Extending Codex

Take a repo in good shape by every measure this course uses: import-bank-csv sits in .agents/skills/, so the import procedure fires on recognition (the skills chapter built that); facts live in AGENTS.md, repeating procedures became skills, one-offs stay in the prompt; and the money path is hard - app/importers/csv.py converts amounts through Decimal, never a float, with a green suite pinning it (ten tests in the course’s labeled continuation).

Two gaps are left, and they are different in kind. The first is reach: a handful of transactions are in euros and pounds, recorded at whatever rate you guessed when you typed them in, and nothing anywhere in the repo can fetch a live rate. There is no fx module in budgetcli (the course’s running example, a small self-hosted personal-finance API in Python and FastAPI) and never has been - the rate feature is this course’s constructed next ticket, the same labeled scenario approvals & sandbox met at the network wall.

The second gap is a guarantee. The float parse survived for six chapters while AGENTS.md stated the opposite rule, in context, on every single session - nothing argued it away, and nothing stopped it. A rules file informs; it never enforces. The hardening eventually landed because you drove it there, turn by turn. What did not exist at any point was a check that fires whether or not anyone remembers.

Two arguments, not one

This chapter is two separate arguments, and they don’t share a mechanism, so don’t read them as one long one:

• Reach. Connecting the rate API as an MCP server gives Codex a tool the repo cannot provide - at a real, recurring price that current Codex only sometimes charges up front.
• The gate. Wiring hooks on the money path takes a door away and adds a check nothing can argue with - and then the last lesson works out exactly when a hook is the right tool instead of a rule or a permission.

The only thing the two share is what they’re not: neither one is a line in AGENTS.md. Reach isn’t something you can write into a rule - the model can’t call an API that isn’t wired up, no matter how clearly you describe it. And “never rewrite a raw statement” is exactly the kind of promise a rule keeps until the one session it doesn’t.

One expectation to correct before it forms: this chapter is not a replay of the approvals chapter’s network wall. That wall governs programs the agent’s shell commands spawn - sandbox_workspace_write.network_access is the dial that opened it. An MCP server connection is a separate wiring and approval surface, and the reach lesson teaches that split instead of assuming one wall covers both.

What you’ll do this chapter

• Connect the exchange-rate API as an MCP server - register it, learn which surface actually governs its reach, and price what a connected tool costs with schema deferral stated honestly.
• Gate the money path with hooks - block rewrites of the raw statements, and run the money tests automatically after every edit under app/importers/ and app/services/, including a direct edit to ledger.py mid-session.
• When a hook beats a rule or a permission - three guarantee strengths, and the one question that tells you which one a given constraint actually needs.

Plugins: installing someone else’s bundle

Skills, MCP servers and hooks can also arrive packaged. codex plugin manages that from the shell (verified in codex plugin --help, codex-cli 0.163.0, 2026-10-25):

codex plugin marketplace add <source>     # a local path or Git marketplace
codex plugin marketplace list
codex plugin list                         # plugins from configured and remote marketplaces
codex plugin add <plugin>@<marketplace>   # or: codex plugin add <plugin> --marketplace <name>
codex plugin remove <plugin>              # uninstall and clear its local cache

The plugins, plugin_sharing and remote_plugin flags are stable in that build, and release 0.153.0 added listing, installing and removing from remote marketplaces. An installed plugin can add hooks and MCP servers, so apply the same scrutiny as for any code you run: read what it bundles, and prefer a pinned source. The manifest format is covered in the plugins foundations chapter.

Start by connecting the rate API.