← All plugins
CODEX AGENTbeta

Codex Agent

Runs OpenAI Codex as an agent on the plugin's own host — a durable Codex thread per call site, fenced by the OS sandbox (Seatbelt/bubblewrap), structured answers from a JSON Schema, and a "Needs a human" outbound port that parks the thread on an approval and resumes it with the person's decision.

The repository Full catalog entry Install Inflowenger
SDK
Python
Protocol
inflowv1
Actions
1
Version
v0.1.0
Author
Inflowenger
Runs on
Any inflowv1 host
Categories
AI and agentsUtility

Reach for it when

Same shape as Claude Agent, over Codex — reach for it when you want the workspace fence enforced by the operating system rather than by the model behaving well.

The use people don't expect

The two agent plugins are interchangeable on the canvas: same four ports, same human loop. So "which agent" stops being an architecture decision and becomes a node setting. You can run both on the same task and compare.

Flows that use it

Each one is a shape of flow, not a template to copy. Node names are the labels as they appear on the canvas; a name with a slash means either would do.

01

Two agents, one task, compared

Starts withAnything you don't fully trust one agent to judge.

  1. Void

    Fan-out. The same task description goes to both.

  2. CLAUDE AGENT

    Answers against a shared JSON Schema.

  3. CODEX AGENT

    Answers against the same schema, sandboxed by Seatbelt or bubblewrap.

  4. Code

    Compares the two structured answers. Agreement passes through; disagreement is the interesting case.

  5. Human in the Loop

    A person only ever sees the disagreements.

What you getAgreement between two independent agents is weak evidence, but disagreement is a reliable signal that the task was underspecified. Cheap way to find the questions worth a person's time.

02

Patch under an OS-enforced fence

Starts withA dependency alert names a file to change.

  1. CODEX AGENT

    Runs in workspace-write — the sandbox is the kernel's, so the agent cannot reach outside the tree even if it decides it should.

  2. Human in the Loop

    Any step outside the sandbox becomes an approval request the node refuses on its own, then hands to a person as prose.

  3. GitHub (OpenConnector)

    The approved patch becomes a branch and a PR.

What you getThe agent runs with real write access and still can't surprise you about where. Approval is a step in the process, not a dialog somebody clicked through at 2am.

The reference, not the pitch

This page is about what the plugin is for. Every action, every connection field, the ports, the install one-liner and the caveats are in the catalog entry, which is the thing the maintainer updates.

Codex Agent in the catalog How plugin nodes work

Near it in the catalog

CLAUDE AGENTClaude Agent

The task is "do this, here, on this machine" rather than "answer this" — and you want the work to stop and ask when it hits a decision nobody delegated.

Google Workspace (OpenConnector)Google Workspace (OpenConnector)

Sheets, Docs, Drive and Calendar — thirty per-operation actions, under a centrally connected account.

NUCLEINuclei

Template-based vulnerability scanning inside a flow, with templates chosen by filter rather than one at a time.