Codex rust-v0.152.0 turns the planning tool off by default and adds a per-MCP-tool output token cap

GitHub·high signalXBlueskyLinkedInCopy link

Released 01:58 UTC on 1 September 2026, Codex 0.152.0 demotes `update_plan` to opt-in, so you now need `tools.update_plan.enabled = true` in config to get planning back (#41744). It also adds `output_token_limit` per individual MCP tool with truncation that survives session resume (#41421), allows `:`, `@`, `/` and `.` in MCP server names for package-style naming (#41700), and lets app-server clients set `thread/shellCommand` timeouts past one hour (#41384). On the security side, cloud task requests now reject untrusted backend URLs and refuse redirects to protect saved credentials (#41403), and reviewed terminal input rejects NUL bytes (#41354).