Codex CLI 0.161.0: In-Session MCP Login and Enterprise Auth

Ethan Park

Morning. Quick thanks to Jellypod for helping make this daily show a reality. Today's change is small to type and useful if you work with MCP servers. Codex CLI 0.161.0 shipped on October 7, and it adds a slash command: /mcp login, followed by the server name.

Maya

The release notes say you can sign in to MCP servers from an active terminal session. So instead of handling authentication somewhere else, you do it from inside the session you're already in. For example, /mcp login and then the name of a server you've configured. I'd use the exact name from your config, since that's what the command takes.

Ethan Park

The enterprise side of the release explains why this matters. The changelog lists several pull requests around enterprise MCP auth. One restricts enterprise MCP authentication and makes it fail closed when the config refreshes. Another enables enterprise sign in and adds account scoped grant cleanup. A third discovers and validates MCP authorization servers before the token exchange.

Maya

Let me translate. Fail closed means if the config refresh goes wrong, you get a refusal instead of a quiet fallback. Account scoped grant cleanup means grants are tied to the account, so they get cleaned up per account. Validating the authorization server first means Codex checks where it's sending you before the exchange happens. Those are the release's titles, and the details sit in the pull requests, so read them before you rely on specifics.

Ethan Park

One more related change is about documentation. Authentication guidance now accounts for keyring storage, instead of implying your credentials always live in auth.json. If you audit where secrets sit on developer machines, check that your assumptions match.

Maya

Practical caveat, then. This is a terminal session command, so it assumes you're in the interactive interface. And the enterprise hardening is aimed at managed setups, so behavior may differ depending on your organization's configuration.

Maya

Now the smaller items. Approved filesystem escalation can grant broader write access while preserving denied reads and network restrictions. Background tasks also keep the permissions of the turn that started them. If you run long background work, that's worth knowing.

Ethan Park

Daybreak is now opt in. You enable it with the enable flag naming cli_daybreak, or set features.cli_daybreak to true in config. Setting daybreak to true alone is not enough. Without it, the controls are hidden and the slash daybreak command is unavailable. Separately, codex exec has a cyber access program flag, and the TypeScript SDK has a cyberAccessProgram option, for choosing a program per turn.

Maya

A few quality of life fixes too. Voice conversations let you choose your microphone, speaker, and input channels, saved locally. Enter now submits buffered input after paste detection expires, including in Vim insert mode. And startup detects recoverable SQLite corruption earlier and keeps the damaged database as a backup.

Ethan Park

Also, GPT 6.1 Sol is now the default model in the bundled and Amazon Bedrock catalogs. If you pin models in scripts, check what your defaults resolve to. Update to 0.161.0, run /mcp login on one server, and see how it goes.