What Codex Actually Sends to the Model

Type 'Reply with pong.' into Codex and you'd assume the model sees roughly that much text. It doesn't. One developer built a local recorder that intercepts Codex CLI 0.145.0's outgoing requests to the gpt-5.6-sol model, redacts sensitive headers, and returns a fixed fake response instead of hitting a real provider. The captured request for that 16-character prompt came out to 42,980 bytes, which tokenizes locally to roughly 9,435 tokens using o200k_base. The prompt itself accounted for about 25 of those tokens. Everything else — tool definitions, base instructions, skill metadata, environment context — made up the other 99.7%.

Three things dominated that overhead. Tool entries describing exec, wait, request_user_input, and a collaboration namespace (which itself bundles six subtools) came to 3,942 tokens. Codex's own developer-message instructions added another 3,729 tokens. Together with the user message, that's 7,696 of the 9,435 tokens before a single file gets read or a command gets run. This was even an isolated-home baseline, stripped of project instructions, so a real repo starts from a higher floor.

And the floor keeps rising once you add context sources developers rarely think about. AGENTS.md files get sent in full: 250 synthetic markers added 5,947 bytes and 2,530 tokens to the first request, 1,000 markers added 24,197 bytes and 11,030 tokens. Skills initially contribute only name, description, and path — one skill added about 125 tokens, ten added about 1,250 — but their full bodies stay invisible until Codex actually reads them. MCP servers behave similarly: an unused server contributes generic discovery guidance, but once its tools get triggered, one server with three tools added 1,522 tokens and two servers with seven tools added 4,210 tokens.

A simulated bug-fix task showed how this compounds turn by turn. Starting at 9,815 tokens, the request grew through search results, file reads, a failed regression test, a fix, and a passing test suite to 11,889 tokens by the final step — none of the intermediate output got dropped. Terminal output was even less forgiving: a 10,000-line command result got truncated to a head-and-tail sample, but the request still jumped from 9,584 tokens to 25,835. Images came across as base64 data URLs; a 32x32 PNG added a 442-character URL, while a larger synthetic image got resized and re-encoded into a request that ballooned to 115,265 bytes.

The one mechanism built to fight this bloat is compaction, and the experiment forced it to fire with a synthetic setup — 13,000 reported input tokens against a 20,000-token window and a 12,000-token threshold. Codex sent the accumulated history plus a summary prompt in a 21,408-token compaction request, then rebuilt the conversation around the returned summary, shrinking the next request back down to about 9,500 tokens. That's real savings, but it also means anything not captured in that summary effectively disappears from the model's view. Unread files, ignored files, and a fake .env never appeared automatically in any of this — the machine boundary held there. Everything the assistant does touch, though, sticks around and rides along in every request after it.