Extensions, cloud and integrations

MCP servers, plugins and skills: install from an approved list, pin versions, limit tools with enabled_tools, and give servers that read tickets, errors, chat or email read-only scopes, since outsiders write that content. Turn off skill_mcp_dependency_install so skills can’t add servers on their own.
Codex cloud: keep agent internet access off, or allow only the domains a task uses; never “All (unrestricted)”. Put only the secrets a task needs in an environment (Codex docs).
GitHub and task triggers: connect only the repositories Codex needs, protect branches so it can open pull requests but not merge, and don’t let outsider-written issues or messages start tasks.

Security for Codex Development: Extensions, cloud and integrations