Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@mcp-codex-allowlist what codex commands am I allowed to run in this project?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Read-only MCP server that exposes Codex command execution rules so an agent can inspect the user's pre-approved command rules before acting.
The server reads direct *.rules files from the user Codex home and a project’s
.codex/rules/ directory. It preserves each source file, its path, and scope.
The combined tool returns global and project files in that order without
deduplicating or interpreting rules.
The Python package source is in mcp_codex_allowlist/.
This is a view of the rule files, not effective policy. Codex also applies approval and sandbox settings, managed policy, and project trust. Project rules are only active when Codex trusts the project.
Related MCP server: PolyAI Agent Studio MCP Server
Requires Python 3.10+ and pipx.
git clone https://github.com/jewzaam/mcp-codex-allowlist.git
cd mcp-codex-allowlist
make install-pipx
codex mcp add allowlist -- mcp-codex-allowlistFor a non-default Codex home, pass it to the server process:
codex mcp add allowlist --env CODEX_HOME=/path/to/codex-home -- mcp-codex-allowlistThe default is ~/.codex.
Tool | Returns |
| User-level rules from |
| Project rules from |
| Both scopes, with per-file scope and source path. |
The two project tools accept an optional project_dir; if omitted, the server
uses its current working directory. Each result's count fields count rule
files, not individual rules. The files can contain allow, prompt, or
forbidden decisions.
make install-dev
make checkRead user and project rule files with their source scope and paths.
Files can contain allow, prompt, and forbidden rules. This tool does not compute effective policy from approval settings, sandbox settings, managed policy, or project trust.
| Name | Required | Description | Default |
|---|---|---|---|
| project_dir | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that returned files carry source scope and paths, that files contain allow/prompt/forbidden rule categories, and explicitly enumerates what it does not evaluate. Return shape is covered by the output schema. Minor gap: no mention of whether unreadable/missing rule files error or return empty.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core action and followed by the content and exclusion notes. The exclusion list is long but each item genuinely narrows agent expectations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema handles return values and the scope/exclusion narrative is solid, but the single undocumented parameter is the one lever an agent needs to pull, and ambiguity with the global/local siblings is unaddressed. Adequate, not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One parameter (project_dir, optional, default null) with 0% schema description coverage, and the description never mentions it. 'user and project rule files' gestures at project scoping but does not explain what project_dir does, what null means (cwd? user-only?), or how it interacts with the sibling tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Read user and project rule files with their source scope and paths.' The scope qualifier ('user and project') hints at how it differs from the global/local siblings, but the siblings are never named, so the agent must infer the split.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'does not compute effective policy from approval settings, sandbox settings, managed policy, or project trust' line is a useful negative boundary that tells the agent when this tool is not the answer. However, it never says when to prefer this over get_global_exec_rules or get_local_exec_rules, leaving the sibling choice to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Read user rules from $CODEX_HOME/rules/*.rules (default ~/.codex).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral-disclosure burden. It implies a read-only operation and identifies the source path and default location, but it does not describe missing-file behavior, parsing, permissions, or other runtime characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence with no wasted text. The operation, source path, and default location are all stated efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description does not need to explain return values. For a zero-parameter read tool, the description covers the essential source location, though it could say more about when this global-rules tool is preferred over its siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline score is 4. The description does not need to explain parameter semantics because the input schema is empty and fully covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read'), resource ('user rules'), and filesystem scope ('$CODEX_HOME/rules/*.rules', default '~/.codex'). It does not explicitly differentiate itself from the sibling tools 'get_local_exec_rules' or 'get_codex_exec_rules', so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus the sibling tools, nor does it state any exclusions or prerequisites. The path implies global-scope rules, but the agent is left to infer that selection logic.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Read rules from the project .codex/rules directory for trusted projects.
| Name | Required | Description | Default |
|---|---|---|---|
| project_dir | No |
| Name | Required | Description |
|---|---|---|
No output parameters | ||
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the behavioral burden. 'Read' clearly implies a non-mutating operation and 'trusted projects' discloses a trust restriction, but it does not explain failure behavior for untrusted projects or any permission requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence with no wasted words. It communicates scope and trust condition efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and has an output schema, so return values do not need explanation. Still, the description omits parameter semantics and sibling-tool routing, leaving meaningful gaps for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the single parameter. It does not describe project_dir, its path format, or what happens when it is omitted and defaults to null.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and resource ('rules') and scopes it to the local project '.codex/rules' directory. It implicitly contrasts with the global sibling, but it does not explicitly name or differentiate against get_global_exec_rules or get_codex_exec_rules.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for trusted projects' gives a real usage condition, so there is some guidance. However, it does not say when to prefer this over get_global_exec_rules or get_codex_exec_rules, nor what to do for untrusted projects.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
v0.1.0get_codex_exec_rulesget_global_exec_rulesget_local_exec_rulesScored across 3 tools
get_global_exec_rules and get_local_exec_rules are distinct scopes, but get_codex_exec_rules is effectively a superset that reads both, so an agent can often just call the aggregate and the other two become redundant. Descriptions help clarify scope differences, but the boundary between 'both scoped reads' and 'combined read' invites miselection.
All three follow the same snake_case get_<scope>_exec_rules pattern, with only the scope token varying (global/local/codex). Fully predictable.
Three focused read tools are reasonable for an inspection-only rules surface, though the combined tool makes the set feel slightly redundant. Nothing extraneous, but arguably two tools would suffice.
The surface is read-only: no tools to add, modify, or remove allow/prompt/forbidden rules, and effective policy computation is explicitly disclaimed. For an allowlist server, the absence of any write or policy-resolution operation is a significant gap that will block manage-allowlist workflows.
Deterministic allow/require_approval/deny verdicts for agent actions, before they happen.
Git-native policy layer for AI agents: check_action verdicts against rules approved via PR.
The system of record for AI agent authority: playbooks, routed policy questions, reusable rules.
Read-only catalog of prompt packs and rule files: Cursor, CLAUDE.md, AGENTS.md, SKILL.md.