OpenAI Codex · tool · fg-0503

Codex shell commands cannot reach the network in workspace-write, so npm install and curl fail

npm install, pip install, or curl fails with DNS or connection errors inside Codex

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

The default workspace-write sandbox keeps command network access off unless sandbox_workspace_write.network_access is true. The network_proxy feature only constrains traffic once access is on; with access off it does nothing.

Fix

Set network_access true under sandbox_workspace_write, and add network_proxy rules if you want an allowlist. Some Codex App versions have been reported to ignore the key, so test from the CLI first.

Apply

# ~/.codex/config.toml
[sandbox_workspace_write]
network_access = true

Affects: Codex CLI, IDE extension, and ChatGPT desktop app, workspace-write mode, as of 2026-10

Sources

https://learn.chatgpt.com/docs/agent-approvals-security
https://github.com/openai/codex/issues/10390

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp