Codex and Claude Code with permission: how to deploy your coding agents

Codex, Claude Code and OpenCode are already part of many teams’ daily work. They write code, but more and more they also act: they deploy, query an internal API, open a ticket. And to do so they usually inherit the credentials of whoever is using them.

Ploybot does not replace those tools. It sits between them and your systems, so the agent asks for permission instead of carrying the keys. There are three levels, and you can stop at whichever one you need.

Level 1: connect over MCP by pasting a URL

Every Ploybot agent has its MCP at a URL like this:

https://app.ploybot.com/mcp/<agentId>

You will find it under My agents in the console. Paste it into your tool as a remote MCP server. The first time, the client works out how to authenticate on its own, opens the browser, and you sign in with your Ploybot account, using a passkey or password. No tokens to copy or leave in a file.

With Claude Code, for example:

claude mcp add --transport http ploybot https://app.ploybot.com/mcp/<agentId>

From then on the tool sees exactly the tools assigned to that agent, and nothing else. If it asks for something sensitive, it gets PENDING_APPROVAL: whoever decides gets a notification on their phone with the change in front of them, and once they approve, the agent tries again.

Level 2: the workstation recipe

When a whole team works with the same agent, configuring each laptop by hand does not scale. That is why each agent can have a workstation recipe in the catalogue: which tool it uses (Codex, Claude Code or OpenCode), which model from which provider (Anthropic, OpenAI or Bedrock), which other MCP servers and which skills.

With the Ploybot CLI installed, it is applied in a single command:

ploybot install oauth <agentId>

The browser opens, you sign in, and the CLI leaves the tool configured according to the recipe. The person signs in, not the agent: nobody receives the agent’s secret, and the recipe carries no model keys. If the team swaps Codex for Claude Code tomorrow, you change the recipe; the agent, its history and its evidence stay the same.

Level 3: no model keys on the laptop

In the enterprise there is one more step. The model provider’s key (Anthropic or OpenAI) does not need to be on any laptop. With the Ploybot AI gateway:

• The key lives encrypted in the vault and the gateway injects it when calling the provider. The workstation never sees it.
• The workstation presents its workload identity, a SPIFFE X.509 certificate over mTLS. Without that certificate there is no key to inject.
• Prompt Shield checks every request to the model. In strict mode it obfuscates personal data before it leaves and, if the prompt carries non-public data, asks a person for approval.
• A single gateway serves several workstations and agents in the organisation: the certificate says who is calling.

For the developer nothing changes: they open Codex or Claude Code as usual. What changes is that the company knows which model was used, with what data and for what, and that losing a laptop does not mean losing the provider key.

What you get at any of the three levels

• The agent does not carry the credential for your systems: the gateway resolves it.
• Every action goes through policy; sensitive ones, through a person.
• Everything leaves hash-chained evidence: which tool asked for it, with which model, for what reason, what reached the destination and what it answered.

Where to start

Start with level 1: create an account, set up an agent with a read-only tool and paste its URL into your tool. The trial lasts 14 days and needs no card. If you want to go straight to level 3, tell us about your case.