Vibe Coding
Tip: Codex now confines plugin installs and MCP user interaction to the root thread
Two commits in the 0.156.0 alpha range, "Restrict plugin install requests to the root thread" (#45806) and "Keep MCP user interaction on the root thread" (#46066), stop a subagent or spawned thread from installing a plugin or raising an MCP consent prompt on its own. #46042 adds read-only policy support to MCP tool requests, so a thread can be handed an MCP server it may query but not mutate through. If you run fan-out subagents against MCP servers, the read-only policy is the new lever for scoping them.
Source
↳ Follow the thread