AI Coding Tool Setup and Reference (5/7) — Codex CLI Advanced Config: config.toml

Per official Config Reference — real snippets, profiles, Windows native, safe rollout path

핵심 요약

  • Audience: You have Codex installed (install guide) and now want to shape approval / sandbox / models / MCP via ~/.codex/config.toml.
  • What you'll get: Eight frequently-used categories of snippets per the official Config Reference — three approval modes plus granular, workspace-write internals, multi-provider (OpenAI / Azure / Ollama), MCP server registration, profiles, Windows native option.
  • Prerequisite: Codex installed, AGENTS.md basics.

1. Where config.toml lives and how it layers

Official paths:

  • User-level: ~/.codex/config.toml (macOS/Linux) or %USERPROFILE%\.codex\config.toml (Windows)
  • Project-level: .codex/config.toml (project root, optional)
  • Admin enforcement: ~/.codex/requirements.toml (organizational policy)

Layering: project > user > default. requirements.toml hard-constrains user settings (users can't weaken).

~/.codex/ may not auto-create on first run. Create with mkdir -p ~/.codex.

2. Minimum useful config — starter

~/.codex/config.toml:

model = "gpt-5-codex"
model_provider = "openai"

approval_policy = "on-request"

sandbox_mode = "workspace-write"

model_reasoning_effort = "medium"

web_search = "cached"

These six lines are enough for day-to-day work. Borrow from below as needed.

3. Three approval policies + granular

approval_policy decides when Codex pauses for user approval.

Value Behavior
untrusted Only known-safe read-only commands auto-run; others always prompt
on-request (default) Model decides when to request
never Never prompt (automation only; risky)

3.1 Granular — per-category control

approval_policy = { granular = {
  sandbox_approval = true,
  rules = true,
  mcp_elicitations = true,
  request_permissions = false,
  skill_approval = false
} }
  • sandbox_approval — ask when leaving the sandbox
  • rules — ask when a prefix rule (execpolicy) triggers
  • mcp_elicitations — when an MCP server asks for input
  • request_permissions — permission-change requests
  • skill_approval — skill approvals

Granular is best when you want "only prompt where human judgment is required; automate the rest."

3.2 Approvals Reviewer

approvals_reviewer = "user"  # user (default) | auto_review

auto_review delegates approval decisions to a reviewer model (enterprise use).

4. Three sandbox modes + workspace-write internals

Mode Read Write Network
read-only ✅ ❌ ❌
workspace-write ✅ ✅ (within cwd) ❌ (default)
danger-full-access ✅ ✅ unrestricted ✅

4.1 workspace-write details

sandbox_mode = "workspace-write"

[sandbox_workspace_write]
writable_roots = ["/tmp/build", "/var/log/myapp"]

network_access = false

exclude_tmpdir_env_var = false

exclude_slash_tmp = false

Enable network_access = true only when builds need to fetch dependencies. Leaving it on weakens the sandbox.

4.2 Fine-grained with Permissions Profile

default_permissions = "workspace"

[permissions.workspace.filesystem]
glob_scan_max_depth = 3
":project_roots" = { "." = "write", "**/*.env" = "none" }
"/absolute/path/to/secrets" = "none"

:project_roots is the project-relative token. **/*.env blocks even reading any env file anywhere in the project.

5. Reasoning & response control

5.1 Effort levels

model_reasoning_effort = "medium"

plan_mode_reasoning_effort = "high"

model_reasoning_summary = "auto"

model_verbosity = "medium"

5.2 Context & token caps



tool_output_token_limit = 12000

If you frequently read long logs, 8,000–20,000 is a reasonable range for tool_output_token_limit.

6. Multiple model providers

Built-in IDs: openai, ollama, lmstudio (reserved, can't override). Register custom providers under a different ID.

6.1 OpenAI Data Residency

[model_providers.openaidr]
name = "OpenAI Data Residency"
base_url = "https://us.api.openai.com/v1"
wire_api = "responses"

6.2 Azure OpenAI

[model_providers.azure]
name = "Azure"
base_url = "https://YOUR_PROJECT_NAME.openai.azure.com/openai"
wire_api = "responses"
query_params = { api-version = "2025-04-01-preview" }
env_key = "AZURE_OPENAI_API_KEY"
env_key_instructions = "Set AZURE_OPENAI_API_KEY in your environment"

6.3 Local Ollama (OSS models)

[model_providers.local_ollama]
name = "Ollama"
base_url = "http://localhost:11434/v1"
wire_api = "responses"

Switch inside a session:

/model gpt-oss-120b@local_ollama

6.4 Command-backed bearer token

For proxies or short-lived tokens:

[model_providers.proxy]
name = "OpenAI via LLM proxy"
base_url = "https://proxy.example.com/v1"
wire_api = "responses"

[model_providers.proxy.auth]
command = "/usr/local/bin/fetch-codex-token"
args = ["--audience", "codex"]
timeout_ms = 5000
refresh_interval_ms = 300000

The command prints a JWT to stdout; Codex injects it as a bearer header and refreshes every 5 minutes.

7. Registering MCP servers

Two transports are supported.

7.1 STDIO (local process)

[mcp_servers.docs]
enabled = true
command = "docs-server"
args = ["--port", "4000"]
env = { "API_KEY" = "value" }
cwd = "/path/to/server"
startup_timeout_sec = 10
tool_timeout_sec = 60
enabled_tools = ["search", "summarize"]
disabled_tools = ["slow-tool"]

7.2 Streamable HTTP

[mcp_servers.github]
enabled = true
url = "https://github-mcp.example.com/mcp"
bearer_token_env_var = "GITHUB_TOKEN"
http_headers = { "X-Example" = "value" }
env_http_headers = { "X-Auth" = "AUTH_ENV" }
scopes = ["repo"]

bearer_token_env_var injects that env var's value as Authorization: Bearer <token>. Fits most authenticated MCP servers.

7.3 Required servers

[mcp_servers.critical]
command = "critical-server"
required = true  # Codex startup fails if this server can't initialize

For production automation that must not run without a specific MCP server.

8. Profiles — preset switching for scenarios

Keep multiple work modes in one config.toml and switch via flag.

profile = "safe"  # default profile

[profiles.safe]
sandbox_mode = "read-only"
approval_policy = "untrusted"
model_reasoning_effort = "low"

[profiles.dev]
sandbox_mode = "workspace-write"
approval_policy = "on-request"
model_reasoning_effort = "medium"

[profiles.ci]
sandbox_mode = "workspace-write"
approval_policy = "never"
model_reasoning_effort = "minimal"
web_search = "disabled"

Invoke with:

codex --profile dev
codex --profile ci exec "lint the codebase and fix issues"

Leaving safe as default and switching to dev deliberately prevents accidental destructive runs.

9. History, state, shell environment

9.1 History persistence

[history]
persistence = "save-all"  # save-all (default) | none
max_bytes = 5242880  # 5 MB

Use none for API-auth / audited environments where transcripts shouldn't persist.

9.2 Shell environment policy

Controls the env vars of shells Codex spawns:

[shell_environment_policy]
inherit = "all"

ignore_default_excludes = false

exclude = ["AWS_*", "AZURE_*"]

set = { "CI" = "true" }

include_only = []

In sensitive environments, inherit = "core" + include_only = ["PATH", "HOME"] leaks the minimum.

9.3 SQLite state location

sqlite_home = "/path/to/codex-state"  # default $CODEX_HOME
log_dir = "/path/to/codex-logs"

10. Windows native only

[windows]
sandbox = "unelevated"

elevated runs the sandbox as admin — required for rare cases like registry edits or system-folder access. Normal dev should stick with unelevated.

Non-Windows hosts silently ignore the [windows] section.

11. TUI customization (optional)

[tui]
theme = "catppuccin-mocha"

notifications = false  # true | false | ["agent-turn-complete", "approval-requested"]

animations = true

status_line = ["model", "context-remaining", "git-branch"]

terminal_title = ["spinner", "project"]

Custom .tmTheme files go in $CODEX_HOME/themes/ and appear in /theme automatically.

12. Features flags

[features]

Keep defaults and override only as needed. Listing every flag invites surprises on upgrade.

13. A safe rollout path — progressive

Recommended order when introducing Codex to a new project.

  1. Day 1: sandbox_mode = "read-only" + approval_policy = "untrusted" + model = "gpt-5-codex". Read and analyze only.
  2. Day 2+: Apply Codex's proposed changes by hand. Once comfortable, switch to workspace-write.
  3. Week 2+: Move to on-request. Switch to the dev profile for longer tasks.
  4. Automation stage: Only in isolated CI with never + workspace-write. Never use never directly against production repos.

Rule of thumb: approval and sandbox are orthogonal. Relax one at a time until you hit a felt-safe combination. Relaxing both simultaneously makes post-incident diagnosis hard.

14. Counter-scenarios — when not to touch config.toml

  • First time with Codex → Use defaults for a few days, collect pain points, then tune.
  • Team-wide shared settings → A user-home config.toml can't share. Use requirements.toml + MDM.
  • One-off customization → A CLI flag (codex --sandbox-mode read-only) is enough. Don't bake it into the file.
  • Enterprise needs hard constraints → Use requirements.toml with allowed_approval_policies, allowed_sandbox_modes, etc.

15. What's next

With advanced config in hand:

  1. Codex + Claude Code parallel workflow — role division (coming soon).
  2. Codex install complete guide — install / auth / AGENTS.md.
  3. Claude Code hooks complete guide — Codex doesn't have hooks; worth comparing.

References

This is post 7/15 in the "AI Coding CLI Entry Guide" series. last verified: 2026-04-25 (per official OpenAI Codex Config Reference).

댓글

댓글 쓰기

이 블로그의 인기 게시물

Agent Memory Engine (2/10) — Building an AI Agent Memory System with SQLite Alone

← 1/10 SQLite Memory Engine f… 📚 Series Index 3/10 memcore Completed → A memory engine that runs without daemons, without dependencies, anywhere 핵심 요약 This post covers how to design an AI agent memory engine (memcore) on a single-file SQLite backend. - Structure: 25 modules, ~6,464 lines, 22 DB tables - Principles: no daemon, single-file portability, no required external dependencies, host-agnostic - Core techniques: 4-layer hybrid search (topic · vector · FTS5 · LIKE), U-tag dialectic-based confidence evolution, ingestion-layer bias rejection rules What This Post Covers One approach to building AI agent memory without a server or cloud vector DB. Specifically: (1) the limitations of text-file-based memory, (2) vector DB alternatives compared and selection criteria, (3) how to layer search tiers, (4) how to evolve confidence scores over time, and (5) how to block biased memory accumulation at the ingestion stage. Design Principles: Why Single-File SQLite Text-file-based ...
Read more »

"ML Foundations (9/9) — PyTorch vs TensorFlow, and the Road to Local LLMs"

이미지
← 8/9 Deep Learning Architec… 📚 Series Index (series end) The final part. So far we've focused on models. Now we focus on the tools that actually run them . We'll lay out the philosophical difference between PyTorch and TensorFlow, and trace how Hugging Face transformers , llama.cpp , MLX , and Ollama built the bridge to running large language models on your own machine. By the end you should have the full mental model of "download a pretrained LLM and serve it locally." 0. Learning Objectives Explain the eager-vs-graph difference between PyTorch and TensorFlow. Explain, in graph terms, how autograd automates the backward pass. Use Hugging Face transformers ' AutoModel , AutoTokenizer , and pipeline abstractions. Describe llama.cpp's GGUF quantization, INT4 inference, and CPU-first flow. Describe Apple MLX's use of unified memory and how it differs from PyTorch. Run a local LLM with Ollama and call it through an OpenAI-compatible API. ...
Read more »

"RAG Core Study (14/26) — Evaluation Sets with RAGAS & DeepEval"

이미지
Series overview: Series index 📚 Series Index Without an evaluation set, every RAG improvement is a story, not evidence. RAG systems fail in more than one place: retrieval, context selection, answer generation, and grounding. That means "looks better" is not a metric. Part 14 explains how to build a golden dataset , how RAGAS and DeepEval fit into the workflow, and why teams must separate retrieval quality from answer quality if they want tuning decisions to hold up. 0. Prerequisites Part 13 reranking — system quality now depends on multi-stage ranking. Part 1 grounding — a correct-looking answer is not enough. Part 12 Hybrid — multiple retrieval settings need comparison on fixed data. 1. Learning Objectives Build a small but useful golden dataset for RAG. Distinguish retrieval metrics from answer metrics . Use RAGAS and DeepEval in the right roles. Avoid the common traps in judge-model-based evaluation. 2. 핵심 요약 An evaluation set for RAG is ...
Read more »

"ML Foundations (8/9) — Deep Learning Architectures: CNN, RNN, Attention"

이미지
← 7/9 Deep Learning Training 📚 Series Index 9/9 PyTorch vs TensorFlow → What did we keep adding on top of an MLP? Vision went CNN, sequences went RNN/LSTM, and eventually both converged on Attention and the Transformer. Each architecture is easier to remember if you read it as what it gave up to gain something else . This part is the one-line summary of the decisive inflection points: LeNet → AlexNet → ResNet → LSTM → Attention → Transformer. 0. Learning Objectives Explain why CNN's convolution, pooling, and weight sharing match images so well. Trace what got unblocked from LeNet → AlexNet → VGG → ResNet as depth grew. State BPTT for RNNs and the vanishing/exploding gradient problem. Write the LSTM gate equations (forget, input, output) with intuition. Write the attention formula in query/key/value form and the scaled dot-product variant. State the precise reasons Transformers replaced RNNs (parallelism + long-range dependencies). 1. 핵심 요약 CNN : weight sharin...
Read more »

"ML Foundations (7/9) — Deep Learning Training: Optimizers, Regularization, Initialization"

← 6/9 Neural Networks 📚 Series Index 8/9 Deep Learning Architec… → Building an MLP, as we did in Part 6, is not the same as getting it to train well . The right optimizer, regularization, initialization, and learning rate — when these line up, deep networks converge. When they don't, the network refuses to learn at all. This part is the catalog of those crafts, with formulas, paper citations, and code in one place. 0. Learning Objectives Compare and write the update rules for SGD, Momentum, Nesterov, and Adam. Explain how Dropout, BatchNorm, and LayerNorm work and where they belong in a model. Derive the variance formulas for Xavier and He initialization and match them to activations. Implement step, cosine, and warmup learning-rate schedules in PyTorch. Explain why gradient clipping is effectively required for RNNs and Transformers. Diagnose the most common training failures (NaN, plateau, overfitting) and apply first-line fixes. 1. 핵심 요약 SGD : \(w \leftarro...
Read more »

OpenClaw to Hermes Migration (2/13) — What to Preserve, Partially Port, or Discard

← 1/13 Current Structure Inve… 📚 Series Index 3/13 What Moves to Hermes → A code review record classifying operational scripts into three tiers: preserve, partial-preserve, and discard. What This Post Covers An asset classification framework (preserve / partial-preserve / discard) for migrating a legacy agent system to a successor A concrete case applying the Strangler Fig + Subset Migration strategy to a memory pipeline Classification results evaluated across LOC, external dependencies, and replaceability axes A method for slimming down a bloated single file (1,310 LOC) using the migration as a natural entry point Problem Definition: Port Everything or Cut Deep? The OpenClaw inventory comprises multiple agents, multiple scheduler/daemon processes, and multiple operational scripts. When moving to the successor system, Hermes, the choice is not binary. A full port carries accumulated technical debt along with it; a minimal port discards hard-won domain logic. Code-revie...
Read more »

AI Agents I Built (5/7) — Building an Automated Blogger API Publishing System

← 4/7 My Life Organizer Agent 📚 Series Index 6/7 Dual → Designing a Markdown-Based Auto-Publish Pipeline with Blogger API v3 + OAuth 2.0 Key Summary Blogger API v3 + OAuth 2.0 enables a pipeline that converts Markdown files into publishable HTML posts blogger_publish.py handles the full flow — frontmatter parsing → body cleanup → HTML conversion → CSS injection → API post — in a single script For bulk publishing, quota management (delay, retry, TOC suppression) is the critical design concern Platform Selection Criteria API access is mandatory for AI agent-driven content publishing. A comparison of platforms: Platform API Cost AdSense Decision WordPress.com REST API Paid plan required Paid only Cost overhead Ghost REST API Self-hosted or paid Manual setup Ops overhead Blogger v3 API Free Native integration Adopted Blogger is free, exposes a REST API, and integrates natively with AdSense. For personal blog automation, this combination i...
Read more »