feat(codex): telnyx-developer-kit plugin — navigator/architecture/guardrail/debugging skills + hosted MCP - #323
Vijaypepakayala wants to merge 27 commits into
Conversation
Oliver-Zimmerman
left a comment
Oliver-Zimmerman
left a comment
There was a problem hiding this comment.
Review verdict: Changes requested
Reviewed at head 7d52d901c271f843d0b618e7188388d79bbf868f. The direction is solid, but these introduced issues should be addressed before approval:
-
High — advertised MCP output schemas reject valid runtime responses
The new schemas in
usage-cost-explorer/src/server.ts,voice-monitor/src/server.ts, andnumber-intelligence/src/server.tsusez.intersection(z.object(...), z.record(...)). Zod preserves provider-specific fields at runtime, but the emitted JSON Schema contains anallOfobject branch withadditionalProperties: false.I reproduced wire-schema rejection for successful values containing
billing_group_id,client_state, and nestedrecord_type. Replace these intersections with a singlez.object({...}).catchall(jsonValueSchema)—including nested provider objects—and add tests that validate representativestructuredContentagainst the schema returned bytools/list. -
Medium — CSV usage reports return an empty successful result
billing_query_usageacceptsformat: "csv"; the client converts a CSV response into{text: csvBody}, butusageReportEnvelopeSchemastripstext. The resulting MCP response is a successful{}with the entire report discarded.Either remove CSV from the tool input or explicitly model and preserve a result such as
{format: "csv", text: csvBody}. Add an end-to-end CSV tool-call test. -
Medium — Product Navigator sends Codex users to unavailable plugins
skills/telnyx-kit-product-navigator/SKILL.md:16-17tells users to run/plugin install telnyx-<product>@telnyx, which is Claude-oriented syntax. The Codex marketplace in this PR exposes onlytelnyx-developer-kit.In an isolated Codex installation, the Developer Kit installed and the navigator activated naturally, but both
codex plugin add telnyx-voice@telnyxandtelnyx-platform@telnyxfailed as not found. Either expose Codex versions of the referenced plugins and use Codex syntax, or qualify those deep dives as Claude-only and give Codex users an MCP discovery/schema path. The Twilio migration row needs the same treatment. -
Medium — root MCP tool schemas are not structurally validated
scripts/check-telnyx-mcp-catalog.py:896-897only checks thatinputSchemais a dictionary. A schema such as{"type":"definitely-not-a-json-schema-type"}passes. Apply the existing recursive schema validator to every rootinputSchemaandoutputSchema, with malformed-schema self-tests. -
Medium — release audit accepts non-standard and ambiguous JSON
External MCP responses, public metadata, and embedded result JSON use Python's permissive
json.loads. I reproduced acceptance ofNaNand duplicate object keys. Centralize strict JSON decoding that rejects non-finite constants and repeated member names, and use it at every external/package metadata boundary. -
Medium — catalog-validator self-tests are absent from automatic CI
check-telnyx-mcp-catalog.py --self-testpasses locally, but no PR/push workflow runs it. The only validator execution is the credentialed hosted audit, which is manual and main-only. Add an uncredentialed automatic CI step running the self-test while keeping the live audit protected. -
Medium — Number Intelligence has an inaccurate
openWorldHintnumber-intelligence/src/server.ts:139-144marks billable arbitrary phone-number lookups asopenWorldHint: false. These tools query an external provider about arbitrary real-world numbers and can incur charges. Set it totruefor both single and batch lookup tools and update the tests currently enforcingfalse.
Validation completed
- Codex package validator passed
- Catalog-validator self-tests passed
- Generated skill trees are clean and synchronized
- All four official Agent Skills validators passed
- MCP Apps typecheck/build passed
- 69 MCP Apps tests plus workspace test runs passed
- Isolated real Codex marketplace installation and natural skill activation passed
.mcp.jsonregistered with the real Codex CLI
I separately reproduced two real pre-existing issues—the same-repository PR secret exposure and sync-script symlink deletion—but did not count either as a blocker introduced by this PR.
7d52d90 to
e0231b1
Compare
|
Oliver — all seven findings are addressed at
The two pre-existing findings are fixed as well: pull-request code cannot receive repository secrets, and skill synchronization refuses symlink traversal while providing a non-mutating drift check. Local validation on this exact head:
Could you please re-review this head? |
Oliver-Zimmerman
left a comment
Oliver-Zimmerman
left a comment
There was a problem hiding this comment.
@Vijaypepakayala — second-pass review at e0231b11. All seven findings from my previous review are resolved: the wire schemas validate representative runtime output, CSV is removed from the MCP boundary, Codex Product Navigator uses the hosted MCP path, root schemas are structurally validated, JSON decoding is strict, catalog self-tests run in CI, and Number Intelligence now advertises openWorldHint: true. The full typecheck/build/test/validator/sync suite passed, and isolated natural Codex activation worked. One new session-capacity regression remains; see the inline comment. Please re-request review after eviction is committed only after replacement initialization succeeds and the failure case is covered.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7b669fedeb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. Another round soon, please! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
f5092f7 to
f9b1e02
Compare
|
@Oliver-Zimmerman, the session-eviction blocker and latest Codex findings are addressed. The final branch is one commit on current |
|
@codex review |
|
Codex Review: Didn't find any major issues. 🚀 Reviewed commit: ℹ️ About Codex in GitHubCodex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback". |
f9b1e02 to
e570f4b
Compare
|
Rebased onto current main and pushed the final local-review contract at @codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e570f4b12a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
|
The current-head P1 bundled MCP shape finding is fixed at @codex review |
|
@Oliver-Zimmerman — re-review requested at current head Your seven original findings remain resolved. The later session-capacity blocker is covered by committing eviction only after replacement initialization succeeds; failed initialization releases its reservation without evicting the existing session, with concurrent capacity-matrix regression coverage. The remaining Codex base-URL thread is now replied to and resolved: both hosted apps normalize the shared Current validation: all GitHub CI checks green; local typecheck/build clean; tests 219 workspace + 39 Number Intelligence + 73 Usage Cost + 41 Voice Monitor; zero production dependency vulnerabilities; plugin/catalog validators and generated-skill sync clean. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 07f9bb21a1
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2db660449a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f1ef7b6987
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ab01e8b175
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a0d8c0e794
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 381bbae0d2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2a57d672e5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fd854de3d3
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 52bf002c12
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ca80d39c61
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| servers = metadata.get("authorization_servers") | ||
| require(isinstance(servers, list) and len(servers) == 1, "expected one authorization server") |
There was a problem hiding this comment.
When protected-resource metadata contains any single authorization server, this check passes without verifying its value or even that it is a string. A staging gateway that accidentally advertises a stale or non-Telnyx issuer can therefore pass the release audit while Codex installations are redirected to the wrong OAuth service; compare the entry with the canonical Telnyx issuer and validate its type.
AGENTS.md reference: AGENTS.md:L134-L140
Useful? React with 👍 / 👎.
| body = parse_body(content_type, read_limited(response)) | ||
| require(body.get("id") == expected_id, f"expected JSON-RPC id {expected_id}") | ||
| return body |
There was a problem hiding this comment.
When the connector returns an object with the expected id and result but omits jsonrpc: "2.0" or supplies another version, this routine accepts it in both the JSON and SSE paths. The hosted audit can consequently approve malformed responses that conforming Codex or Claude JSON-RPC clients reject; validate the jsonrpc member before returning a matched response.
Useful? React with 👍 / 👎.
| received = list_all_tools( | ||
| url, | ||
| token, | ||
| protocol_version, | ||
| session, | ||
| request_id_base + 1, | ||
| ) | ||
| validate_tool_catalog(received, contract) |
There was a problem hiding this comment.
When the deployed connector exposes the six expected tools plus an MCP resource or legacy MCP App resource, this audit still passes because it only invokes tools/list. That leaves the release requirement in submission/telnyx-developer-kit/README.md:47-48—an empty-profile install with no Apps resource—unchecked, so enumerate all resources/list pages (or verify that the resources capability is absent) before accepting the deployed contract.
Useful? React with 👍 / 👎.
| - Scale unit = concurrent streams; key TeXML call state on `CallSid` and | ||
| stream state on `StreamSid`, never on `call_control_id` or process globals. |
There was a problem hiding this comment.
stream_id for TeXML stream state
When an implementation follows this TeXML WebSocket pattern, keying stream state on StreamSid conflicts with the immediately preceding protocol guidance that Telnyx supplies stream_id on server events. Looking for the Twilio-style field can collapse state under a missing identifier and mix concurrent media streams; use the received stream_id consistently, then resync the generated provider and Codex copies.
AGENTS.md reference: AGENTS.md:L75-L86
Useful? React with 👍 / 👎.
Complete the pending base merge and include validated manifest, catalog guidance, strict JSON/SSE, OAuth metadata and regression-test corrections. The isolated runtime and staging activation remain separate dependencies.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1d2bfad18a
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| ) | ||
| result = handshake["result"] | ||
| capabilities = result.get("capabilities") | ||
| require(isinstance(capabilities, dict), "server capabilities must be an object") |
There was a problem hiding this comment.
When either protocol handshake returns capabilities: {} (or a non-object tools value) but still responds to the audit's direct tools/list request, this check accepts the deployment. MCP clients use the advertised tools capability to determine whether tools are available, so the release gate can pass while a clean Codex installation exposes none of the five tools; require capabilities.tools to be an object in both protocol branches.
Useful? React with 👍 / 👎.
| if "text/event-stream" not in content_type.lower(): | ||
| body = parse_body(content_type, read_limited(response)) |
There was a problem hiding this comment.
When the gateway returns a valid JSON-RPC body with an empty, text/plain, or other non-MCP content type, this branch treats it as JSON and the hosted audit passes. A conforming Streamable HTTP response must use application/json or text/event-stream, so Codex can reject the same misconfigured deployment that this release gate approves; validate the response media type before parsing.
Useful? React with 👍 / 👎.
2 participants
Goal
Add the Codex
telnyx-developer-kitplugin backed by the isolated OAuth MCP endpoint athttps://api.telnyx.com/v2/ai/mcp.Package
1.0.0-preview.5NOT_AVAILABLEuntil staging and release gates passThe embedded contract is byte-identical to
team-telnyx/telnyx-ai-connectorsource candidate5bff92e2f32f32705e1ea3a5e15d0676c64b4cb9; SHA-256:29c307e0735c462d5cafa7a4d1223fd2e8b57664b013d6fd46289574fb482878.Validation
No Telnyx account mutation, billable request, remote review trigger, or production deployment was performed.
Release boundary
This PR makes the Codex package review-ready. Availability remains gated on deployment of the isolated connector, Gateway/Auth Manager propagation, clean staging OAuth validation, and the release approvals documented in
submission/telnyx-developer-kit/README.md.