Image: OpenAI / github.com/openai/codex Codex CLI 0.147.0: Agent Plugins, Amazon Bedrock, and a Flag to Stop Asking Permission
Codex CLI's latest update ships portable agent plugins with searchable catalogs, Amazon Bedrock endpoints, stable multi-agent orchestration, and an --approve-for-me flag for hands-off workflows.
OpenAI shipped Codex CLI 0.147.0 on August 7, 2026. The release covers a lot of ground: portable agent plugins, Amazon Bedrock support, stable multi-agent orchestration, and a new flag that removes the approval prompts between agent steps.
Agent Plugins
Codex now supports portable Agent Plugins with searchable catalogs spanning local, personal, workspace, and remote sources. Plugins can be installed, searched, and managed without leaving the CLI. Each plugin runs in an isolated environment with restricted network access, so a plugin can’t reach outside its declared scope.
This is the start of a proper ecosystem for extending Codex’s behavior. Teams that have been hacking together custom scripts or chaining multiple tools can package that logic into a plugin that any team member can install from a shared catalog.
Amazon Bedrock
Codex 0.147.0 adds experimental Amazon Bedrock login with custom endpoint and authentication support. GPT-5.6 Sol is the default Bedrock model. Web search results are cached for Bedrock sessions, which matters for cost control when agents are doing repeated lookups on similar queries.
For teams already running workloads through Bedrock, this removes the need to route Codex sessions through a separate OpenAI endpoint.
Multi-Agent V2 Is Now Stable
Multi-agent V2 shipped as experimental in an earlier release. It’s stable in 0.147.0. The update adds configurable sub-agent models, reasoning levels, and concurrency settings. Different sub-agents in the same workflow can run different models at different reasoning budgets, which helps with cost management on longer pipelines.
—approve-for-me
The --approve-for-me flag lets Codex run a session without stopping for human approval at each step. For CI pipelines and automated workflows where the human review happens before the task starts, the per-step prompt was friction with no benefit.
This isn’t a security bypass. It’s a workflow flag for contexts where you’ve already decided you trust the session. The flag is explicit, not a default.
MCP 2026-07-28 Protocol
Codex now speaks the MCP protocol from the July 28 spec, which includes paginated discovery, multi-round requests, and non-blocking server startup. For setups where Codex is one node in a larger MCP topology, this aligns the version constraints.
Persistent Conversation Sections
Conversations can now be organized into persistent sections with manual ordering and incremental transcript browsing. Long-running sessions that span multiple tasks become easier to navigate when the context is structured rather than a flat scroll.
Security and Stability
The update also adds enhanced secret redaction from displayed commands and conversation history, improved terminal rendering for special characters, and tighter plugin isolation overall.
The 0.146.1 patch that preceded this release adjusted automatic-review defaults for cyber-capable models, which points to the same category of concern Z.ai addressed with GLM-5.3’s delayed weight release: AI tools running in agentic loops need careful defaults around what they surface and review automatically.
Sources: Codex CLI GitHub Release, Releasebot, Codex CLI Changelog