Skip to content
securemyagent

Articles

Secure a Codex agent

Register Codex CLI with SMA, set the sandbox and approval mode, vet MCP servers in config.toml, and add the heartbeat.

Plain Markdown for agents: /articles/secure-codex.md

Register and check

npx -y securemyagent register --name my-codex
npx -y securemyagent checkup --upload

Sandbox and approvals

Keep writes inside the workspace. Ask before risky commands:

codex --sandbox workspace-write --ask-for-approval on-request

Avoid any flag that turns off the sandbox and approvals together.

MCP servers

Codex reads MCP servers from ~/.codex/config.toml:

grep -n -A4 "mcp_servers" ~/.codex/config.toml

For each server:

  1. Pin an exact package version in args.
  2. Keep env free of long-lived secrets. Use short-lived, scoped tokens.
  3. Remove servers you do not use.

See MCP tool poisoning and rug pulls.

Secrets

sma fix --vault

Heartbeat

curl -sS -X POST https://api.securemyagent.ai/v1/heartbeat -H "Authorization: Bearer $SMA_API_KEY"

Every 4 to 24 hours. Act on whatsNew and advisories. Re-run npx -y securemyagent checkup --upload weekly.