armor Command Reference

All ArmorCodex commands start with armor. Type armor alone to see the help text. Commands run in the UserPromptSubmit hook before Codex's model sees the prompt - they are processed instantly without a model call.

Type commands with no leading slash (armor policy list, not /armor). Codex reserves / for its own built-in commands and rejects unknown ones, so a slash-prefixed command never reaches the hook.

Quick Reference

Command	Description
`armor`	Show help
`armor yes`	Apply the current staged proposal
`armor no`	Discard the current staged proposal

Policy Commands

Viewing Policy

Command	Description
`armor policy list`	Show all rules with IDs and effects
`armor policy view`	Show the active policy as raw JSON

Adding Rules

armor policy add allow bash
armor policy add deny apply_patch
armor policy add hold bash
armor policy add allow bash and apply_patch, deny apply_patch

Effects: allow, deny (or block), hold (or require_approval).

Multiple rules in one command are comma-separated. All changes are staged - confirm with armor yes.

Removing Rules

armor policy remove policy1

Removes a specific rule by ID. Check IDs with armor policy list. Staged - confirm with armor yes.

Resetting Policy

armor policy reset

Proposes clearing all rules back to an empty policy. Must be confirmed.

Setting Default Decision

armor policy default allow
armor policy default deny
armor policy default hold

Controls what happens when no rule matches a tool call. Appends a catch-all rule; staged, confirm with armor yes.

Applying Templates

armor policy template balanced

Available templates:

Name	Description
`all-allow`	Everything permitted, intent planning still enforced
`strict-read-only`	Only read-style tools allowed
`balanced`	Reads allowed, shell and file edits require approval
`lockdown`	All tools require approval

Staging and Confirmation

Every policy change goes through a two-step process:

armor policy add deny bash        # stages the change
armor yes                         # applies it

Command	Description
`armor yes`	Apply the current staged proposal
`armor no`	Discard the current staged proposal
`armor policy confirm`	Apply (same as `armor yes`)
`armor policy confirm pol_abc12345`	Apply a specific proposal by ID
`armor policy cancel`	Discard (same as `armor no`)
`armor policy cancel pol_abc12345`	Discard a specific proposal by ID

Staged proposals expire after 30 minutes.

MCP Server Management

Control which MCP servers are trusted. Trust rules are additive mcp__<server>__* rules:

Command	Description
`armor mcp list`	Show current MCP trust rules
`armor mcp approve <server>`	Allow every tool from an MCP server
`armor mcp deny <server>`	Block every tool from an MCP server

armor mcp deny github
armor yes

armor mcp approve <server> places the allow rule before any catch-all deny so it wins. Staged, confirm with armor yes.

Profile Management

Save and switch policy profiles (stored locally):

Command	Description
`armor profile list`	Show all saved profiles
`armor profile save <name>`	Save current policy as a named profile
`armor profile switch <name>`	Stage switching to a saved profile (requires confirm)
`armor profile delete <name>`	Delete a saved profile

Example: Save and Switch Profiles

armor policy template balanced
armor yes
armor profile save my-balanced

armor policy template lockdown
armor yes
armor profile save my-lockdown

armor profile switch my-balanced
armor yes

Natural Language (Back-Compat)

The older natural-language form still works and applies immediately (no staging):

Policy list
Policy new: deny bash containing curl
Policy delete policy1
Policy reset

Complete Command List

armor                                 - show help
armor policy list                     - show current rules
armor policy view                     - show active policy JSON
armor policy default <allow|deny|hold> - set default decision
armor policy add <rules>              - stage new rules
armor policy remove <rule-id>         - propose removing a rule
armor policy reset                    - propose clearing all rules
armor policy template <name>          - propose applying a template
armor policy confirm [proposal-id]    - apply staged change
armor policy cancel [proposal-id]     - discard staged change
armor yes                             - apply current staged change
armor no                              - discard current staged change
armor mcp list                        - show MCP trust rules
armor mcp approve <server>            - approve an MCP server
armor mcp deny <server>               - deny an MCP server
armor profile list                    - show saved profiles
armor profile save <name>             - save current policy as profile
armor profile switch <name>           - switch to a saved profile
armor profile delete <name>           - delete a profile

Command Reference

On this page