Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/bex-co/bex-securityInstalling this writes the configuration, not the program: `./scripts/launch_codex_security_mcp` has to be on your PATH already, or the server will not start.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/mcp/bex-co/bex-security/codex-security-codex-security)<a href="https://agentmods.dev/mcp/bex-co/bex-security/codex-security-codex-security"><img src="https://agentmods.dev/badge/mcp/bex-co/bex-security/codex-security-codex-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/mcp/bex-co/bex-security/codex-security-codex-security"><img src="https://agentmods.dev/badge/mcp/bex-co/bex-security/codex-security-codex-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
codex-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
98% identical to codex-security — 2 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
{
"codex-security": {
"command": "./scripts/launch_codex_security_mcp",
"args": [
"--stdio"
],
"cwd": ".",
"env_vars": [
"CODEX_HOME",
"CODEX_SQLITE_HOME",
"CODEX_API_KEY",
"CODEX_SAFETY_IDENTIFIER",
"CODEX_BROWSER_USE_NODE_PATH",
"CODEX_CLI_PATH",
"CODEX_ELECTRON_RESOURCES_PATH",
"CODEX_MANAGED_PACKAGE_ROOT",
"CODEX_MCP_NODE_PATH",
"OPENAI_API_KEY",
"OPENROUTER_API_KEY",
"FIREWORKS_API_KEY",
"AWS_BEARER_TOKEN_BEDROCK",
"AWS_ACCESS_KEY_ID",
"AWS_SECRET_ACCESS_KEY",
"AWS_SESSION_TOKEN",
"AWS_PROFILE",
"AWS_REGION",
"AWS_DEFAULT_REGION",
"AWS_CONFIG_FILE",
"AWS_SHARED_CREDENTIALS_FILE",
"AWS_ROLE_ARN",
"AWS_ROLE_SESSION_NAME",
"AWS_WEB_IDENTITY_TOKEN_FILE",
"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
"AWS_CONTAINER_CREDENTIALS_FULL_URI",
"AWS_CONTAINER_AUTHORIZATION_TOKEN",
"AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
"PYTHON",
"PYTHONUTF8",
"CODEX_SECURITY_GIT",
"CODEX_SECURITY_KNOWLEDGE_BASE",
"CODEX_SECURITY_CONFIG_PATH",
"CODEX_SECURITY_DEEP_SCAN_CONFIG_PATH",
"CODEX_SECURITY_SCAN_ROOT",
"CODEX_SECURITY_STATE_DIR",
"CODEX_SECURITY_SURFACE",
"HTTP_PROXY",
"HTTPS_PROXY",
"ALL_PROXY",
"NO_PROXY",
"SSL_CERT_FILE",
"REQUESTS_CA_BUNDLE",
"NODE_EXTRA_CA_CERTS",
"XDG_CACHE_HOME"
],
"startup_timeout_sec": 120,
"tool_timeout_sec": 349200
}
}What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 16d ago Changed · +1 lines bebb2936dbe5
- 1mo ago Changed · +1 lines 52c84ebef2a1
- 1mo ago Changed · +1 lines 49847c97e35d
- 1mo ago First seen · 55 lines scan A ae298af141b8
codex-security is an MCP server published in the GitHub repository bex-co/bex-security (51 stars, last pushed today), licensed Apache-2.0. Its token cost is not measured: an MCP server costs its tool schemas, not its config file. A static security scan graded it A with 0 findings. It is 98% identical to codex-security, differing in 2 lines, and is treated as a copy.
Other mcp servers, from other repositories
pathfinder
Python SDK for code-pathfinder static analysis for modern security teams. Runs locally from the codepathfinder Python package.
ai-appsec
Evidence-backed AppSec for AI applications and agents. Powered by HAIEC. Runs locally from the ai-appsec npm package.
qdrant-search
MCP server "qdrant-search", hosted remotely, as configured in nick-pape/grackle.
playwright
Lets the agent drive a real browser: open pages, click, type, take screenshots and read the accessibility tree, using Playwright. Runs locally from the @playwright/mcp npm package.
github
GitHub's hosted MCP server: lets the agent search code, read and create issues and pull requests. Remote server at api.githubcopilot.com.
docs-langchain
MCP server "docs-langchain", hosted remotely at docs.langchain.com, as configured in langchain-ai/langchain.