Codex can use every token your shell exports. Give it none.

Codex reads its MCP servers from one file, `~/.codex/config.toml`, so one setup covers every Codex session on the machine: the CLI, the IDE extension and the desktop app. No `GITHUB_TOKEN` or `SLACK_TOKEN` in your shell; each call is checked and logged instead.

Livelast reviewed 24 September 2026

One command, once per machine

You need Node.js 18 or later. Run it from a directory you’ll keep, such as your main project: the agent’s key is stored there and the Codex config points at it.

1
Run the register command. Add --project if you also want an AGENTS.md in this directory.
Terminal
```
npx @agentvalet/register

# or, to also write AGENTS.md here
npx @agentvalet/register --project
```
Your browser opens. Sign in, or create a free account, and the CLI finishes registering when you authorise it. You don’t copy any ids on this path.
Start a new codex session. AgentValet appears in its tool list whenever the agent needs a platform.
In the dashboard, approve the new agent and grant the platforms it needs. It starts with nothing: every call is refused until you grant it.

Connect over OAuth instead, with no key file

This path needs your owner id. It’s in the dashboard under Settings, Account, Owner ID. The Connect Claude, ChatGPT, Copilot… button on the Agents page builds the whole URL for you. Codex’s OAuth needs the server to support dynamic client registration, which AgentValet does, so there’s no client id to enter.

1
Add the server, then log in. The login opens your browser; approve, and AgentValet creates a new agent for this connection with nothing granted.
Terminal
```
codex mcp add agentvalet --url https://api.agentvalet.ai/mcp/v1/<owner-id>
codex mcp login agentvalet
```
Grant that agent its platforms in the dashboard.

Write the TOML by hand

Run npx @agentvalet/register once first. It creates the key on this machine and prints the four values below when it finishes. The MCP server needs all four; an entry without them won’t start.

Add this block to ~/.codex/config.toml.

~/.codex/config.toml

[mcp_servers.agentvalet]
command = "npx"
args = ["-y", "@agentvalet/register@latest", "mcp-server"]
env = { AGENT_ID = "<agent-id>", OWNER_ID = "<owner-id>", PROXY_URL = "https://api.agentvalet.ai", AGENT_PRIVATE_KEY_PATH = "/absolute/path/to/.agentvalet/agent.key" }

What the command writes

~/.codex/config.toml: A [mcp_servers.agentvalet] block, shared by the Codex CLI, IDE extension and desktop app. Written on every run, whichever scope you choose.
AGENTS.md: Only with --project. Created in the current directory with the rules for calling platforms through AgentValet; skipped if you already have one. An existing AGENTS.md gets the approved-platform list added when the CLI refreshes it.
.codex/config.toml: Only with --project. Codex reads it for trusted projects only.
.agentvalet/agent.key: In the directory you ran the command from. The agent’s private key, which never leaves this machine. If you have a .gitignore, the CLI adds .agentvalet/ to it.
CLAUDE.md, .claude/, .mcp.json, .env.agentvalet: Also in that directory, whichever host you use: governance rules and the approved-platform list for Claude Code. Delete them if you don’t use Claude Code there.

What’s governed here

Nothing is allowed until you grant it. This is a typical first grant for Codex CLI; you decide every row, and you can change it without touching the agent.

Example grant for Codex CLI. Platforms and actions are illustrative.
What the agent tries	Platform	Decision
Read an issue	Linear	Allowed within grant
Comment on a pull request	GitHub	Allowed within grant
Change a DNS record	Cloudflare	Asks you
Delete a storage bucket	Supabase	Not granted

Codex guide in the docsThe longer walkthrough, kept with the product docs.

All integrations or the platforms your agents can reach

Put Codex CLI behind AgentValet.

Register the agent, grant only what it needs, and approve the risky calls from your phone. Free to start, no credit card.

Protect my first agent Watch your agent’s calls live, no signup