The LLM proxy for OpenAI models at `/api/v2/llm/proxy/openai/v1` break tool calling in newer version of Code. This matters because the supply chain attacks on TanStack caused certificates to be reused which will eventually cause all users to have their malware detectors triggered and force an upgrade to a version where the certificate signatures match. Below is a full explination of the issue and how I fixed it with a LLM proxy that rewrites the calls locally before sending to AIP
The issue was a **shape mismatch** between Codex, the Palantir OpenAI-compatible proxy, and MCP tool routing.
Codex sent the MCP server to the model as a **namespace tool**:
{
"type": "namespace",
"name": "mcp__codestrap_local_dev",
"tools": [
{
"type": "function",
"name": "palantir_broker"
}
]
}
But the Palantir proxy/model response came back as a plain function call:
{
"type": "function_call",
"name": "palantir_broker",
"arguments": "{...}"
}
Codex could not route that, so it failed with:
unsupported call: palantir_broker
The fix was to create my own LLM proxy to rewrite tool calls:
// Palantir response -> Codex
// Add Codex's MCP routing namespace.
if (
next.type === 'function_call' &&
next.name === 'palantir_broker' &&
typeof next.namespace !== 'string'
) {
next.namespace = 'mcp__codestrap_local_dev';
}
That let Codex route the call to the MCP server. Your MCP logs confirmed it hit:
[MCP TOOL CALL] palantir_broker sessionId=new
Then the next request back to Palantir failed because Codex included its internal field:
{
"namespace": "mcp__codestrap_local_dev"
}
Palantir rejected that with:
unrecognizedProperty=namespace
So the final fix was bidirectional:
// Palantir response -> Codex
// Add namespace so Codex can route MCP calls.
function_call.namespace = 'mcp__codestrap_local_dev';
// Codex request -> Palantir
// Strip namespace because Palantir does not accept it.
delete function_call.namespace;
In plain English:
**Codex needs `namespace` to dispatch MCP calls. Palantir rejects `namespace` as an unknown request field. The proxy now adds it only on responses going to Codex and removes it on requests going back to Palantir.**
Can you please upgrade your proxies and fix tool calling so this is no longer necessary.