Codex now gates MCP tools behind Touch ID

OpenAI's Codex agent now checks a fingerprint before it lets an MCP tool run.

The stakes are what an agent can do while nobody's watching. MCP tools can touch a filesystem, hit APIs, or run shell commands. Until now, that ran on whatever permission the agent process already had.

MacOS user verification now runs on P-256 keys stored in the Secure Enclave's Data Protection Keychain, per Codex PR #43624. It merged September 8 at 00:15 UTC. Each signature needs a fresh LAContext, so one Touch ID unlock doesn't cover a batch of calls. The key's access-control policy requires that prompt on every signature.

A second PR closed the loop five hours later, at 05:41 UTC. The TUI had been auto-cancelling these verification requests instead of surfacing them. That would have made the feature invisible. The fix routes approvals through the app-server's userVerification/verify RPC and returns the proof to the original request.

Remote workspaces are still unsupported. The PRs don't say when that changes.