A developer publishing under the handle 0xkato intercepted every request Codex, OpenAI’s command-line coding agent, generates before it reaches a real model, by pointing the client at a local server that never forwards anything. A prompt of just 16 characters, “Reply with pong,” still produced a 42,980-byte request that his local tokenizer counted at roughly 9,435 tokens, with the prompt itself worth only about 25 of them. Almost the entire bill on a trivial exchange comes from what Codex loads before it ever reads the user’s message.
The method is what makes the numbers trustworthy. Codex supports custom model providers, so 0xkato pointed it at an HTTP server running on his own machine. That server logged every outgoing request, stripped sensitive headers, and replied with a fixed placeholder instead of forwarding anything to OpenAI. That setup shows exactly what the client transmits, with no vendor cooperation, no guesswork from documentation, and no reliance on a billing dashboard that only totals tokens after the fact. Reading an API reference tells you what a tool is supposed to send. Recording the wire traffic tells you what it actually sends, tested against Codex CLI 0.145.0 running the gpt-5.6-sol model.
Three components accounted for 7,696 of the 9,435 tokens in that first request. A tool-definitions block describing four top-level entries, exec, wait, request_user_input, plus a collaboration namespace, ran to 16,741 characters and roughly 3,942 tokens. The developer message carrying Codex’s base instructions added 17,730 characters and about 3,729 tokens. The user’s own prompt cost 25 tokens. The exec entry alone folded in command execution, patching, image inspection, and plan updates, several distinct capabilities inside one definition, and the collaboration entry expanded into six subtools of its own.
Project files add up fast once a repository leans on them. 0xkato planted synthetic AGENTS.md markers and watched the request climb from the 42,980-byte baseline to 48,927 bytes with 250 markers and to 67,177 bytes with 1,000 markers, a jump of roughly 11,030 tokens. Unread files behave differently: a fake .env and a gitignored log he planted deliberately never appeared until he had Codex read them, at which point a 20,000-line log alone pushed one trace from 43,500 bytes to 87,561 bytes before Codex cut it down to a head-and-tail excerpt.
Tool exposure compounds the same pattern. Configuring one MCP server, the interface coding agents use to call external tools, with three tools initially added nothing beyond generic discovery guidance, holding the request at 46,582 bytes. Only once 0xkato forced Codex to print the deferred entries did the tool descriptions themselves arrive, adding 5,894 bytes and about 1,522 tokens for three tools, and 15,970 bytes for seven tools spread across two servers. Images entered as base64 data URLs rather than counted image tokens in this local accounting: a small 32-by-32 pixel PNG added a 442-character data URL, while a larger image that Codex resized to 1,600 by 1,600 pixels before sending added a 71,666-character one, pushing that single request past 115,000 bytes.
Across a full nine-step coding task, fixing a bug, adding a regression test, and running the suite, the request grew from 44,189 bytes at the start to 52,389 bytes at the end, about 2,074 extra tokens of search results, file contents, and diffs. Forcing Codex’s compaction path by lowering its token threshold produced a third pattern: the summarization request itself briefly spiked to 68,375 bytes and roughly 21,408 tokens, then dropped back to 42,646 bytes once the raw history was replaced by a short summary.
The timing matters. Today’s issue also carries a separate measurement showing GPT-5.6 Sol burning far more tokens per session than its predecessor at the same headline rate, and knowing what the harness itself sends is the other half of understanding that bill. 0xkato is careful about the limits of his own data: this is one client, one Codex version, one model, and one prompt shape, measured on his own machine, not a universal minimum across every configuration or provider. The pattern is still concrete enough to act on. Teams paying for Codex or similar agents on usage-based pricing should treat AGENTS.md length, MCP server counts, and image attachments as direct cost levers, not incidental context, before their next contract renewal.
0xkato published these findings on his blog on 4 August 2026.
