node9 sees every tool call Codex CLI makes, through a pre-execution hook, and governs its MCP servers too. A risky action is allowed, sent to you for review, or blocked before it runs.
Codex gets the same pre-tool gate as Claude Code.
| Surface | How node9 is wired | What it does |
|---|---|---|
| Every tool call | PreToolUse hook in ~/.codex/hooks.json | allow / review / block before the tool runs |
| Pasted prompts | UserPromptSubmit hook | prompt secret scan |
| Every tool result | PostToolUse hook | audit record; verified against real Codex sessions |
| MCP servers | mcp_servers in ~/.codex/config.toml are wrapped | per-tool allow / review / block |
| Cost | reads ~/.codex/sessions and ~/.codex/archived_sessions session logs | estimated per-project spend in node9 report |
Headless codex exec runs the same hooks. Verified with a nonce probe against the real
trusted-hooks config: both the pre and post hook fired.
Set it up
node9 agents add codex
node9 init does this for every agent it detects on the machine. Either command is safe to
re-run; it repairs a hook that an agent update removed and leaves everything else alone.
After installation, open or restart Codex and run /hooks to review and trust the Node9
entries. Installing the hooks does not activate them: Codex skips untrusted hooks. If a
hook definition changes, review and trust it again. Any MCP servers already wrapped through
Node9 remain protected independently of hook trust.
What is not covered
- Tool output is observed, not gated (same as Claude Code).
Verify it on this machine
node9 doctor # is the hook (or MCP wrap) actually in place?
node9 explain Bash 'cat ~/.ssh/id_rsa' # shows the verdict the live hook enforces: BLOCK
node9 explain prints the exact rule that fires and where the decision came from. If doctor
says the agent is not wired, the guard is not running, whatever the config looks like.
Every agent, side by side
node9 wires into twelve agents and the depth differs. The coverage matrix shows all of them in one table, including which ones node9 cannot see the shell of.