setup

AgentGuards setup

Guide the user through finishing AgentGuards setup after installing the plugin. The plugin already bundles the enforcing hooks — the only thing the user must supply is their API key.

Steps

1. Check for the API key. The hooks use the first of: the AGENTGUARDS_API_KEY environment variable, ~/.codex/agentguards_token, then ~/.agentguards/credentials.json. If none holds a key starting with ag_, the easiest fix is the AgentGuards CLI: agentguards login signs in through the browser and saves the key where the hooks read it (install the CLI from https://agentguards.co if it isn't there). Otherwise, tell the user to:

   • Get a key from the dashboard at https://agentguards.co/dashboard/keys

   • Export it so the hooks can read it. For the current shell and future sessions, add to their shell profile (~/.bashrc, ~/.zshrc, etc.):

     export AGENTGUARDS_API_KEY=ag_your_token_here
     

   • Restart Codex (or start a new session) so the hooks pick up the key.

2. Confirm the URL (optional). AgentGuards defaults to https://prod.agentguards.co. Only set AGENTGUARDS_URL if the user runs a self-hosted instance.

3. Fail-open vs fail-closed. The hooks fail closed by default — if the AgentGuards service is unreachable, actions are blocked. A user who prefers availability over strict enforcement can set AGENTGUARDS_FAIL_OPEN=true. Mention this only if they ask or report unexpected blocks.

4. Verify. Run the checks in the status skill yourself: they prove the key is accepted (HTTP 200), not just present. If it fails, the most common cause is AGENTGUARDS_API_KEY not being exported in the environment Codex was launched from.

5. Summarize what is now active: prompt screening, shell-command authorization (with Codex's approval prompt for anything borderline), scanning of content fetched by shell commands, and security scanning of apply_patch edits.