Recall instead of resend.
Four lines in ~/.codex/config.toml. The CLI and the IDE extension share that file.
[mcp_servers.tileward_context]
url = "https://context.tileward.com"
bearer_token_env_var = "TILEWARD_API_KEY"
Codex reads the key from the named environment variable rather than storing it in the file, so the config is safe to keep in a dotfiles repo. Run /mcp in a session to confirm it connected, then ask the model to remember something, start a new thread, and ask it to recall. That round trip is the whole product.
A project-scoped .codex/config.toml works too, but only in a project you have marked trusted: Codex silently ignores project-local config otherwise, so no server loads. Use the global file if you would rather not mark the project trusted.
A gate, not a system prompt.
Codex runs a UserPromptSubmit hook before the prompt reaches the model, and a hook that exits 2 stops it, with the reason shown to you. The gate ships as a plugin.
codex plugin add tileward-guard@tileward
export TILEWARD_API_KEY=tw_live_...
The Codex marketplace is not public yet. Email hello@tileward.com with the GitHub account that will install it and we will add it; the commands above then work as written. /hooks in a session shows the gate loaded.
Bind a policy to the key first, in the console under Settings → API keys. A key with no policy refuses nothing.
Each refusal is recorded against Codex's turn id, so it is findable in the audit next to the prompt that caused it.
Make it a control, not a guardrail.
A plugin the governed party can uninstall is a suggestion. Codex has a managed-hooks tier, and it is what turns this into a control.
allow_managed_hooks_only = true
Per Codex's documentation, that key is honoured only in requirements.toml; the same line in config.toml does nothing, silently. With it set, Codex ignores user, project and session hook configuration and loads managed hooks only, and a managed hook ignores a user's enabled = false. Managed configuration reaches the machine through MDM or an enterprise configuration bundle, not through a file the user can edit.
Verify on one machine before rolling it out: a marketplace that cannot be cloned and a hook that cannot start both surface as non-blocking errors, and the prompt runs.
What happens when Tileward is unreachable.
The prompt is blocked: the hook exits 2 on every failure path, an unreachable Tileward and an unhandled exception included. Codex has no HTTP hook type, so the gate is always a local process.
Set TILEWARD_FAIL_OPEN=1 in the environment if you would rather a prompt ran during an outage. Two limits apply to any Codex hook: a hook that exceeds its timeout is killed and the prompt runs, so the script keeps its own timeout under the hook's; and exit 2 blocks only when a reason is written to standard error, which the Tileward hook always does.
Codex runs a hook through a login shell, so keep the shell profile on governed machines silent for non-interactive shells. Anything the profile prints on the allow path is handed to the model as extra context.
Other guides: Claude Code · ChatGPT. Every other client, and the endpoint table: the connect guide.