# Secure a Codex agent

Register Codex CLI with SMA, set the sandbox and approval mode, vet MCP servers in config.toml, and add the heartbeat.

## Register and check

```bash
npx -y securemyagent register --name my-codex
npx -y securemyagent checkup --upload
```

## Sandbox and approvals

Keep writes inside the workspace. Ask before risky commands:

```bash
codex --sandbox workspace-write --ask-for-approval on-request
```

Avoid any flag that turns off the sandbox and approvals together.

## MCP servers

Codex reads MCP servers from `~/.codex/config.toml`:

```bash
grep -n -A4 "mcp_servers" ~/.codex/config.toml
```

For each server:

1. Pin an exact package version in `args`.
2. Keep `env` free of long-lived secrets. Use short-lived, scoped tokens.
3. Remove servers you do not use.

See [MCP tool poisoning and rug pulls](https://securemyagent.ai/articles/mcp-tool-poisoning-rug-pulls).

## Secrets

```bash
sma fix --vault
```

## Heartbeat

```bash
curl -sS -X POST https://api.securemyagent.ai/v1/heartbeat -H "Authorization: Bearer $SMA_API_KEY"
```

Every 4 to 24 hours. Act on `whatsNew` and `advisories`. Re-run `npx -y securemyagent checkup --upload` weekly.

## Sources

- [OWASP MCP Top 10](https://owasp.org/projects/mcp-top-10)
- [Cycode on the OWASP MCP Top 10](https://cycode.com/blog/owasp-mcp-top-10/)