codex-manual.md +78 −4
5114Use this changelog to see what changed in Codex Security and which plugin5114Use this changelog to see what changed in Codex Security and which plugin
5115versions are available from each installation source.5115versions are available from each installation source.
5116 5116
51175117**Latest release in the hosted Codex Security catalog:** `0.1.15`.**Latest release in the hosted Codex Security catalog:** `0.1.17`.
5118
5119**Latest release in the public Codex CLI plugin marketplace:** `0.1.11`.
5120 5118
5121Check the plugin version in your current Codex environment before you use a5119Check the plugin version in your current Codex environment before you use a
5122feature from a newer release. Reopening or rerunning a saved scan doesn't pin5120feature from a newer release. Reopening or rerunning a saved scan doesn't pin
5125These versions apply to the Codex Security plugin. The Codex app, Codex CLI,5123These versions apply to the Codex Security plugin. The Codex app, Codex CLI,
5126TypeScript SDK, and plugin app have separate version numbers.5124TypeScript SDK, and plugin app have separate version numbers.
5127 5125
5126#### 0.1.17 (August 5, 2026)
5127
5128#### Follow scan progress as it happens
5129
5130- Track the current scan phase, elapsed time, active workers, reviewed files, and
5131 token usage from a single live progress view.
5132- See repository review progress update as files finish instead of waiting for a
5133 scan to complete.
5134
5135#### Resume interrupted deep scans
5136
5137- Continue an in-progress deep scan after its coordinator restarts without
5138 repeating completed file reviews.
5139- Preserve completed discovery results, scan ownership, and pending work across
5140 app updates or interrupted scan sessions.
5141
5142#### Start and complete scans with less overhead
5143
5144- Start standard, change, and deep scans directly in native workflows without
5145 opening the retired embedded scan widget.
5146- Reuse completed scan summaries without reloading every finding unless you
5147 request the complete structured results.
5148
5149#### 0.1.16 (August 4, 2026)
5150
5151#### Track measured scan usage
5152
5153- Review total, input, cached input, and output token usage across the main scan
5154 and its delegated workers.
5155- Distinguish complete, partial, and unavailable measurements instead of showing
5156 missing usage as zero.
5157
5158#### Run deeper scans with consistent results
5159
5160- Use the same threat-modeling, discovery, validation, attack-path analysis, and
5161 reporting phases for standard and deep scans.
5162- Configure deep scan workers, per-worker delegation, saturation, and discovery
5163 limits from the CLI or SDK.
5164- Run deep scans with the model's supported worker runtime and recover older
5165 scan state without losing existing scan history.
5166- Generate the primary report for change and deep scans without requiring
5167 separate vulnerability write-ups or hardening recommendations.
5168
5169#### Keep scan guidance and repository targets accurate
5170
5171- Update security guidance during an active scan and carry it into later phases
5172 and delegated deep scan workers.
5173- Preserve repository URLs, pull request references, and longer security context
5174 without allowing network access you didn't request.
5175- Fail scans when the repository or scan target changes during execution so
5176 automation doesn't accept stale findings.
5177- Honor enterprise proxy and trusted certificate settings in managed network
5178 environments.
5179
5180#### Write clearer vulnerability reports
5181
5182- Produce source-backed vulnerability reports that separate observed behavior
5183 from unverified hypotheses.
5184- Include realistic proof-of-concept limitations, affected versions, security
5185 boundaries, and actionable remediation guidance.
5186
5128#### 0.1.15 (July 30, 2026)5187#### 0.1.15 (July 30, 2026)
5129 5188
5130#### Keep scans accurate as projects change5189#### Keep scans accurate as projects change
5151#### Reduce unnecessary scan work5210#### Reduce unnecessary scan work
5152 5211
5153- Keep standard-scan discovery adaptive to the repository and candidate list.5212- Keep standard-scan discovery adaptive to the repository and candidate list.
51545213- Stop retrying policy failures and remove the legacy fanout prompt.- Stop retrying policy failures and remove the legacy fan-out prompt.
5155 5214
5156#### 0.1.14 (July 28, 2026)5215#### 0.1.14 (July 28, 2026)
5157 5216
18613 18672
18614DCR is still supported. If you include `registration_endpoint`, ChatGPT can register dynamically when the plugin builder chooses DCR or CIMD is not available. ChatGPT runs DCR once per MCP server connection, then keeps and reuses the registered OAuth client for that connection. DCR can still create many registered clients across many separate connections, so CIMD is usually easier to administer at scale.18673DCR is still supported. If you include `registration_endpoint`, ChatGPT can register dynamically when the plugin builder chooses DCR or CIMD is not available. ChatGPT runs DCR once per MCP server connection, then keeps and reuses the registered OAuth client for that connection. DCR can still create many registered clients across many separate connections, so CIMD is usually easier to administer at scale.
18615 18674
18675Keep the registered OAuth client and any client secret valid while the connector is in use. If your authorization server expires, deletes, or replaces either credential, users and reviewers may receive an `invalid_client` error when they connect. Access and refresh tokens can still expire or rotate normally.
18676
18616#### Client identification18677#### Client identification
18617 18678
18618A frequent question is how your MCP server can confirm that a request actually comes from ChatGPT. ChatGPT presents an OpenAI-managed client certificate when connecting to MCP servers, so you can verify the client at the transport layer with mTLS. You can also allowlist ChatGPT’s [published egress IP ranges](https://developers.openai.com/api/docs/guides/ip-addresses). ChatGPT does **not** support machine-to-machine OAuth grants such as client credentials, service accounts, or JWT bearer assertions, nor can it present custom API keys or customer-provided mTLS certificates.18679A frequent question is how your MCP server can confirm that a request actually comes from ChatGPT. ChatGPT presents an OpenAI-managed client certificate when connecting to MCP servers, so you can verify the client at the transport layer with mTLS. You can also allowlist ChatGPT’s [published egress IP ranges](https://developers.openai.com/api/docs/guides/ip-addresses). ChatGPT does **not** support machine-to-machine OAuth grants such as client credentials, service accounts, or JWT bearer assertions, nor can it present custom API keys or customer-provided mTLS certificates.
24484 24545
24485Users may sign in to an existing paid account and access features already included in their subscription. Plugins must not display subscription plans, initiate new subscriptions, or promote upgrades.24546Users may sign in to an existing paid account and access features already included in their subscription. Plugins must not display subscription plans, initiate new subscriptions, or promote upgrades.
24486 24547
24548If a certain plugin feature requires a different plan or entitlement (e.g., a different subscription tier or additional credits) than the user's, the plugin may explain that. This information should help users understand why the feature is unavailable, and should not initiate a checkout or transaction flow.
24549
24550Specifically, plugins may:
24551
24552- Explain that a certain feature is not available with the user’s current plan or entitlement.
24553- Link to an informational page describing available plans or entitlement options.
24554
24555Plugins may not:
24556
24557- Link directly to a checkout or other transactional page.
24558- Link to a page that explicitly initiates the process to upgrade, subscribe, or complete a purchase.
24559
24487In addition, plugins may not be used to sell, promote, facilitate, or meaningfully enable the following goods or services:24560In addition, plugins may not be used to sell, promote, facilitate, or meaningfully enable the following goods or services:
24488 24561
24489#### **Prohibited goods**24562#### **Prohibited goods**
26367 26440
26368- **401 errors:** Include a `WWW-Authenticate` header in the error response so ChatGPT knows to start the OAuth flow again. Double-check issuer URLs and audience claims.26441- **401 errors:** Include a `WWW-Authenticate` header in the error response so ChatGPT knows to start the OAuth flow again. Double-check issuer URLs and audience claims.
26369- **Client registration fails:** If you use CIMD, confirm your authorization server metadata includes `client_id_metadata_document_supported: true` and can fetch ChatGPT's client metadata document. For `private_key_jwt`, confirm your authorization server can fetch ChatGPT's public JWKS and check the signed client assertion. If you use DCR, confirm your authorization server exposes `registration_endpoint` and that newly created clients have at least one login connection enabled.26442- **Client registration fails:** If you use CIMD, confirm your authorization server metadata includes `client_id_metadata_document_supported: true` and can fetch ChatGPT's client metadata document. For `private_key_jwt`, confirm your authorization server can fetch ChatGPT's public JWKS and check the signed client assertion. If you use DCR, confirm your authorization server exposes `registration_endpoint` and that newly created clients have at least one login connection enabled.
26443- **An existing connector returns `invalid_client`:** Confirm that the dynamically registered OAuth client still exists and that your authorization server accepts its client secret, if it has one. ChatGPT reuses these credentials, so restore them instead of creating a new client. An expired access token requires a different fix.
26370 26444
26371#### Deployment problems26445#### Deployment problems
26372 26446