Skip to content
Maskflare
Talk to usStart free trial
Menu

OpenAI Codex integration

Keep secrets and customer data out of OpenAI Codex

Maskflare hooks stop Codex prompts that carry API keys and mask secrets and PII in Bash, apply_patch and MCP tool calls before the model reads them.
Start free trial Developer guide
What Maskflare covers
  • Prompts: blocked when a rule would mask or block anything in them. Codex can stop a prompt but cannot rewrite it
  • Tool input: masked, or the call denied by a block rule, for Bash, apply_patch and MCP tools. For apply_patch only the added lines are masked, because the context and removed lines must match the file
  • Tool output: Bash and MCP output that needs masking is replaced by its masked text, which the model reads as the hook's reason. The command has already run
  • File reads: no hook of its own. A file read through a shell command is covered as Bash output

Codex runs shell commands and applies patches on its own. A command that prints a .env file, or a patch that writes a key into source, puts the secret into the model's context or into your repository.

Codex runs a hook when a prompt is submitted, before a tool runs and after it returns. The desktop agent installs Maskflare's hook command at those points for every local user and restores the entries if they are removed.

Set up OpenAI Codex with Maskflare

The Maskflare desktop agent writes hooks into each developer's Codex configuration and keeps them in place. Prompts that carry secrets are stopped, and Bash, patch and MCP tool traffic is masked.

Install the Codex hooks
# With the desktop agent: set in the agent policy
"coding_agent_hooks": { "mode": "enforce", "tools": ["codex"] }

# The agent writes one entry per event into ~/.codex/hooks.json
"<agent>" hook --agent codex --fail closed --maskflare-managed

# Without the desktop agent: copy examples/codex/hooks.json from the
# Python SDK into ~/.codex/hooks.json, then review the hooks with /hooks

What gets masked

  • Prompts: blocked when a rule would mask or block anything in them. Codex can stop a prompt but cannot rewrite it
  • Tool input: masked, or the call denied by a block rule, for Bash, apply_patch and MCP tools. For apply_patch only the added lines are masked, because the context and removed lines must match the file
  • Tool output: Bash and MCP output that needs masking is replaced by its masked text, which the model reads as the hook's reason. The command has already run
  • File reads: no hook of its own. A file read through a shell command is covered as Bash output
  • Your organization's rules, including 232 credential formats, in monitor mode (count only) or enforce mode

Good to know

  • Hooks are off by default. Start in monitor mode to count what they see, then switch to enforce.
  • Codex has no fail-closed setting for a hook that crashes or times out: such a call goes through, whatever fail mode Maskflare sets.
  • Codex accepts a masked tool input only with an explicit allow, so a masked call is allowed to run with the masked values.
  • The Python hook was checked live against Codex CLI 0.143 (prompt blocked, Bash input masked before running, output replaced). The desktop agent's hook has protocol tests only.
  • Prompt-injection detection does not run in the hooks; it runs on MCP traffic through the gateway.

Frequently asked questions

Does Codex let a hook rewrite tool output?

No. Output that needs masking is replaced by its masked text, which Codex passes to the model as the hook's reason. The command itself has already run.

Are file reads covered?

Codex has no file-read hook. A file read through a shell command shows up as Bash output and is covered there.

What happens if the hook crashes or times out?

Codex lets the call through. Maskflare can't make it fail closed for this case.

Which Codex does it work with?

The Python hook was checked live against Codex CLI 0.143. The desktop agent's hook uses the same protocol and has protocol tests.

Other coding agents integrations

Claude CodeCursorGitHub Copilot CLIVS Code agent mode

All integrations

See it on your own data

Try Maskflare free.
Bring your hardest prompts.

28-day free trial or 10,000 requests, whichever comes first. Point one app at the gateway or enroll a few laptops,
and watch what gets masked. Or talk to us first.

Start free trial Talk to us