Agent frameworks

Codex

Give an OpenAI Codex agent a real, routable, verifiable network identity — a Whisper IPv6 /128 it egresses from, and keyless tools to verify any peer.

›

Status: Live. Installable now — proven on a real install of the framework's own CLI: the adapter installs and whisper mcp registers, and the routable /128 egress works. In-chat tool invocation additionally needs that framework's own account/login.

Install

codex plugin marketplace add whisper-sec/whisper-adapters
codex plugin add whisper@whisper

Prerequisite: the whisper CLI on your PATH — the adapter runs whisper mcp (the tool surface) and, for egress, whisper connect:

curl -fsSL https://get.whisper.online | sh

The adapter bundles whisper mcp as an MCP provider with the WHISPER.md context. Codex's plugin marketplace is new; if the manifest key names differ in your Codex version, the same whisper mcp server can be added directly to your Codex MCP config.

Two tiers, auth optional

Like every Whisper integration, the adapter is two-tier by design — liberal in what it asks of you (Postel's Law):

No API key — the keyless tools work for everyone: whisper_verify (is an address or hostname a real Whisper agent, and whose?) and whisper_rdap (its RDAP registration). Real value, zero setup.
With your key (WHISPER_API_KEY in the client's environment, or a saved whisper login) — the full control plane unlocks (whisper_register, whisper_list, whisper_policy, whisper_logs, whisper_revoke, whisper_egress_config), and the session can egress from its routable /128.

Verify without a key

# keyless — no account, no key
whisper verify 2a04:2a01:f3c6:4261:9887:4349:306a:52c8
# → verified Whisper agent (DANE-anchored)
#   fqdn a98874349306a52c8.botboss.app

In an agent chat, the same check is one tool call — ask the model to run whisper_verify {target:"api.openai.com"} and it comes back with is_whisper_agent, dane_ok, and jws_ok.

Egress from your /128

Set your key in the client's launch environment, then let the agent mint its own identity and route through it:

export WHISPER_API_KEY=whisper_live_…   # set in the CLIENT's launch env
# in chat: whisper_register {name:"scout"}  → a routable /128 + DNS name
whisper ip                          # ✓ egress verified — source IP == the agent's /128
dig -x <that /128>                # reverse-DNS → the agent's Whisper hostname

In-chat use needs your OpenAI login.

Verify it worked

Restart the client and ask it, in chat, to run whisper_verify against any address. A true/false is_whisper_agent verdict back means the whisper mcp server is wired in correctly, end to end. With a key present, whisper_list returns your agents.

Next: Copilot CLI · MCP server.

← Gemini CLI Copilot CLI →