AGENTS.md

1# ECC for Codex CLI
2 
3This supplements the root `AGENTS.md` with Codex-specific guidance.
4 
5## Model Recommendations
6 
7| Task Type | Recommended Model |
8|-----------|------------------|
9| Routine coding, tests, formatting | o4-mini |
10| Complex features, architecture | o3 |
11| Debugging, refactoring | o4-mini |
12| Security review | o3 |
13 
14## Skills Discovery
15 
16Skills are auto-loaded from `.agents/skills/`. Each skill contains:
17- `SKILL.md` — Detailed instructions and workflow
18- `agents/openai.yaml` — Codex interface metadata
19 
20Available skills:
21- tdd-workflow — Test-driven development with 80%+ coverage
22- security-review — Comprehensive security checklist
23- coding-standards — Universal coding standards
24- frontend-patterns — React/Next.js patterns
25- frontend-slides — Viewport-safe HTML presentations and PPTX-to-web conversion
26- article-writing — Long-form writing from notes and voice references
27- content-engine — Platform-native social content and repurposing
28- market-research — Source-attributed market and competitor research
29- investor-materials — Decks, memos, models, and one-pagers
30- investor-outreach — Personalized investor outreach and follow-ups
31- backend-patterns — API design, database, caching
32- e2e-testing — Playwright E2E tests
33- eval-harness — Eval-driven development
34- strategic-compact — Context management
35- api-design — REST API design patterns
36- verification-loop — Build, test, lint, typecheck, security
37 
38## MCP Servers
39 
40Configure in `~/.codex/config.toml` under `[mcp_servers]`. See `.codex/config.toml` for reference configuration with GitHub, Context7, Memory, and Sequential Thinking servers.
41 
42## Key Differences from Claude Code
43 
44| Feature | Claude Code | Codex CLI |
45|---------|------------|-----------|
46| Hooks | 8+ event types | Not yet supported |
47| Context file | CLAUDE.md + AGENTS.md | AGENTS.md only |
48| Skills | Skills loaded via plugin | `.agents/skills/` directory |
49| Commands | `/slash` commands | Instruction-based |
50| Agents | Subagent Task tool | Single agent model |
51| Security | Hook-based enforcement | Instruction + sandbox |
52| MCP | Full support | Command-based only |
53 
54## Security Without Hooks
55 
56Since Codex lacks hooks, security enforcement is instruction-based:
571. Always validate inputs at system boundaries
582. Never hardcode secrets — use environment variables
593. Run `npm audit` / `pip audit` before committing
604. Review `git diff` before every push
615. Use `sandbox_mode = "workspace-write"` in config
62