Live webinarWebinar with Jason Lee, Tue, Oct 13Your newest insider is an AI agent.Jason LeeFormer CISO, Zoom & SplunkRegister

Guardrails for OpenAI Codex, built from your own rules.

Your company's rules reach Codex before every patch. What it must never do is blocked before it runs.

npx -y @cybedefend/vibedefend@latest install

Create a free accountAny recent version of OpenAI CodexRead the docs

OpenAI CodexOpenAI Codex is writingbilling/refund.ts

export async function refund(req: Request) {
  const { id, amount } = await req.json();
  const invoice = await db.invoices.find({
    id, tenant: req.tenant,
  });
  if (amount > 500)
    await approvals.second(invoice);
  return payments.refund(invoice, amount);
}

Every query is scoped to the tenant.

rules/data-access.md

Refunds above €500 need a second approver.

Approved once by Sofia M.

Checked before the commit: clean

Set up in four steps.

  1. Run one commandIn any terminal, on macOS, Linux or Windows. Node 18.17 or later.
  2. Choose your region, sign inEU or US. Your browser opens to sign in, no key to paste.
  3. Tick OpenAI CodexThe installer finds the agents on your machine and ticks them for you.
  4. Code as usualOnce, in Codex: run /hooks and trust the cybedefend entries.

Check it any time: vibedefend status

What VibeDefend adds to OpenAI Codex.

Rules served

Your business and security rules reach OpenAI Codex before each edit.

OpenAI CodexOpenAI Codex is writingsrc/billing/cart-checkout.ts

const total = new Decimal128(cart.sum);
const rows = await db.query(
  "SELECT * FROM carts WHERE id = $1", [id]
);

Monetary amounts use Decimal128, never Number.

Mined from src/billing.ts:14

Parameterise every query that mixes user input.

OWASP Top 10

Served before the edit

Secret guard

Raw secret reads are refused; OpenAI Codex gets the managed reference instead.

OpenAI CodexOpenAI Codexwebhooks.ts

  1. cat .env | grep STRIPE

    Blocked: raw secret read

  2. Insteadprocess.env.STRIPE_WEBHOOK_SECRET

  3. npm test -- webhooks

    Tests pass

Logged for the team

Action guard

Destructive commands, schema drops and protected paths are stopped before they run.

OpenAI CodexOpenAI Codex

  1. rm -rf dist/

    Allowed: build output

  2. rm -rf .cache/

    Allowed: cache

  3. rm -rf ./storage/uploads

    Blocked: protected path, user uploads

Logged for the team

Live findings

SAST, SCA, secrets, IaC and CI/CD findings, live in the session.

OpenAI CodexOpenAI Codex

  1. SASTsrc/db/users.repo.ts:42

    SQL injection

  2. SCApackage.json

    lodash 4.17.20, CVE-2021-23337

  3. Secretsconfig/prod.yml

    AWS access key

  4. IaCinfra/main.tf

    S3 bucket public-read

  5. CI/CD.github/workflows/deploy.yml

    pull_request_target

In the agent's context, live

Your questions.

Does VibeDefend change my OpenAI Codex configuration?
It adds its hooks and registers the cybedefend MCP server, in ~/.codex/hooks.json, ~/.codex/config.toml. Your own hooks stay: re-running the installer only replaces VibeDefend's entries.
What leaves my machine?
The analysis runs in the region you chose at install, EU or US. The decision to block an action is made on your machine. Before an edit, the hook sends the part of the file being written, to find the rules that apply. The session review sends the files the session changed. Your sign-in token stays in your OS keychain.
Which version of OpenAI Codex do I need?
A recent version of OpenAI Codex, and Node 18.17 or later. The installer runs on macOS, Linux and Windows.
Do I need to link each repository?
Not for projects imported from GitHub or GitLab: VibeDefend reads the repo's origin and finds the project. For any other repo, run vibedefend link once. It writes .cybedefend/config.json with the project ID.
How do I remove it?
Run vibedefend uninstall: it removes every file VibeDefend installed. If you installed the package globally, then run npm uninstall -g @cybedefend/vibedefend.
Why do the hooks show Active 0 in Codex?
Codex 0.131 and later keep new hooks dormant until you approve them. Open Codex, run /hooks and trust the cybedefend entries.
Technical details for OpenAI Codex
MCP server
Available~/.codex/config.toml
Rules before each edit
AvailablePreToolUse^(Edit|Write|apply_patch|Bash)$Before apply_patch, edits and shell commands that write files. Read-only commands fetch nothing.
Dangerous actions blocked
AvailablePreToolUse
Rules loaded at start
AvailableSessionStart
End-of-session review
AvailableStop
Review of long sessions
Not availableNo equivalentCodex has no event before compaction.
Reminder on every prompt
Through MCPServer.instructionsCodex receives the CybeDefend instructions from the MCP server at each session, so no reminder is needed.

What it writes for OpenAI Codex

  • ~/.codex/hooks.json
  • ~/.codex/config.toml

And the hook runner in ~/.cybedefend/. Your own hooks stay: re-running the installer only replaces VibeDefend's entries.

Approve the hooks once. Codex 0.131 and later ask you to trust each hook: open Codex, run /hooks and trust the cybedefend entries. Until then the panel shows Installed N, Active 0.

One more sign-in, once: Codex's MCP token cannot call the endpoints the hooks use. The installer also sets hooks = true in ~/.codex/config.toml for you.

Something off? vibedefend status gives a read-only report, and vibedefend doctor repairs what it can.

VibeDefend also works with