DEDUPED Hot AI repos, turned into use cases Get the Monday 5

How to block network commands that name sensitive paths with Codex Privacy Hud

Use the default-on lexical network guard to deny Codex network commands that reference sensitive files.

Remote script. The installer downloads and runs a script from GitHub, so verify the source before piping it to sh.

Who it is forA developer who lets Codex run shell commands on a machine with credential or key files, and wants a denial before data leaves.

The problemA network command such as a curl call can send the contents of a sensitive file to a remote host without any visible check.

The outcomeRecognized network commands that contain known-sensitive-path references are denied, and the denial is counted in the session HUD.

What you need first

  • macOS on Apple Silicon or Intel (Linux and Windows are not packaged)
  • Codex CLI installed and signed in, with `codex --version` printing a version
  • Python 3.11 or newer on your PATH
  • About 3 GB of disk if you want name and address detection

Steps

  1. Run the one-line installer with curl -fsSL https://raw.githubusercontent.com/inin-zou/codex-privacy-hud/main/install.sh | sh.
  2. Restart Codex so the hooks load from the installed plugin.
  3. In a new session, ask Codex to run a network command that references a known-sensitive path in a test directory.
  4. Confirm the command is denied and that the denial appears in the Privacy HUD for that session.
  5. Check that the denial is recorded separately from the local read guard, which is an independent check.

Prompt for your agent

Using the repo inin-zou/codex-privacy-hud, install the plugin and run a test network command that references <sensitive-path-placeholder> inside a Codex session. Expected output: a denial from the lexical network guard and a denials-issued count in the HUD. Verify that no file contents were opened or rewritten by the guard, as the README states.

Caveat. The guard is lexical, so it only catches recognized network commands with known-sensitive-path references, and shell-derived file identities remain unresolved.

Use this in your AI agent

Ask your agent

Using the Deduped MCP, get the setup steps for inin-zou/codex-privacy-hud and "Block network commands that name sensitive paths"

Add Deduped to Claude Code once

claude mcp add --transport http deduped https://dedupedai.com/mcp

Cursor, ChatGPT, others

Share: X LinkedIn Hacker News Email Copy link

Third-party repos we don't own. AI-written use cases can be wrong. Disclaimer