How do I query my agents’ traces from inside Codex CLI?

Rius lets you query your agents’ traces from Codex CLI by adding the Rius MCP server with one command and signing in with your Rius account. You then ask questions in plain language and Codex answers from your real traces, cost and alerts. If you already use the Rius plugin for Codex (beta), the server is registered as rius and you can skip the add step.

How it works

The Rius MCP server is an endpoint that Codex connects to over streamable HTTP. When you ask a question, Codex picks the right tools from the server and calls them against your workspace. The tools read trace lists, span waterfalls, cost and token summaries, agent and user activity, and alerts. The full list is in the MCP reference.

There are two ways to sign in:

• Interactive. On a machine with a browser, you sign in with your Rius account over OAuth and Codex handles the flow. The tools see the workspaces your user can access.
• Headless. For CI, cron or other agents without a browser, you use a read-scoped API key as a bearer token. The key reaches only the workspace it was created in.

Querying is a second sign-in, separate from the one that sends traces to Rius. A key that only ships telemetry (an ingest key) cannot query, so a headless connection needs a key with the read capability.

Set it up

1. Check whether you already have it. If you installed the Rius plugin for Codex (beta), it already registers the server as rius. Go straight to step 3.

2. Add the server. Run this in your terminal. Keep --url before the URL, because a bare URL registers a stdio server that cannot authenticate.

   codex mcp add rius --url https://mcp.eu.console.rius-glassflow.com/mcp

3. Sign in. Run codex mcp login rius and complete the browser sign-in with your Rius account. This is separate from $rius:rius-login, whose key only sends traces. If the client lists the server but shows no tools, the sign-in has not finished yet. If the sign-in loops or reports an auth error, remove the server and add it again.

4. Verify the connection. Ask Codex:

   Who am I in Rius, and which workspaces can I access?

   Codex should call the get_me tool and answer with your email and a table of workspaces.

5. For a headless session, use a read-scoped key instead. Mint it from the Connect an agent button on the console’s MCP page, or from Settings → API keys with the Query data (read) capability. The key is shown once, so store it as a secret in the RIUS_API_KEY environment variable. Then point Codex at it in ~/.codex/config.toml. If the Rius plugin is installed, give the key-based server its own name so it sits next to the plugin’s rius server:

   [mcp_servers.rius-key]
   url = "https://mcp.eu.console.rius-glassflow.com/mcp"
   bearer_token_env_var = "RIUS_API_KEY"

   A 401 means the key is revoked or mistyped. A 403 saying the key lacks the required scope means it has no read capability.

To trace your Codex sessions themselves, see Coding agents.

What you get

You ask questions from the terminal where you already work, and Codex answers from your telemetry. Examples:

• Traces. “List the failed runs from this week and show me what went wrong in the worst one.” Codex filters the trace list by status, then opens the span waterfall for the worst run.
• Traffic and latency. “Summarize my agent traffic over the last 24 hours.” You get traces, LLM calls, error rate, cost, tokens and latency percentiles.
• Cost. “Which service is spending the most right now?” Costs are list-price estimates in US dollars, not billed amounts.
• Alerts. Ask what is firing and what a given alert says. A key can read alerts, and an interactive session can also acknowledge a firing.
• Agents and users. Ask about agent error groups, versions, and what each user’s traffic looked like.

Every tool carries hints that say whether it only reads or changes something. Codex can use them to run reads without asking and to confirm writes with you.

When something else fits

• Creating, renaming or deleting workspaces, and changing members, are not available over MCP. Do those in the console.
• Managing alert rules and channels needs an admin’s interactive session. A headless key can do it only if it was minted in the Connect an agent dialog with the alert or channel scope ticked, and no key can acknowledge a firing or mint other keys.
• Browsing a single trace visually is often quicker in the console than in a chat reply.

Related