feat(exec): Add --disable-builtin-tools flag for MCP-only mode

[provencher]

Summary

Adds a new --disable-builtin-tools CLI flag to codex exec that allows users to disable all built-in tools (shell, file operations, plan, apply_patch) while keeping MCP tools and web search available.

This is useful for running codex exec in headless mode with only custom MCP tools, enabling better control over the agent's capabilities.

Changes

• Add --disable-builtin-tools CLI flag to exec
• Thread flag through ConfigOverrides and Config
• Update ToolsConfig to conditionally register built-in tools based on flag
• Keep MCP tools, web_search, and view_image available when flag is set

Testing

Verified the flag works correctly:

• With flag: Agent uses only MCP tools (no built-in shell/file tools)
• Without flag: Agent has access to all built-in tools as normal

Built and tested successfully with both configurations.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[provencher]

I have read the CLA Document and I hereby sign the CLA

[provencher]

recheck

[amittell]

+1 on needing this flag

[etraut-openai]

Thanks for the contribution, and apologies for the slow response. We've received many PRs, and we don't have the bandwidth on the codex team to review all of them.

We've updated our contribution guidelines to clarify that we're currently accepting contributions for bugs and security fixes, but we're not generally accepting new features at this time. We need to make sure that all new features compose well with both existing and upcoming features and fit into our roadmap. If you would like to propose a new feature, please file or upvote an enhancement request in the issue tracker. We will generally prioritize new features based on community feedback.

[provencher]

Thanks for the contribution, and apologies for the slow response. We've received many PRs, and we don't have the bandwidth on the codex team to review all of them.

We've updated our contribution guidelines to clarify that we're currently accepting contributions for bugs and security fixes, but we're not generally accepting new features at this time. We need to make sure that all new features compose well with both existing and upcoming features and fit into our roadmap. If you would like to propose a new feature, please file or upvote an enhancement request in the issue tracker. We will generally prioritize new features based on community feedback.

Really too bad that this was closed. I think it's a large omission that codex does not permit even disabling the shell execution, as it's a security risk in many cases.

I opened an issue to track the request
#6049 (comment)