Connection details
Generic configuration
Most clients accept a variant of this shape:Codex
Add to~/.codex/config.toml:
Building your own agent
Point any MCP client library at the endpoint and pass the headers. The tools arrive through the standardtools/list handshake with full JSON schemas — you
do not need to hardcode their shapes.
Verifying the endpoint
A bare request without a valid key returns401. That is the healthy response —
it confirms the endpoint is live and enforcing auth:
Self-hosted
Running your own engine? The endpoint is the same path on your own host, and everything else is unchanged:Notes
OAuth instead of an API key
OAuth instead of an API key
The hosted server accepts OAuth bearer tokens for clients that support the
MCP authorization flow. The agent identity then defaults to the OAuth
client_id, unless X-Vex-Agent overrides it.Legacy header
Legacy header
X-AgentGuard-Key is still accepted as an alias for X-Vex-Key, so older
clients keep working. Do not use it in new integrations.