`--strict-config` is not supported for `codex {subcommand}`

Error message

`--strict-config` is not supported for `codex {subcommand}`

What it means

`--strict-config` makes codex fail on unknown config keys, but only some commands honor it. The flag is parsed at the root level (so `codex --strict-config` keeps working for the TUI and for wrappers that forward root options), so unsupported subcommands get an explicit post-parse reject: reject_root_strict_config_for_subcommand consults unsupported_subcommand_name_for_strict_config and reject_strict_config_for_unsupported_subcommand bails rather than silently accepting a flag the subcommand would ignore. Supported commands include the TUI, exec, resume, agents, review, doctor, and bare `app-server`; mcp, plugin, login, logout, cloud, sandbox, debug, apply, update, and `app-server <sub>` are rejected.

Source

Thrown at codex-rs/cli/src/main.rs:2471

fn reject_strict_config_for_app_server_subcommand(
    strict_config: bool,
    subcommand: Option<&AppServerSubcommand>,
) -> anyhow::Result<()> {
    if subcommand.is_none() {
        return Ok(());
    }
    reject_strict_config_for_unsupported_subcommand(
        strict_config,
        app_server_subcommand_name(subcommand),
    )
}

fn reject_strict_config_for_unsupported_subcommand(
    strict_config: bool,
    subcommand: &str,
) -> anyhow::Result<()> {
    if strict_config {
        anyhow::bail!("`--strict-config` is not supported for `codex {subcommand}`");
    }
    Ok(())
}

fn reject_remote_mode_for_app_server_subcommand(
    remote: Option<&str>,
    remote_auth_token_env: Option<&str>,
    subcommand: Option<&AppServerSubcommand>,
) -> anyhow::Result<()> {
    let subcommand_name = app_server_subcommand_name(subcommand);
    reject_remote_mode_for_subcommand(remote, remote_auth_token_env, subcommand_name)
}

fn app_server_subcommand_name(subcommand: Option<&AppServerSubcommand>) -> &'static str {
    match subcommand {
        None => "app-server",
        Some(AppServerSubcommand::Daemon(daemon)) => match daemon.subcommand {
            AppServerDaemonSubcommand::Bootstrap(_) => "app-server daemon bootstrap",

View on GitHub (pinned to 339751715c)

Solutions

Drop `--strict-config` from invocations of the subcommand named in the error.
Use the flag only with supported commands: the TUI (`codex --strict-config`), `codex exec`, `codex resume`, `codex agents`, `codex review`, `codex doctor`, bare `codex app-server`.
In CI, validate config strictly once with a supported command, then run the remaining subcommands without the flag.

Example fix

# before
codex --strict-config mcp add fs --command npx -y @modelcontextprotocol/server-filesystem
# after
codex mcp add fs --command npx -y @modelcontextprotocol/server-filesystem

# strict config stays on commands that support it:
codex exec --strict-config 'ping'

Defensive patterns

Strategy: validation

Validate before calling

strict_config_ok() {
  case "$1" in
    ""|tui|exec|resume|agents|review|doctor|mcp-server|exec-server|app-server) return 0 ;;
    *) return 1 ;;
  esac
}
if [[ -n $STRICT ]]; then
  strict_config_ok "$SUB" || { echo "--strict-config unsupported for 'codex $SUB'" >&2; exit 2; }
fi
codex ${STRICT:+--strict-config} "$SUB" "$@"

Try / catch

if ! codex --strict-config mcp list 2>err.log; then
  grep -q -- '--strict-config` is not supported for' err.log && exec codex mcp list
  exit 1
fi

Prevention

Scope --strict-config to the commands that consume it instead of a global prefix
Encode the supported-subcommand list in one wrapper constant so upgrades refresh it in one place
Let CI run strict validation once via a supported command rather than on every codex call

When it happens

Trigger: Running `codex --strict-config mcp ...`, `codex --strict-config login`, `codex --strict-config cloud ...`, or `codex --strict-config app-server generate-ts` — any subcommand for which unsupported_subcommand_name_for_strict_config returns Some(...). Commands it returns None for (exec, resume, agents, review, doctor, queue, fork, bare app-server, ...) never trigger it.

Common situations: CI pipelines that prepend --strict-config globally to catch config.toml typos and then also call `codex mcp add` or `codex login` in the same job; wrapper scripts forwarding a shared root-option string into every subcommand; playbooks written against an older codex that accepted the flag more broadly.

Related errors

AI-assisted analysis of openai/codex@339751715c (2026-08-25). Data as JSON: /api/errors/49e119adc62eb392. Report an issue: GitHub.