OpenAI Codex x Radware Agentic AI Protection

Protect OpenAI Codex with Radware Agentic AI Protection. Every prompt is checked before the model sees it, and every tool call is checked before it executes. Each decision produces a Radware Event ID you can trace in the portal.

Installed once per machine, it applies to every Codex session and every new chat automatically.

Install - npm (recommended)

npx @radware/codex-radware-agentic-protection install --name "Your Name"

Then start Codex once and choose "Trust all and continue" when it asks to review hooks.

This is the recommended route: nothing to clone, the runtime is copied to a stable location so the hook cannot break if you move or delete a folder, and upgrades are a single command.

Alternative - from this repository

Use this if npm is unavailable, or if you want to run from source:

git clone https://github.com/Radware/codex-radware-agentic-protection.git
cd codex-radware-agentic-protection
python install.py --name "Your Name"

Both routes install the same hooks and behave identically. The difference is only how the files get onto the machine - with the repository route, keep the folder where it is, because Codex stores the hook path in its configuration.

Full walkthrough: docs/customer-guide.md, also available as a Radware-branded document, Codex-Radware-Integration-Guide.docx.

How it works

Codex exposes native lifecycle hooks. This connector registers two of them:

| Codex event | Radware stage | Effect | |---|---|---| | UserPromptSubmit | AI Guardrails | An unsafe prompt is refused before the model sees it | | PreToolUse | Behavioral Protection | A malicious tool call is denied before it runs |

Enforcement is out-of-path: the hook calls Radware, Radware returns a verdict, and Codex honours it. Your model path is untouched, so Codex keeps using whatever model it normally uses.

PostToolUse and the other lifecycle events cannot block and are never sent for a verdict.

What is covered

| Surface | Covered | |---|---| | Codex CLI | Yes | | Codex desktop app | Yes | | Codex IDE extension (VS Code) | Yes | | codex exec (scripts, CI) | Yes | | Codex Cloud / web | No - runs in OpenAI's cloud, where no local hook exists |

This integration is for Codex. It does not apply to ChatGPT Chat or ChatGPT Work.

Requirements

• Codex 0.145 or newer - lifecycle hooks do not exist before this
• Python 3.8 or newer
• A Radware out-of-path Homegrown Agent key (sk-rdwr-...)

A machine can carry more than one Codex engine - the desktop app ships its own, and older engines can remain after an update. The installer finds them all, targets the newest, and reports any it cannot protect.

Managing it

With npm:

npx @radware/codex-radware-agentic-protection status
npx @radware/codex-radware-agentic-protection install --key sk-rdwr-...   # rotate the key
npx @radware/codex-radware-agentic-protection uninstall
npx @radware/codex-radware-agentic-protection uninstall --purge           # also delete the key

From the repository, the same operations are:

python install.py --status
python install.py --key sk-rdwr-...
python install.py --uninstall
python install.py --uninstall --purge

Restart Codex after installing or uninstalling - a running session keeps hook configuration in memory.

Enterprise deployment

Administrators can enforce the integration on every endpoint so users cannot disable it, by deploying requirements.toml with allow_managed_hooks_only = true:

• Windows: %ProgramData%\OpenAI\Codex\requirements.toml
• macOS and Linux: /etc/codex/requirements.toml

With that setting Codex ignores user, project and session hook configuration and runs only the administrator's hooks. See the customer guide for the full file and rollout notes.

Configuration

Settings live in ~/.radware/codex-hook.json (permissions 0600), because the desktop app is launched from the Start menu or Dock and does not inherit environment variables. Environment variables take precedence where set.

| Setting | Environment variable | Default | |---|---|---| | API key | RADWARE_OUT_OF_PATH_API_KEY | - | | Identity | RADWARE_USER_IDENTIFIER | username + host | | Fail mode | RADWARE_FAIL_MODE | close | | Timeout | RADWARE_TIMEOUT_SECONDS | 20 | | Radware host | RADWARE_HOST | production | | Diagnostics | RADWARE_DEBUG | off |

Fail mode defaults to close: if Radware cannot be reached, the action is blocked rather than allowed through unchecked.

Validation

Validated end to end on Windows, macOS and Linux, with every block correlated to a Radware Security Event. See docs/validation.md. The macOS checks run in CI on every change (workflow).

python -m pytest tests -q

Repo layout

• install.py - installer, uninstaller and status
• radware_codex_hook_launcher.py - what Codex invokes
• src/radware_codex_hook/ - the shim: event mapping, Radware client, session context, redaction
• config/ - hook configuration templates
• docs/ - customer guide (Markdown and branded document) and validation evidence
• tests/ - unit tests
• ci/ - helpers used by the macOS workflow

Getting a key

Create the agent at console.radwarecloud.com: Agentic -> + -> Homegrown Agent -> Out-of-Path. The key is shown exactly once.

Security

See SECURITY.md. In short: the key is stored locally with restricted permissions, sent only to Radware, and never written to logs. Prompts and proposed tool calls are sent to Radware for inspection - that is how the protection works, and it should be confirmed against your data-handling policy before wide deployment.

License

MIT - see LICENSE.