Codex CLI + AgentValet — Governed MCP for OpenAI's terminal agent

Configuration

Two ways to add AgentValet

Use the codex mcp add command or edit the TOML config file directly.

via CLI (recommended)

codex mcp add agentvalet https://api.agentvalet.ai/mcp/v1/YOUR_OWNER_ID

or edit the config file directly

~/.codex/config.toml

[mcp_servers.agentvalet]
url       = "https://api.agentvalet.ai/mcp/v1/YOUR_OWNER_ID"
transport = "http"

Setup

Get connected in 4 steps

1

Run npx @agentvalet/register — generates an RS256 keypair, records your agent in the registry, and outputs your OWNER_ID.

2

Add the AgentValet server via codex mcp add agentvalet https://api.agentvalet.ai/mcp/v1/… — or edit ~/.codex/config.toml directly with the TOML block above.

3

Approve platforms in the AgentValet dashboard. Set which platforms the agent can call and what scopes it gets per platform.

4

Run codex normally. AgentValet appears in the tool list when the agent needs to call a platform. No keys in your shell — all calls proxied and logged.

What changes

Terminal agent, governed platform access

No keys in env vars

Codex agents no longer need GITHUB_TOKEN or SLACK_TOKEN in your shell. AgentValet handles credential injection at call time.

Permission matrix

Each platform call is validated against the permission matrix you set in the dashboard — deny-by-default, explicit allow required per scope.

Immutable audit log

Every call logged in append-only storage: which agent, which platform, which action, exact timestamp.

Circuit breaker

Three auth failures or five API errors auto-suspend the agent. You're notified and can investigate before re-enabling.

AgentValet for Codex CLI

Two ways to add AgentValet

Get connected in 4 steps

Terminal agent, governed platform access

Ready to connect Codex CLI?