Claude Code and Codex

Check every prompt, tool call and tool result in a Claude Code or Codex session on your machine, and refuse destructive or credential-reading commands before they run.

Before you start

agentfox is installed and on the PATH your coding agent runs hooks with.

Install the hooks
Without --write it only prints the config. With it, it writes .claude/settings.json, registers the agent, and grants Claude Code's built-in tools so ordinary work is not refused.
bash
```
agentfox admin hooks install --agent claude-dev --write
```
Run init again
This turns on the coding-agent rules for the agent the hooks govern. They start in Watch.
bash
```
agentfox init
```
Start the daemon
Each hook asks a background process, so a check takes milliseconds. Keep it running in a terminal tab or under your process manager, then check it is listening.
bash
```
agentfox admin hooks daemon
agentfox admin hooks status
```
Grant the other tools your sessions use
MCP tools arrive as mcp__server__tool and have no grant, so they are refused. Grant one, or let a few sessions run and have grants proposed from what the agent called.
bash
```
agentfox permit grant claude-dev mcp__github__create_issue
agentfox policy proposals from-traffic --agent claude-dev
```
Switch to Block
After a few days, read what the coding-agent rules would have stopped on the Issues page, then turn them on.
bash
```
agentfox policy enforce coding-agent
```

What is refused from the start

The shell rules block from day one, whatever the grants say:

Command	Rule
`curl … \| sh`	`action.remote_code_execution`
`cat .env`, `cat ~/.aws/credentials`	`secrets.credential_file`
`rm -rf ~`	`shell.destructive`
`git reset --hard HEAD~3`	`action.history_rewrite`
`terraform apply`, `npm publish`	`action.infrastructure_mutation`, `action.supply_chain_publish`
Turning AgentFox off, e.g. `agentfox policy observe …`	`control_plane.tamper`

A refused tool call does not run, and the agent is told which rule stopped it. A refused prompt never reaches the model. A tool result cannot be undone; when it carries injected instructions, the agent is told to treat it as data.

Codex

The same steps, with three differences:

Install with --harness codex. It writes .codex/hooks.json; add --scope user for ~/.codex/hooks.json and every project.
Open Codex in the project, run /hooks and trust the three AgentFox hooks. Codex skips a hook nobody trusted, and a changed file needs trusting again.
Codex cannot ask you from a hook, so a call that needs a person is refused with the reason. Hosted tools such as web search run on OpenAI's side and are not checked.

bash

agentfox admin hooks install --harness codex --agent codex-dev --write

The operator plugin

Separate from the hooks, the AgentFox plugin lets Claude Code drive AgentFox for you: slash commands such as /agentfox:tour, /agentfox:start, /agentfox:status and /agentfox:redteam, matching skills, and the read-only AgentFox MCP server. It asks you before any command that changes what is blocked or granted.

bash

claude plugin marketplace add architsharm/agentfox
claude plugin install agentfox@agentfox

For Codex: codex plugin marketplace add architsharm/agentfox, then codex plugin add agentfox@agentfox. The Codex plugin refuses those commands and tells the agent to hand them to you.

If something goes wrong

You see	Do this
A tool refused with `capability.denied`	It is not a built-in tool. Grant it with `agentfox permit grant`.
AF_UNIX path too long	Set `AGENTFOX_STATE_DIR` to a shorter folder, for the daemon and the coding agent.
coding-agent not enabled, from init	Install the hooks first, then run `agentfox init` again.
Codex runs everything unchecked	Trust the hooks in `/hooks`, and start the daemon.

Before you start

agentfox is installed and on the PATH your coding agent runs hooks with.

Install the hooks

Without --write it only prints the config. With it, it writes .claude/settings.json, registers the agent, and grants Claude Code's built-in tools so ordinary work is not refused.

bash

agentfox admin hooks install --agent claude-dev --write

Run init again

This turns on the coding-agent rules for the agent the hooks govern. They start in Watch.

bash

agentfox init

Start the daemon

Each hook asks a background process, so a check takes milliseconds. Keep it running in a terminal tab or under your process manager, then check it is listening.

bash

agentfox admin hooks daemon
agentfox admin hooks status

Grant the other tools your sessions use

MCP tools arrive as mcp__server__tool and have no grant, so they are refused. Grant one, or let a few sessions run and have grants proposed from what the agent called.

bash

agentfox permit grant claude-dev mcp__github__create_issue
agentfox policy proposals from-traffic --agent claude-dev

Switch to Block

After a few days, read what the coding-agent rules would have stopped on the Issues page, then turn them on.

bash

agentfox policy enforce coding-agent

What is refused from the start

The shell rules block from day one, whatever the grants say:

Command

Rule

curl … | sh

action.remote_code_execution

cat .env, cat ~/.aws/credentials

secrets.credential_file

rm -rf ~

shell.destructive

git reset --hard HEAD~3

action.history_rewrite

terraform apply, npm publish

action.infrastructure_mutation, action.supply_chain_publish

Turning AgentFox off, e.g. agentfox policy observe …

control_plane.tamper

Codex

The same steps, with three differences:

Install with --harness codex. It writes .codex/hooks.json; add --scope user for ~/.codex/hooks.json and every project.

Open Codex in the project, run /hooks and trust the three AgentFox hooks. Codex skips a hook nobody trusted, and a changed file needs trusting again.

Codex cannot ask you from a hook, so a call that needs a person is refused with the reason. Hosted tools such as web search run on OpenAI's side and are not checked.

bash

agentfox admin hooks install --harness codex --agent codex-dev --write

The operator plugin

bash

claude plugin marketplace add architsharm/agentfox
claude plugin install agentfox@agentfox

For Codex: codex plugin marketplace add architsharm/agentfox, then codex plugin add agentfox@agentfox. The Codex plugin refuses those commands and tells the agent to hand them to you.

If something goes wrong

You see

Do this

A tool refused with capability.denied

It is not a built-in tool. Grant it with agentfox permit grant.

AF_UNIX path too long

Set AGENTFOX_STATE_DIR to a shorter folder, for the daemon and the coding agent.

coding-agent not enabled, from init

Install the hooks first, then run agentfox init again.

Codex runs everything unchecked

Trust the hooks in /hooks, and start the daemon.