← All docs

Codex

Wire agentjail into Codex's pre-tool-use hook to enforce policy before every tool call.

agentjail supports Codex CLI. agentjail install auto-detects Codex when ~/.codex/ exists or codex is on your PATH, and wires the hook automatically.

Want the OS sandbox and network visibility too? The hook guards tool calls. To also run Codex inside the kernel sandbox (Seatbelt/Landlock) and capture its LLM traffic, launch it with agentjail run -- codex. See the OS-native sandbox.

Install

Quick install (recommended):

curl -fsSL https://agentjail.io/install.sh | sh

The script runs agentjail install, which presents an interactive picker of all detected agents including Codex. Press Enter to wire them all.

Wire Codex specifically:

agentjail install --for codex

Homebrew:

brew install LuD1161/tap/agentjail
agentjail install --for codex

Both paths work on macOS and Linux.

What the installer writes

agentjail install --for codex adds a PreToolUse hook entry to ~/.codex/hooks.json:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": ".*",
        "hooks": [
          {
            "type": "command",
            "command": "~/.agentjail/bin/agentjail-hook --agent=codex",
            "timeout": 30
          }
        ]
      }
    ]
  }
}

Every tool call Codex makes will pass through agentjail-hook before execution.

Verify it is working

You can test agentjail-hook directly from the terminal (the daemon must be running). Pipe a synthetic PreToolUse event to the hook and inspect the output:

echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"rm -rf /"}}' \
  | agentjail-hook

The hook prints a JSON response:

{
  "hookSpecificOutput": {
    "hookEventName": "PreToolUse",
    "permissionDecision": "deny",
    "permissionDecisionReason": "..."
  }
}

Exit 0 means allow or ask; exit 2 means deny.

For a full explanation of the hook protocol, see the generic hook guide.