Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add mcp/bex-co/bex-security/codex-security-codex-securitygit clone --depth 1 https://github.com/bex-co/bex-securityGrade A, and why
codex-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"codex-security": {
"command": "./scripts/launch_codex_security_mcp",
"args": [
"--stdio"
],
"cwd": ".",
"env_vars": [
"CODEX_HOME",
"CODEX_SQLITE_HOME",
"CODEX_API_KEY",
"CODEX_SAFETY_IDENTIFIER",
"CODEX_BROWSER_USE_NODE_PATH",
"CODEX_CLI_PATH",
"CODEX_ELECTRON_RESOURCES_PATH",
"CODEX_MANAGED_PACKAGE_ROOT",
"CODEX_MCP_NODE_PATH",
"OPENAI_API_KEY",
"OPENROUTER_API_KEY",
"FIREWORKS_API_KEY",
"AWS_BEARER_TOKEN_BEDROCK",
"AWS_ACCESS_KEY_ID",
"AWS_SECRET_ACCESS_KEY",
"AWS_SESSION_TOKEN",
"AWS_PROFILE",
"AWS_REGION",
"AWS_DEFAULT_REGION",
"AWS_CONFIG_FILE",
"AWS_SHARED_CREDENTIALS_FILE",
"AWS_ROLE_ARN",
"AWS_ROLE_SESSION_NAME",
"AWS_WEB_IDENTITY_TOKEN_FILE",
"AWS_CONTAINER_CREDENTIALS_RELATIVE_URI",
"AWS_CONTAINER_CREDENTIALS_FULL_URI",
"AWS_CONTAINER_AUTHORIZATION_TOKEN",
"AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE",
"PYTHON",
"PYTHONUTF8",
"CODEX_SECURITY_KNOWLEDGE_BASE",
"CODEX_SECURITY_DEEP_SCAN_CONFIG_PATH",
"CODEX_SECURITY_SCAN_ROOT",
"CODEX_SECURITY_STATE_DIR",
"CODEX_SECURITY_SURFACE",
"HTTP_PROXY",
"HTTPS_PROXY",
"ALL_PROXY",
"NO_PROXY",
"SSL_CERT_FILE",
"REQUESTS_CA_BUNDLE",
"NODE_EXTRA_CA_CERTS",
"XDG_CACHE_HOME"
],
"tool_timeout_sec": 349200
}
}What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 55 lines scan A ae298af141b8
codex-security is an MCP server published in the GitHub repository bex-co/bex-security (40 stars, last pushed 3d ago), licensed Apache-2.0. Its token cost is not measured: an MCP server costs its tool schemas, not its config file. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other mcp servers, from other repositories
pathfinder
Python SDK for code-pathfinder static analysis for modern security teams. Runs locally from the codepathfinder Python package.
cursor-delegate-mcp
Bridge AI coding hosts to cursor-agent over the Agent Client Protocol. Runs locally from the cursor-delegate-mcp npm package.
ai-appsec
Evidence-backed AppSec for AI applications and agents. Powered by HAIEC. Runs locally from the ai-appsec npm package.
qdrant-search
MCP server "qdrant-search", hosted remotely, as configured in nick-pape/grackle.
github
GitHub's hosted MCP server: lets the agent search code, read and create issues and pull requests. Remote server at api.githubcopilot.com.
playwright
Lets the agent drive a real browser: open pages, click, type, take screenshots and read the accessibility tree, using Playwright. Runs locally from the @playwright/mcp npm package.