# Codex CLI 0.147: Test Agent Plugins, Approvals, and MCP Separately

> Source: <https://dev.to/yan_gao_3ad90a90b26925538/codex-cli-0147-test-agent-plugins-approvals-and-mcp-separately-6h4>
> Published: 2026-08-15 18:42:09+00:00

Codex CLI 0.147 combines several changes that affect different trust boundaries. Treating the upgrade as one pass/fail event misses the failures that matter.

Test five things independently:

`--approve-for-me`

boundary.A successful launch proves only that Codex started. It does not prove that plugin provenance, approval scope, protocol negotiation, imported context, or process cleanup are correct.

Portable plugins can move instructions, tools, apps, and supporting files between environments. Before activation, record:

Then disable the plugin and start a fresh session. The capability should disappear. Catalog visibility is not execution proof.

`--approve-for-me`

is not unrestricted execution
The flag adds automatic approval review. It does not erase the sandbox, network policy, managed restrictions, or the need to verify side effects.

Use a disposable workspace and check:

Codex 0.147 also removes the deprecated `codex exec --full-auto`

shortcut. Unattended workflows should declare sandbox and approval behavior explicitly.

Opt-in MCP 2026-07-28 support adds capabilities such as paginated discovery and multi-round requests. A connected server can still fail during tool discovery, schema validation, one invocation, or response handling.

Record the negotiated protocol version, enumerate tools, call one bounded tool, and verify the artifact outside Codex.

Cursor-managed skills and imported Claude or Cursor conversations increase reusable context. They also increase the chance of stale instructions, duplicate guidance, and hidden conflicts.

Pin the source, inspect references, run a known-answer task, and confirm which instruction won when scopes conflict.

The release includes Windows process and path fixes. Verify them by starting a harmless bounded background task, interrupting it, and checking both the process tree and expected artifact state. A quiet terminal is not proof that the child process stopped.

Upgrade only when every boundary has its own evidence receipt. If one check fails, roll back or disable only that capability instead of deleting unrelated configuration.

Official release:

[https://github.com/openai/codex/releases/tag/rust-v0.147.0](https://github.com/openai/codex/releases/tag/rust-v0.147.0)

Complete source-linked analysis and acceptance checklist:

[https://tgwise.com/intelligence/codex-cli-0-147-agent-plugins-approve-for-me-mcp/](https://tgwise.com/intelligence/codex-cli-0-147-agent-plugins-approve-for-me-mcp/)