codex-mcp-go

The server executes the external 'codex' CLI command with strict input validation for parameters like 'cd' (working directory) and 'sandbox'. The 'sandbox' parameter is explicitly validated against a whitelist of safe modes (read-only, workspace-write, danger-full-access), defaulting to 'read-only'. Critically, 'model' and 'profile' parameters are explicitly rejected by the wrapper unless an allowlist is enabled (which is not present in the provided code), preventing potential misuse of alternative configurations for the underlying 'codex' CLI. Prompts for Windows are escaped to prevent shell injection. The primary security consideration remains the trusted integrity of the underlying 'codex' CLI itself and the cautious use of 'danger-full-access' by the controlling AI, which the project's recommended prompts strongly discourage.