Codex CLI security hooks

Muzzle checks each command, patch, file write and MCP call Codex makes before it runs, and the requests its commands send.

~/.codex/hooks.json

"PreToolUse": [ { "matcher": "^(Bash|apply_patch|Edit|Write|mcp__.*)$", "hooks": [ … "muzzle hook codex" … ] } ],

"PostToolUse": [ { "matcher": "^(WebFetch|WebSearch|Bash|Read|mcp__.*)$", … } ],

"SessionStart": [ … ]

zsh

$ codex

› /hooks

Set it up

Download Muzzle, open it and click Get started.
Enter what should never leave your Mac: your email, name and phone number. Muzzle suggests your git email and account name.
Switch Codex on and click Protect. Muzzle adds its hooks to ~/.codex/hooks.json and a codex shell function to ~/.zshrc, and to ~/.bashrc if you have one.
Open a new terminal, start Codex and type /hooks to turn the hooks on.
Get Pro with a key, or by contributing to the Threat Feed with a confirmed email.
Muzzle scans your projects and shows anything that already leaks. For the first week it only watches, then you turn blocking on.

Leaks in commands, patches, file writes and MCP calls

Pro

Settings lock

Free

Credential files and package check

Pro

Prompt injection alerts on results

Pro

Instruction files and risky folders at session start

Pro

Requests made by commands Codex runs

Pro

What happens when Pro ends?

The settings lock keeps working. The other checks let Codex through; nothing is uninstalled.

How do I remove it?

Switch Codex off in Muzzle's Settings. Muzzle removes its hooks and the shell function.

Free · Apple Silicon · macOS 12 or later