AI agent phone notifications and replies: Claude Code, Codex and MCP

CLI 0.6.0 and plugin 0.4.1 include rich messages, Session IDs, a phone-reply skill and the Claude AskUserQuestion bridge. Single-choice questions use buttons with an optional text alternative; multi-select currently uses typed option numbers. Codex uses MCP for phone questions; native request_user_input is not intercepted.

Execution approvals below have a separate compatibility matrix.

• One-command setup and marketplace plugins

On Windows, use direct CLI setup or local MCP. Claude Code hooks require 2.1.139+; an older or unknown version gets MCP only. Codex on Windows provides MCP questions without automatic hooks. The marketplace plugin uses POSIX shell hooks; use direct setup on Windows. Native tool permission approvals retain their separate platform and host policy.

ntfyx setup claude-code --dry-run
ntfyx setup claude-code

ntfyx setup codex --dry-run
ntfyx setup codex

• Windows installation and platform scope

After connecting the CLI to your phone, add a local stdio server to your MCP client. It starts the executable shown below. Merge this entry with existing servers; do not replace unrelated configuration or weaken your client’s tool policy.

{"mcpServers":{"ntfyx":{"command":"ntfyx","args":["mcp"]}}}

In CLI 0.1.5, ntfyx setup claude-code adds question and notification hooks plus the MCP server; native permission hooks are off by default and require ntfyx setup claude-code --permissions on. Setup merges selected lifecycle hooks to your Claude Code settings, with a backup of each file. The PermissionRequest adapter handles one invocation at a time, with a 90-second remote wait and a 100-second hook timeout.

Existing deny rules and other hooks stay in place, and the terminal can still answer. A late Allow cannot revive an invocation that has ended. Unsupported tools, oversized context, unexpected payloads, verification failures and timeouts return control to the terminal.

ntfyx setup claude-code --dry-run
ntfyx setup claude-code

Requires ntfyx CLI 0.1.2 or later on Linux x64, or 0.1.5 or later on Apple silicon Mac. ntfyx setup codex adds a PermissionRequest hook for shell commands (Bash) and file changes (apply_patch), plus a Stop hook, to your Codex hooks.json, and registers the MCP server with codex mcp add. Codex runs only hooks you have reviewed: open Codex and trust the two ntfyx hooks with /hooks.

Approvals work in interactive sessions. codex exec turns approvals off, so it never asks.

ntfyx setup codex --dry-run
ntfyx setup codex

• Step-by-step Codex phone approval setup
• Codex usage and reset-credit alerts

Plugin 0.4.1 includes step-by-step phone setup, rich-message guidance, local MCP, phone replies, completion/approval hooks, and Claude AskUserQuestion forwarding. Requires CLI 0.6.0+. Add the public Ntfyx marketplace; official curated-directory inclusion is separate. Use either the plugin or ntfyx setup for each agent to avoid duplicate hooks.

# Claude Code
/plugin marketplace add KaylaONeal/ntfyx-agent-plugins
/plugin install ntfyx@ntfyx

# Codex (then trust the hooks with /hooks)
codex plugin marketplace add KaylaONeal/ntfyx-agent-plugins
codex plugin add ntfyx@ntfyx

# pi
pi install git:github.com/KaylaONeal/ntfyx-agent-plugins

The pi package registers the ntfyx MCP tools, adds the skill and sends a notification when a turn ends. Phone approval for bash is opt-in: risky asks before commands such as rm -rf, sudo, git push, publish and deploy; bash asks before every command. Deny blocks the command. Without a verified phone answer, pi falls back to its own confirmation, or blocks when there is no UI.

NTFYX_PI_APPROVAL=risky pi
NTFYX_PI_APPROVAL=bash pi

Phone approval is enabled from the minimum verified host version on a verified platform, and only when the request payload matches the host’s documented format. Anything unexpected goes back to the terminal. Real-host runs with the compiled CLI and the encrypted relay passed for Claude Code 2.1.283 (full suite) and 2.1.284 (Bash, Edit and Write, Allow and Deny) and for Codex 0.158 in an interactive session (Bash and apply_patch, Allow and Deny), all on Linux x64.

Apple silicon Mac real-host verification on 19 October 2026 also passed with Claude Code 2.1.303 (8 lifecycle/tool cases and 6 policy cases) and Codex 0.163.0 (4 interactive cases), requiring CLI 0.1.5+. The receiver in those runs was programmatic, not a physical iPhone. Apple silicon Mac native approvals are verified with Claude Code 2.1.303 and Codex 0.163.0 and require CLI 0.1.5+.

Intel Mac native approvals remain unverified and return to the terminal. Codex requires interactive TUI and /hooks trust; codex exec does not trigger permission hooks. Interactive terminal-choice precedence in Claude Code remains unverified.

Approval permits the original, bound request once. It does not authorize arbitrary future shell commands. Ntfyx records a unique remote decision and one-time consumption; it cannot guarantee exactly-once effects for every external system.

Completion alerts, tool permission requests and missing information need different integrations. Use the guide below to choose a supported permission hook or explicitly ask for a choice or text reply through the CLI or local MCP. Existing terminal prompts are not automatically forwarded.

• Agent waiting for input: notifications and replies
• Multiple coding agents and projects
• SSH and remote server jobs

CLI 0.1.3 and current clients group related messages into Sessions within a Topic. Confirm or choose on the original message; select Reply for a quoted text answer. CLI 0.1.3 includes --session-id and --session-name; run ntfyx upgrade to update. Read the guide for examples, standalone-message defaults and availability.

• Sessions and message replies

CLI 0.6.0 independently sends ordinary text, Markdown and native metric/table/chart messages, with local validation before sending. See the guide for receiver version requirements and store availability.

• Rich-message formats and complete example