Codex Integration

⚡ 5 min read

Install transcodes-guard for OpenAI Codex CLI. Node.js ≥ 20, Codex build with codex plugin + hooks (codex plugin --help should work). Get a MAT from Console — see AI Agent Overview.

Save your token


# macOS / Linux
curl -fsSL https://raw.githubusercontent.com/transcodings/transcodes-guard/prod/cli/install.sh | bash && transcodes install
# Windows (PowerShell):
# irm https://raw.githubusercontent.com/transcodings/transcodes-guard/prod/cli/install.ps1 | iex; transcodes install
# or: transcodes set <MAT> -l codex

Without a MAT, hooks deny danger commands but cannot open step-up.

Enable hooks and skills

~/.codex/config.toml:


[features]
hooks = true
skills = true

Without hooks = true, Codex silently ignores the plugin — the gate never runs.

Without skills = true, the bundled $transcodes skill is not loaded.

Install from the marketplace

The repo ships .agents/plugins/marketplace.json. Codex clones it for you — no manual git clone or build:


codex plugin marketplace add transcodings/transcodes-guard
codex plugin add transcodes-guard@bigstrider

Or in Codex: /plugins → install transcodes-guard from the bigstrider marketplace.

Approve hook trust

One-time review on first run (/hooks to inspect). Do not use --dangerously-bypass-hook-trust.

Verify

Run a gated command — hook should deny with step-up URL on Transcodes Auth.

What you get

Same gate core as other hosts: PreToolUse on Bash + protected MCP tools, bundled transcodes-guard MCP server (admin tools, step-up poll, diagnostics).

Use the $transcodes skill or MCP tools for prompt-driven admin operations, and inspect step-up state.

After a deny

User completes MFA on Transcodes Auth.
Agent calls poll_stepup_session_wait with sid.
Retry the same command on verified.

See Step-up Auth → MCP.

See also: Cursor · Claude Code · Step-up Auth