Extending Codex

Chapter 7 gave Codex a procedure it could reach for on its own - a skill, invoked without you pasting anything. This chapter gives it two things a skill can’t: a door to a system that lives entirely outside budgetcli, and a wall around the one write inside it that must never happen by accident.

Both still answer to the fact that’s run under every chapter so far: Codex starts a turn knowing only what’s already in front of it. A skill widens what it remembers to do. The two extensions here widen something else - what it can touch, and what can stop it - and neither one lives in the model’s head at all. That’s the whole reason they’re worth a chapter of their own.

Here’s the concrete hole. A handful of your transactions are in euros and pounds - a hotel booking, a couple of foreign subscriptions - stored at whatever rate you guessed when you typed them in. src/budgetcli/fx.py already tries to fix that: back in approvals & sandbox, Codex read that file and reached for the live exchange-rate API, and the sandbox refused the connection. The rate still isn’t reachable. And once it is, you’re about to let Codex touch code that edits real account balances - which means you also need a promise that survives no matter how confident the model sounds when it wants to break it.

Two arguments, not one

This chapter is two separate arguments, and they don’t share a mechanism, so don’t read them as one long one:

• Reach. Connecting the rate API as an MCP server gives Codex a door to a system it currently can’t touch at all - a new tool, at a real and recurring price.
• The gate. Wiring a hook on the ledger write takes a door away, on the one path where “the model probably won’t” isn’t good enough - and then the last lesson works out exactly when a hook is the right tool instead of a rule or a permission.

The only thing the two share is what they’re not: neither one is a line in AGENTS.md. Reach isn’t something you can write into a rule - the model can’t call an API that isn’t wired up, no matter how clearly you describe it. And “never write to the ledger” is exactly the kind of promise a rule keeps until the one session it doesn’t.

What you’ll do this chapter

• Connect the exchange-rate API as an MCP server - register it, hit the network-off wall you’ve met before, then price what a connected tool actually costs you, turn after turn.
• Gate a risky move with a hook - block writes to the real ledger, and run the money tests every time the money math changes, not just when someone remembers to.
• When a hook beats a rule or a permission - three kinds of guarantee, and the one question that tells you which one a given constraint actually needs.

Start by connecting the rate API.