex-cli 0.124.0                                                                                                                                 
- OS: macOS 15.4.0 / Darwin 25.4.0 (arm64)
- Claude Code installed: yes                                                                                                                                   
- Affected plugin in my setup: claude-mem@thedotmack (12.3.9)                            
                                                                                                                                                               
Related GitHub MCP issue (may or may not be the same root cause)                                                                                               
                                                                                                                                                               
On the same setup, the built-in github@openai-curated plugin also fails to start, with:                                                                        
⚠ GitHub MCP does not support OAuth. Log in by adding a personal access token...         
This is a separate error but the user experience is the same — two startup warnings before any work begins.                                                    
                                                                                                                                                               
---

extent analysis

TL;DR

To fix the issue, add a config flag to opt out of Claude-marketplace discovery or skip plugins with unresolved variables like ${CLAUDE_PLUGIN_ROOT}.

Guidance

  • The issue is caused by Codex CLI auto-mirroring Claude Code marketplaces without a config flag to opt out.
  • To mitigate the issue, users can add [plugins."plugin_name@marketplace"]\nenabled = false to config.toml for every leaked plugin, but this doesn't scale.
  • A possible solution is to add a auto_discover_claude_marketplaces = false flag to config.toml to prevent auto-mirroring.
  • Another solution is to modify the Codex CLI to skip plugins with unresolved variables like ${CLAUDE_PLUGIN_ROOT} instead of attempting a handshake.

Example

[plugins]
auto_discover_claude_marketplaces = false

This config flag would prevent Codex CLI from auto-mirroring Claude Code marketplaces.

Notes

The issue is specific to Codex CLI version 0.124.0 and macOS 15.4.0. The workaround of adding enabled = false to config.toml for every leaked plugin is not scalable and may not be practical for users with multiple plugins.

Recommendation

Apply the workaround of adding auto_discover_claude_marketplaces = false to config.toml until a fixed version of Codex CLI is released. This will prevent auto-mirroring of Claude Code marketplaces and avoid handshake failures.

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#logging issue#authentication issue#prompt issue#agent setup#task chaining

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING