Permaura for Codex · In your terminal
Give Codex permission, not your keys.
Codex can open the pull request, check the deploy and triage the backlog while every key stays on the gateway. Permaura makes the call itself, scrubs the key from the result, and sends anything risky to your iPhone, Apple Watch or Mac for a yes.
It's free on your own computer: the gateway runs from the terminal on macOS, Linux and Windows, or as the Mac app, or let Permaura host it. Approvals reach your iPhone and Apple Watch, your Mac, or the console in any browser.
Try itCodex is tidying up and picked the wrong repo.
Codex wants to delete a repository on GitHub
github.repos.delete · acme/payments-api
Agent says
You asked me to clean up unused repos, and this one has had no commits in 90 days.
Approve it or deny it. Nothing real happens here.
Set it up
Connect Codex in a few minutes.
Codex launches its tool servers as local processes, so it reaches the gateway through a small bridge called mcp-remote. The console's Connect agent dialog writes the block below for you, with your gateway's address and a live code already in it.
- 1
Sign up and run the gateway: free on your own computer with one command or the Mac app, or let Permaura host it. The welcome screen gives you the command with your pairing code filled in.
- 2
In the console, open Agents, then Connect agent, and pick Codex CLI. Copy its block into ~/.codex/config.toml. The code sits in env, which only your account can read, rather than in the arguments every local user can see in the process list.
~/.codex/config.toml, with the docs' example values[mcp_servers.permaura] command = "npx" args = ["-y", "mcp-remote", "https://your-gateway.permaura.app/mcp", "--header", "Authorization:${AUTH_HEADER}", "--transport", "http-only"] env = { AUTH_HEADER = "Bearer pgc_ENRL-A1B2-C3D4-E5F6-A7B8-C9D0-E1F2-A3B4-C5D6" } - 3
Start a new Codex session. Its first call redeems the code, and the agent appears on the Agents page. The code is single-use and lives 15 minutes, so connect within that window; Refresh in the dialog mints a new one.
- 4
Approve the agent on the Agents page, where it arrives as Pending, then give it a grant. Permaura is deny-by-default, so until then every call it makes is refused.
The address and the code on this page are the examples from the docs. The console's Connect agent dialog fills in your own gateway's address and a live code, and names the exact menu or file for the client you pick. Source: The console's Connect agent dialog for Codex CLI, and the docs page Connect your AI client.
What you'd use it for
Hand Codex the job. Keep the last word.
Three jobs people hand to Codex most, and the moment each one asks you. That is the default. You choose what needs approval.
GitHub
Open the pull request
It reads the issue, the code and the commits, and writes the change.
Asks you first: opening the pull request, and merging it.
Vercel
Deploy the branch
It reads your deployments, projects and domains, and checks which settings exist, by name only.
Asks you first: starting a deploy, adding a setting, or deleting a project.
Linear
Triage the backlog
It reads your issues and projects and works out what comes next.
Asks you first: creating an issue, or archiving one.
What Permaura can and cannot enforce
It guards the door it stands at, and says so.
Permaura governs what passes through it, and it has only the keys you have moved into it. Anything your assistant can reach another way, it reaches without asking.
Permaura governs
Every call made through a Permaura connection.
The key stays on the gateway, which adds it on the way out and scrubs it from the result. The assistant gets an answer, never the login.
What runs on its own, and what waits for you.
Reading runs on its own by default. Sending, spending, deleting and publishing start switched off and ask you first, app by app, and you can change any of it.
Who may say yes, and the record of it.
A held call waits for a tap on your iPhone, Apple Watch or Mac, or in the console, signed by that device. Every decision goes into a record you can check, and a pause from your phone stops every assistant at once.
Permaura does not govern
Codex's own tools: its shell and sandbox, the files it edits, and any other MCP server in config.toml. Those run with whatever access Codex has on your machine, and Codex's own approval settings are where you limit them.
Any key it can already reach. A token still in your .env or your shell's environment is one curl away, and that call never passes Permaura. Putting a service behind Permaura means moving its key in, taking it out of the assistant's reach, and rotating it, since it has already lived there.
The code it connected with. It is a credential Codex holds in its config, and anything that can read that file can act as that agent, within that agent's grants. Removing the agent on the Agents page ends it at once.
Questions
What people ask before they connect Codex.
What happens if my assistant is tricked?
Its requests through Permaura still have to pass your rules. An action requiring approval waits for you; a denied action is blocked. An allowed action can still be misused, and data from an allowed read reaches the assistant. Permaura does not control its local shell, separate tools or credentials stored elsewhere.
Where do my passwords live?
The credentials you add stay with the gateway that runs your connections: on your computer for a local gateway, or on Permaura's servers for a hosted gateway. Permaura uses them to make requests on your assistant's behalf. Hosted means trusting Permaura to operate the service holding those credentials.
Can I turn it off?
You can pause access through Permaura or remove a connection. That stops access through the gateway. If an assistant also has a direct key or another connection to the app, you need to revoke that access separately.
What does it cost?
Running the gateway on your computer is free. Your computer needs to stay on for it to run. You can bring your own tunnel for remote access. Paid plans add hosting, a managed public address and team features. Plans are not priced per assistant or per call; hosted usage is subject to fair-use limits.
Give Codex its first safe connection tonight.
It's free on your own computer. Connect one app, say what needs a yes, and answer the first request from your iPhone, Apple Watch or Mac.