Who this is for

OpenAI's coding agent, in the terminal or the IDE. For: Codex. Acts as: You. Credential: Your MCP sign-in, and your contro1 sign-in for the hook.

Codex connects in two independent parts: the Contro1 MCP server for company apps, signed in as you, and a Codex hook that makes chosen shell commands wait for a person in Contro1. There is no contro1 connect codex.

All four ways to connect an agent

Company apps in Codex (MCP)

Codex runs contro1 mcp serve as a local MCP server, signed in as you. It can then list and run the Actions you may use, every call checked by Contro1 and recorded as yours.

Signing Codex in to the remote address https://api.contro1.com/api/centcom/mcp directly (codex mcp login) does not work today. Codex's sign-in returns to a 127.0.0.1 address on the same computer, which Contro1 refuses. Use the local server below.

Company apps in Codex (MCP), step 1: Install the Contro1 CLI

Once per computer. The installer downloads the contro1 program from its official GitHub releases. You can read it first at https://contro1.com/install.sh (PowerShell: https://contro1.com/install.ps1).

curl -fsSL https://contro1.com/install.sh | sh
contro1 --version

irm https://contro1.com/install.ps1 | iex
contro1 --version

What you should see: The installer ends with "Installed contro1 to <folder>", and contro1 --version prints "contro1 version 0.2.29" or later. On Windows, if contro1 is not found, open a new terminal: the installer added it to your PATH.

Company apps in Codex (MCP), step 2: Sign the MCP connection in as you

This gives the local Contro1 MCP server a sign-in of its own, separate from contro1 auth login. --execute asks for permission to run Actions; without it the connection can only read and preview.

It shows a code and opens the approval page. You can approve on this computer or on any other device, such as your phone. On the page, check that "Run Actions as you" is ticked, then press Approve.

contro1 mcp login --execute

What you should see: "To connect, open this address on any device and approve: https://contro1.com/connect-app and enter the code: ABCD-EFGH". After you approve: "MCP connected for profile default (mcp:whoami, ..., mcp:actions:execute)." and "See or disconnect it anytime in Contro1: Settings > Connected apps."

Company apps in Codex (MCP), step 3: Add Contro1 to Codex

Use the Codex command, or write the same entry into ~/.codex/config.toml yourself. Both do the same thing.

codex mcp add contro1 -- contro1 mcp serve
codex mcp list

[mcp_servers.contro1]
command = "contro1"
args = ["mcp", "serve"]

What you should see: codex mcp list shows contro1 with the command contro1 mcp serve. In Codex, /mcp lists contro1 and its tools.

Company apps in Codex (MCP), step 4: Try it

In Codex, ask: "Who am I in Contro1?"

What you should see: Codex calls the whoami tool, which names you and your organization.

Approvals for shell commands (Codex hook)

contro1 hooks codex is a Codex PreToolUse hook. Before Codex runs a Bash command that matches, it creates an approval request in Contro1 and keeps Codex waiting until a person decides. Other commands go through Codex's normal permission flow. It handles the Bash tool only: not apply_patch, other local tools or MCP calls.

By default it matches deploy-like commands: npm, pnpm or yarn deploy scripts, kubectl and Helm changes, Terraform or OpenTofu apply and destroy, Pulumi up and destroy, production Vercel or Netlify deploys, and selected cloud deploy commands.

Approvals for shell commands (Codex hook), step 1: Sign in to Contro1 on this computer

The hook creates the approval request with this sign-in. A browser opens on a Contro1 approval page; approve it with your Contro1 account.

contro1 auth login

What you should see: "Logged in as you@company.com (Org: <your organization>)".

Approvals for shell commands (Codex hook), step 2: Add the hook to the project

Put this file at .codex/hooks.json in the project. Replace cto with a reviewer role somebody in your organization holds (or is mapped to under Settings, Routing): only people with that role can approve the request.

{
  "description": "Contro1 approval for selected Codex shell commands.",
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "^Bash
AI Control Plane for Enterprise AI Agents | Contro1
Control AI agents in production with human oversight built in. Contro1 routes approvals, escalations, and critical decisions to the right team by function, role, and shift.
What Contro1 does
Human-in-the-loop approvals for high-impact agent actions
Role-based routing to the right operator across departments
SLA timers and escalation paths for unresolved decisions
Signed webhook callbacks so workflows continue safely
Cross-framework coverage for modern AI agent stacks
Key links
Docs
Resource center
llms.txt
Security policy
quot;,
        "hooks": [
          {
            "type": "command",
            "command": "contro1 hooks codex --role cto --environment production --setup convenience",
            "timeout": 910,
            "statusMessage": "Waiting for approval in Contro1"
          }
        ]
      }
    ]
  }
}

What you should see: The file is saved in the project. Nothing else changes until Codex trusts it.

Approvals for shell commands (Codex hook), step 3: Trust the hook in Codex

Open Codex in that project and run /hooks. Review the Contro1 hook and trust it. Codex records trust against the hook's exact text, so a changed hook has to be trusted again.

What you should see: /hooks lists the Contro1 hook as trusted for PreToolUse.

Approvals for shell commands (Codex hook), step 4: Try it

In a test project whose package.json has "deploy": "echo deployed", ask Codex to run npm run deploy.

What you should see: Codex shows "Waiting for approval in Contro1", and Contro1 shows a request titled "Approve production deploy from Codex?" with the command, branch, commit and working folder. Approve it and the command runs ("Approved by Contro1. Codex may run the exact reviewed command."). Reject it and Codex is told "Production deploy denied by Contro1." with the reviewer's comment. Nobody answering within 15 minutes counts as a refusal.

What each part gives you

Codex is not registered as its own agent with a key in the Contro1 service, the way Claude Code is: there is no contro1 connect codex today.

Make the hook something users cannot remove

A project hook is a convenience: whoever controls the project configuration can change or remove it. To enforce it, distribute a managed Codex requirements.toml through your device or system policy, allow only managed hooks, and install contro1 at the administrator-controlled path the hook names. To protect production itself, keep deploy credentials off developer machines and release them only in protected CI after the approval is verified.

Codex approvals guide, with the managed template · Codex hooks reference

Give it something to do

A connected agent starts with nothing. It can ask people for approval and report what it did. To use an application such as Gmail, two things happen in Contro1:

• Apps: an administrator turns the application on for the organization and chooses which of its Actions are allowed. That alone gives no agent a tool.
• Access: a person opens the agent, connects the account it should use (a shared team account, or their own), ticks the Actions it may run, and presses Save. People can do this for their own agents, within what the organization allows.
• A personal account, such as your own mailbox, is always used on your behalf. When you are the agent's owner and give it your own account in Access, that is recorded as you letting it act for you. Anybody else whose account it should use turns that on for the agent in Access themselves.
• The agent's page shows a "Get it working" card with three steps: Connected to Contro1, Can do something, Did something. It always shows the next one to do, and it disappears once all three are done.

Action Gateway: apps and access

Frequently asked questions

Is there a contro1 connect codex?

No. Codex connects through the local MCP server signed in as you (contro1 mcp login --execute, then contro1 mcp serve), and through the contro1 hooks codex hook for approvals.

Does the hook gate every Codex tool?

No. It handles the Bash tool, for deploy-like commands by default or every command with --all-bash. apply_patch, other local tools and MCP calls are not gated by it.

Can a reviewer edit the command?

No. Reject it and let Codex propose a new command, so each decision stays bound to exactly what was reviewed.

Related resources