Sentisec docs
Sign in
CLI agents

Codex CLI

Protect OpenAI's Codex CLI with Sentisec — one command wires your ChatGPT subscription, with no API key and no config file to edit.

OpenAI's Codex CLI runs shell commands and edits files on your machine, which makes it exactly the kind of agent worth putting behind a policy.

Codex is covered by subscription mode — the same setup command that protects Claude Code. If you sign in to Codex with your ChatGPT account, this is the path to use, and it is a single command.

Set it up

Sign in to Codex with your ChatGPT account if you have not already:

codex login

Sentisec covers Codex when it is signed in this way.

Install the Sentisec CLI.

pipx install sentisec-sdk

Run the guided setup and paste your workspace key. Mint the key first in the dashboard under Settings → API keys.

sentisec edge

Setup detects Codex, recognises the ChatGPT sign-in, and asks you to confirm. Read the closing connection result and workspace mode. New workspaces start in shadow: monitored, with nothing blocked. Confirm the current state with sentisec status.

Use codex exactly as before. No wrapper command, no flag, no change to ~/.codex/config.toml that you have to make yourself. Open Sessions in the dashboard to watch each action and its verdict arrive.

Info
Start Sentisec before Codex

Codex routes through a local service that the setup command starts. Run sentisec edge, check the connection result, then launch codex. Restart Codex if it was already open when setup changed its configuration. A connected service does not itself mean the workspace is enforcing.

What you get

Sentisec evaluates proposed actions. Shadow mode records verdicts without blocking. When an enforcing workspace stops an unsafe action, Codex receives a call to sentisec_tool_call_blocked in its place, carrying a reason that names what was blocked and why. Codex has no such tool, so the action never executes, and the block appears in your session timeline with its reason. Codex cannot show an approval prompt, so a call that needs a person's approval stays blocked on Codex.

Your ChatGPT credential never leaves your machine. Each request is forwarded to OpenAI from your own box; Sentisec receives only a credential-free, token-redacted copy of the action for evaluation. See subscription mode for the full trust model.

Day-to-day

sentisec edge status     # what's protected, service health, live link
sentisec edge off        # pause protection, keep the configuration
sentisec edge on         # resume
sentisec edge uninstall  # remove everything cleanly

Running Codex on an OpenAI API key instead

Codex signed in with an OpenAI API key rather than a ChatGPT account is not covered yet. If that is how your team runs Codex, tell us — get in touch — and in the meantime the same protection is available today for Claude Code, Cursor, and opencode.

Updates / contradictions

2026-09-09 — Replaced the retired unconditional protection message with mode-aware setup guidance. New workspaces monitor in shadow until the operator chooses an enforcing posture.

Cursor

Route the Cursor editor through Sentisec with the Custom OpenAI URL setting — chat, Composer, inline edit, and agent runs all get verdicts.

opencode

Route opencode through Sentisec in its provider config — Claude models over the Anthropic wire, or Kimi over the OpenAI-compatible wire.

On this page

Set it upWhat you getDay-to-dayRunning Codex on an OpenAI API key insteadRelatedUpdates / contradictions
Protected docs