Docs

Codex CLI

OpenAI's terminal AI tool. Fully covered. On a whole-machine install it runs ZYBE by policy; on a just-me install the developer approves ZYBE once.

What ZYBE can do

Block and Ask, on every rule: commands, file reads and writes, web fetches, MCP calls, installs, action after prompt injection.

With Cover the conversation on, Codex CLI also sends its requests to OpenAI through ZYBE on the laptop, so a pasted key is stopped before it leaves and injected text in a tool result is caught as it goes to the model.

What you do

Whole-machine install: nothing. ZYBE is written as managed configuration, which Codex runs without asking anyone.

Just-me install: Codex won't run a check it finds in a developer's own settings until the developer has looked at it once. Open Codex, type /hooks, and approve zybe-hook. The installer prints this reminder. Until it's done, the console shows Codex as Blocking with a note that approval is pending, and Codex runs without the check.

Check it's working

1. Run codex and ask it for any command.
2. In the console, open the laptop from Inventory, Endpoints, click Sensor. Codex CLI shows Blocking.

What the developer sees when blocked

Command blocked by PreToolUse hook: Blocked by your organisation: ...

Codex stops and explains.

If ZYBE isn't connected

ZYBE still reads Codex's own session records after the fact, so what it did is reported. The console shows it as Recording then.

For IT