Post to social media from Codex

In Codex the network is off until you say otherwise

OpenAI’s security page for Codex starts here: “By default, the agent runs with network access turned off.” Locally, Codex uses an OS-enforced sandbox that limits what it can touch, typically to the current workspace.[3]

In the Auto preset Codex can read files, make edits and run commands in the working directory automatically. It asks for approval to edit files outside the workspace or “to run commands that require network access”.[3]

A command that schedules a post has to reach Postnavo over the network. So Codex stops and asks. That is the behaviour OpenAI documents, not a fault in the CLI Postnavo is launching with.

You can turn network access on for the workspace-write sandbox in config.toml, with network_access = true under [sandbox_workspace_write]. OpenAI labels network access Elevated Risk.[3]

Where Codex reads skills from

For repositories, Codex scans .agents/skills in every directory from where you launched it up to the repository root. Your own skills go in $HOME/.agents/skills, and a machine’s shared ones in /etc/codex/skills.[2]

You invoke a skill by running /skills or typing $, or Codex chooses it when your task matches the skill’s description.[2]

OpenAI describes skills as building on the open agent skills standard, and plugins as the way to distribute them.[2]

Postnavo is launching with an agent skill for its CLI. Where it installs for Codex is published at launch.

MCP in Codex: one config for three clients

Codex keeps MCP servers in ~/.codex/config.toml, or in a project’s .codex/config.toml for trusted projects. “The ChatGPT desktop app, Codex CLI, and IDE extension share this configuration.”[1]

A remote server is a url. Codex supports streamable HTTP servers with bearer tokens or OAuth.[1]

Each server can set default_tools_approval_mode to auto, prompt, writes or approve, and a single tool can override it. The writes mode prompts for tools that are not marked read-only.[1]

Separately, OpenAI says destructive app and MCP tool calls “always require approval when the tool advertises a destructive annotation”.[3]

Scheduled tasks need the desktop app and run unattended

In the ChatGPT desktop app, scheduled tasks can work with local projects. OpenAI says to keep the computer on and the app running when a task needs local files.[4]

They run unattended with your default sandbox settings. In a read-only or workspace-write sandbox, tool calls that need the network fail.[4]

A release announcement rarely needs that. Ask once, in the session where Codex wrote the release notes, and the post waits in the calendar Postnavo is launching with until its time.