The config.toml reference

Sets when Codex pauses to ask before running a command. String values: untrusted (only known-safe read-only commands …

Names the permission profile applied to sandboxed tool calls in every session. Built-ins are :read-only, :workspace, …

Filesystem access rules for a custom permission profile. Under permissions.<name>.filesystem you map absolute paths o…

Per-directory trust flag in ~/.codex/config.toml. Set trusted and Codex loads that project's .codex/ layers: project-…

sandbox_mode sets how much of your machine Codex can touch when it runs commands: read-only, workspace-write, or dang…

Boolean under [sandbox_workspace_write] that gives sandboxed commands outbound network access. Default is false, so e…

An array of extra directories Codex can write to when sandbox_mode is workspace-write. Out of the box, workspace-writ…

Picks which native Windows sandbox Codex uses when you run it outside WSL. Set elevated for real isolation built from…

Collects anonymous usage and health data and ships it to OpenAI. It's a boolean under an `[analytics]` table, and `an…

Caps the on-disk history file at a byte limit. Codex writes every session transcript to history.jsonl inside $CODEX_H…

history.persistence decides whether Codex writes your session transcripts to history.jsonl. Two values: save-all keep…

The executable Codex spawns to launch a stdio MCP server — a plain string like "npx" or "node", with flags split out …

Environment variables handed to a stdio MCP server, written as a TOML map under [mcp_servers.<id>.env]. Unset by defa…

How long Codex waits for an MCP server to start before giving up. Default is 10 seconds. If a server launches through…

The endpoint URL for a remote MCP server speaking streamable HTTP. Set it instead of command — an entry gets one or t…

Top-level key that sets the web search mode. `cached` (the default) answers from an OpenAI-maintained index with no l…

Sets which model Codex runs, as a plain string id like gpt-5.5 or gpt-5.6. The official reference doesn't publish a d…

Sets the token count where Codex automatically compacts session history to free up context. Unset by default; each mo…

Picks which entry in the [model_providers] table Codex sends requests to. The value is a string id: openai (the defau…

Sets how hard the model thinks before it acts. Values: minimal, low, medium, high, xhigh. Ships unset, so the model's…

Sets how much reasoning-summary text Codex shows while it works: auto, concise, detailed, or none. auto defers to the…

Sets how much the model writes back on GPT-5 family models: low, medium, or high. It only shapes the answer text, and…

An experimental switch that routes a sandboxed session's outbound traffic through a local proxy so you can allow or d…

The API endpoint Codex sends requests to for a custom [model_providers.<id>] entry. No default; you set it when point…

env_key names the environment variable Codex reads to get the API key for a custom model provider. It holds the varia…

oss_provider picks which local model backend Codex talks to when you run `codex --oss` without naming a provider, eit…

Profiles moved out of config.toml. Since 0.134.0 each profile is its own file at $CODEX_HOME/profile-name.config.toml…

Add a server under [mcp_servers.<id>] in ~/.codex/config.toml. Local (stdio) servers get command plus args; remote se…

Codex has an opt-out for almost every background behavior, but the keys are scattered across a dozen config.toml sect…

Two ways to run different Codex configs per project. Profiles are named files at `$CODEX_HOME/<name>.config.toml` you…

The keys people set together to stop approval prompts without handing Codex the keys to everything. Set sandbox_mode …