# Codex: five config rules and a five-check script for .codex/config.toml (free sample)

> From the Codex bundle: five rules for .codex/config.toml (keep the sandbox on, approval on-request, network off by default, pin the model, pin servers and keep keys out), and a read-only script that checks one config file for them.

- URL: https://paperchasewebb.ai/bots/marketplace/items/codex-five-config-rules-and-a-five-check-script-free-sample/
- Type: Prompt pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); Plain .md plus one Python 3.11+ script, standard library only; the script reads Codex's config.toml, the prompt is for Codex
- Price: Free USD
- Difficulty: Beginner
- Setup time: 5 min
- Time to result: About five minutes to a first result
- Format: Markdown (.md) file, codex-five-config-rules-and-a-five-check-script-free-sample.md
- Version: 1.0, updated 2026-10-29
- License: Personal and commercial use.

## What you end up with

In a few minutes you can see whether your Codex config runs without a sandbox, never asks, has network on, or holds a token in plain text.

## What you get

- Five config rules
- cx_mini.py: five read-only checks on one config.toml
- One prompt
- Worked example: 6 findings across the five checks, then 0

## Who it is for

Anyone on Codex who wants a quick check of their config first.

## Tools needed

- Codex: the main harness (CLI, IDE extension or app); its AGENTS.md, .codex/config.toml and .agents/skills are what the checker reads
- Python 3.11 or newer: runs cx.py (init, hash, gate, request, owner approval, verify, done) and the fifteen-check checker; standard library only (tomllib), no network
- You need: Python 3.11 or newer
- You need: Codex

Cost to run: Free.

## Sample prompt: What am I running with (Codex)

```
Read .codex/config.toml and ~/.codex/config.toml. Tell me the sandbox mode, approval policy, network setting and model you are actually running with, and which file each one came from.
Change nothing.
```

The rules and the script are in the file.

## Free preview of codex-five-config-rules-and-a-five-check-script-free-sample.md

````markdown
# Codex: five config rules and a five-check script for .codex/config.toml (free sample)

Version 1.0, 2026-10-29. By PaperChaseWebb. For developers who use Codex every day, alone or next to Claude Code, Hermes or Grok Bot. One Markdown file and one Python script, standard library only (Python 3.11 or newer, for tomllib). The script was tested on its worked example (6 findings across its five checks, then 0) and on a missing file (exit 2). It reads one config file; it was not run inside Codex or any other harness.

Most Codex setups that go wrong go wrong in the same file. The sandbox was set to danger-full-access to get past one prompt and never set back. approval_policy is never, so nothing stops. Network is on for every task. No model is pinned, so a default change switches it under you. An MCP server is installed at @latest with its token written into the config. This sample gives you the five rules that cover those, and a script that checks them in one config.toml.

## Install in one line

Save this page as FREE-SAMPLE.md, then:

```
python3 -c "import re;t=open('FREE-SAMPLE.md').read();open('cx_mini.py','w').write(re.search(r'~~~python\n(.*?)~~~',t,re.S).group(1))"
python3 cx_mini.py .codex/config.toml
```

## Five config rules

1. **Keep the sandbox on.** sandbox_mode is read-only or workspace-write. danger-full-access is for a throwaway machine, not your project.
2. **Let Codex ask.** approval_policy "on-request". never means nothing stops it, and "untrusted" is no lon
````

## Test record

- Date: Oct 29, 2026
- What was run: cx_mini.py on the worked example, a fixed file, a missing file, and the copy taken from the sample file.
- Result: 6 findings (one check found two), then 0; exit 2 on a missing file; the copy behaved the same.
- Not run: Codex or any other harness.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- The sample checks one config file against five rules. The full Codex Setup Runbook, gate, request approvals by hash, source and vetting records and the fifteen checks are in the full bundle.
- On 2026-10-29 cx_mini.py gave 6 findings on the worked example (one check found two), then 0 on the fixed file, and exited 2 on a missing file; the copy extracted from the sample file behaved the same. It was not run inside Codex or any other harness.

## Questions

**Does it send anything anywhere?** No. It reads one file and opens no network connection.

**What is in the full bundle?** The Codex Setup Runbook with fifteen checks and owner approval tied to each request's hash, plus Spec-First Build Docs, Two-Agent Build and Test Loop, Planner Over Cheap Models and Token Saver in full. $69, against $101 for the four bought separately.

## How to get it

Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/codex-five-config-rules-and-a-five-check-script-free-sample/, no signup.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com