diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json
index 0f83fd98aa..a61f58b8ea 100644
--- a/codex-rs/core/config.schema.json
+++ b/codex-rs/core/config.schema.json
@@ -1395,6 +1395,9 @@
             "unified_image_budget": {
               "type": "boolean"
             },
+            "untrusted_as_tool_output": {
+              "type": "boolean"
+            },
             "use_agent_identity": {
               "type": "boolean"
             },
@@ -8000,6 +8003,9 @@
         "unified_image_budget": {
           "type": "boolean"
         },
+        "untrusted_as_tool_output": {
+          "type": "boolean"
+        },
         "use_agent_identity": {
           "type": "boolean"
         },
diff --git a/codex-rs/features/src/lib.rs b/codex-rs/features/src/lib.rs
index 19cc2c1c7d..4a6595122d 100644
--- a/codex-rs/features/src/lib.rs
+++ b/codex-rs/features/src/lib.rs
@@ -134,6 +134,8 @@ pub enum Feature {
     MultiEnvCopyFile,
     /// Send per-content-entry classifications in internal Responses metadata.
     ContentItemKinds,
+    /// Render client-supplied untrusted context as standalone named tool outputs.
+    UntrustedAsToolOutput,
     /// Record model-attempted tool calls in internal Responses metadata.
     ExecutedToolCallMetadata,
     /// Enable JavaScript code mode backed by the standalone host process.
@@ -1202,6 +1204,12 @@ pub const FEATURES: &[FeatureSpec] = &[
         stage: Stage::Stable,
         default_enabled: true,
     },
+    FeatureSpec {
+        id: Feature::UntrustedAsToolOutput,
+        key: "untrusted_as_tool_output",
+        stage: Stage::UnderDevelopment,
+        default_enabled: false,
+    },
     FeatureSpec {
         id: Feature::ExecutedToolCallMetadata,
         key: "executed_tool_call_metadata",