setup

AgentGuards setup

Guide the user through finishing AgentGuards setup after installing the plugin.

The plugin already bundles the MCP server and the enforcing hooks — the only

thing the user must supply is their API key.

Steps

1. Check for the API key. Look for the AGENTGUARDS_API_KEY environment

variable. If it is missing or does not start with ag_, tell the user to:

• Get a key from the dashboard at https://agentguards.co/dashboard/keys
• Export it so both the MCP server and the hooks can read it. For the current

shell and future sessions, add to their shell profile

(~/.bashrc, ~/.zshrc, etc.):

     export AGENTGUARDS_API_KEY=ag_your_token_here

• Restart Codex (or start a new session) so the MCP server and hooks pick up

the key from the environment.

1. Confirm the URL (optional). AgentGuards defaults to

https://prod.agentguards.co. Only set AGENTGUARDS_URL if the user runs a

self-hosted instance.

1. Fail-open vs fail-closed. The hooks fail closed by default — if the

AgentGuards service is unreachable, actions are blocked. A user who prefers

availability over strict enforcement can set AGENTGUARDS_FAIL_OPEN=true.

Mention this only if they ask or report unexpected blocks.

1. Verify. Call the AgentGuards health_check tool from the agentguards

MCP server. Report whether the service is reachable and which key prefix is

active. If it fails, the most common cause is AGENTGUARDS_API_KEY not being

exported in the environment Codex was launched from.

1. Summarize what is now active: UserPromptSubmit input scanning, PreToolUse

shell-command authorization, PostToolUse web-content scanning, and the

check_input / authorize_action MCP tools.