--- title: "OpenAI Codex Adds Touch ID for MCP Tool Calls. It's a Nice Lock on the Wrong Door." date: 2026-09-21 tags: ["openai","codex","mcp","security","claude-code","agentic-workflows"] categories: ["AI Tools","Agentic Workflows"] summary: "Codex CLI 0.155.0 (Sept 17) added Touch ID verification for MCP tool-call requests in local TUI sessions on supported Macs, using the Secure Enclave. It's a genuinely nice UX touch, and it only covers the one deployment mode — a human sitting at a keyboard — where MCP's real exposure is already smallest." --- ![OpenAI Codex Adds Touch ID for MCP Tool Calls. It's a Nice Lock on the Wrong Door.](/images/codex-cli-touch-id-mcp-tool-calls.png) OpenAI shipped Codex CLI 0.155.0 on September 17, and buried in the same release as an experimental `/voice` mode and better worktree cleanup is a genuinely interesting security detail: **Touch ID verification for MCP tool-call requests**, in local terminal sessions, on supported Macs. Per the changelog, it uses the Secure Enclave for the signing operation — this isn't a cosmetic prompt, it's real hardware-backed authentication sitting in front of an MCP server's request to do something. A day later, 0.155.1 shipped a small follow-up fix so new sessions stop defaulting to a reasoning-summary setting that some providers reject. It's a good feature. It's also aimed at the one place MCP's tool-call risk is already lowest. ## What actually shipped Three pull requests (#43624, #43712, #43715) added biometric confirmation to MCP requests specifically inside **local TUI sessions on supported Macs** — the mode where a developer is physically at their laptop, running Codex CLI in a terminal, watching it work. When an MCP server asks to do something Codex routes through this check, macOS pops the Touch ID prompt, backed by the same Secure Enclave that guards Apple Pay and password autofill. It's a strictly better confirmation mechanism than a plain "y/n" prompt in a terminal — harder to fat-finger, harder to script past, tied to a physical human rather than a keystroke. ## Why the scope is the whole story Read that platform line again: **local TUI sessions on supported Macs.** That's the deployment mode where a developer is already sitting there, already watching the output, already the last line of defense before anything ships. It's also the mode this entire industry — Claude Code included — has had permission-prompting for since day one; Claude Code's own tool-execution model already routes unapproved tool calls, MCP included, through a user confirmation step unless a permission rule explicitly allows it. Touch ID makes that confirmation nicer to give. It doesn't extend it anywhere new. The place MCP's tool-call risk is actually concentrated is everywhere Touch ID structurally cannot reach: headless CI runs, self-hosted runners, scheduled cloud agents, anything executing unattended against a repository nobody is watching in real time. This blog covered the shape of that exposure directly in [the MCP STDIO security crisis piece](/2026/05/mcp-stdio-security-200k-servers-exposed/) — roughly 200,000 MCP servers reachable over the STDIO transport with no execution boundary, a meaningful share on public IPs, and no local human anywhere in the loop to press a fingerprint sensor even if one existed. A biometric check that only fires when a developer is already present adds friction exactly where the existing permission prompt already provides it, and adds nothing where an autonomous agent is running against untrusted input with nobody local to authenticate. ## The contrast with where Claude Code has been pointed Anthropic's own recent MCP and permissions work has moved in the opposite direction: instead of adding a nicer confirmation for the human-present case, it's been narrowing what's possible in the human-absent one. [Restricted mode](/2026/08/claude-code-restricted-mode-v2-1-248/), shipped August 27, strips exec and `WebFetch` tools, refuses `bypassPermissions` outright even if a script tries to set it, and — the detail that matters here — **ignores project-level settings files entirely**, so a compromised repo can't quietly re-enable what the mode disables. That's infrastructure built for CI pipelines and self-hosted runners: the exact unattended, no-human-to-authenticate cases where a fingerprint sensor is structurally unavailable. Claude Code has also shipped native MCP tool hooks (`type: "mcp_tool"`) that let teams intercept and gate MCP calls with their own policy logic, running the same way whether a human is at the keyboard or not. Neither approach is complete. Restricted mode is opt-in — nothing stops a team from running unattended agents without it, and a biometric prompt genuinely does raise the bar for the local, human-present case in a way a text prompt doesn't. Codex's Touch ID feature is worth having. But it's worth being precise about what kind of security work it is: **UX polish on a well-covered scenario**, not a new control on the scenario that's actually under-defended. The MCP ecosystem's hardest open problem right now is authenticating and constraining tool calls with nobody local to ask — and a Secure Enclave prompt that only fires when someone's already sitting there doesn't move that needle at all. ## What this means if you're choosing between the two None of this is an argument against Codex CLI's interactive mode, which is a genuinely pleasant place to work, or against the general instinct to make permission prompts harder to click through on autopilot. It's an argument against reading "we added biometric MCP confirmation" as evidence that the harder problem — unattended, agentic, headless execution — has been addressed. If your team's actual exposure is a developer approving MCP calls at their own keyboard, Touch ID is a real, welcome improvement. If your exposure looks like a CI pipeline running an MCP-connected agent against pull requests from strangers, the feature that matters is the one that works with nobody there to authenticate at all — which is exactly the gap Claude Code's restricted mode and hook-based MCP policy were built to close, and exactly the gap a fingerprint sensor structurally cannot. --- **Sources:** [OpenAI Codex CLI changelog](https://learn.chatgpt.com/docs/changelog), 0.155.0 (Sept 17, 2026) and 0.155.1 (Sept 18, 2026) entries, primary, direct fetch; this blog's own prior coverage of [Claude Code's Restricted Mode](/2026/08/claude-code-restricted-mode-v2-1-248/) (Aug 28, 2026) and the [MCP STDIO transport security exposure](/2026/05/mcp-stdio-security-200k-servers-exposed/) (May 17, 2026).