Codex CLI
A gated identity for the agent that touches your repositories and your deploys.
Codex CLI takes a remote MCP server with a static header. Give it one agent identity, and put your deploy token and your registry key behind bindings. The CLI keeps working with nothing sensitive in its config.
Connect it
sp init --client codexThe two values it needs are the endpoint, https://mcp.sallyport.cloud/mcp, and an Authorization header carrying your agent token. Everything else in the file is the client's own shape, and sp keeps it current when the format changes.
What to expect on a write
A push, a release or a deploy is a write, so it asks. On a long session, approve the class for the next hour with a call budget. The agent then runs clean until the grant expires.