Codex CLI Guardrails
Command-hook authorization for OpenAI Codex CLI workflows
APort adds command-hook authorization to Codex CLI workflows so shell commands, file operations, and network-facing actions can be checked before execution. Use hosted mode for signed audit decisions or local mode for offline smoke tests.
Quick Start
1. Create passport & config
npx @aporthq/aport-agent-guardrails codex
2. Install guardrails package
npx @aporthq/aport-agent-guardrails codex
3. Add to your code
# One-command Codex CLI setup npx @aporthq/aport-agent-guardrails codex # Switch to audit-only mode without replacing the passport: npx @aporthq/aport-agent-guardrails mode codex --enforcement=warn
How It Works
Passport
Your agent gets an OAP passport declaring its identity, capabilities, and operational limits.
Evaluate
Before every tool call, the guardrail evaluates it against the passport's policy. Locally or via hosted API.
Decision
Allow or deny with structured OAP reason codes. Signed decisions create an auditable trail.
Frequently Asked Questions
Can Codex CLI use hosted APort decisions?
Yes. Hosted mode sends minimal policy context to APort Verify and records signed decisions for team audit. Local mode remains available for offline development.
Ready to secure your Codex CLI agents?
Get started in under 2 minutes with a single command.
Start free for local or individual setup. Upgrade to Team for hosted org audit, signed decisions, GitHub guardrails, and shared enforcement across your team.