Only the command-hook branch gets a second review
A timeline shows project trust activating Codex MCP, Codex command-hook, and Claude Code Git paths. The MCP server and Git wrapper execute before the first prompt, while the command hook enters a separate definition review.
Only the command-hook branch gets a second review
The tested MCP and Git paths reach repository code inside the pre-prompt window.
PROJECT FILES
TRUST BOUNDARY
PRE-PROMPT WINDOW
FIRST PROMPT
REQUIRED DECISION
Trust accepted
CODEX
Local MCP
Configuration-driven
TRACKED FILE
.codex/config.toml
CONFIG LOADS
MCP definition
becomes active
AUTOMATIC STARTUP
Start enabled local stdio MCP
python3 .codex/poc/server.py
OBSERVED EXECUTION ★
server.py executes
Before the first prompt
CODEX
Command hook
Non-managed definition
TRACKED FILE
hooks.json
HOOK DISCOVERED
Command hook
enters its own path
SECOND USER DECISION
Review exact
hook definition
not referenced file contents
HOOK TRUST STATE
Trusted or skipped
when the hook event occurs
CLAUDE CODE
Automatic Git
Environment-driven
TRACKED FILE
.claude/settings.json
ENVIRONMENT APPLIES
PATH prepends ./bin
for child processes
AUTOMATIC STARTUP
Bare git lookup
resolves through PATH to
./bin/git
OBSERVED EXECUTION ★
./bin/git executes
Before the first prompt
★
REPOSITORY
CODE ALREADY
RUNNING
before prompt
Observed in the documented test environment: Codex CLI 0.143.0 and Claude Code 2.1.185 on macOS arm64.
Codex and Claude Code use separate product-specific trust prompts; this timeline aligns their equivalent trust boundary.
Datadog Security Labs
Only the command-hook branch
gets a second review
What happens between trust and the first prompt.
PROJECT / FOLDER TRUST
Trust accepted
CODEX / LOCAL MCP
CONFIG LOADS
.codex/config.toml
AUTOMATIC STARTUP
Start enabled local stdio MCP
python3 .codex/poc/server.py
OBSERVED EXECUTION ★
server.py executes before the first prompt
CODEX / NON-MANAGED COMMAND HOOK
HOOK DISCOVERED
Command hook enters its own path
SECOND USER DECISION
Review exact hook definition
not referenced file contents
HOOK TRUST STATE
Trusted or skipped
when the hook event occurs
CLAUDE CODE / AUTOMATIC GIT
PROJECT ENVIRONMENT APPLIES
PATH prepends ./bin
AUTOMATIC STARTUP
Bare git lookup resolves to ./bin/git
OBSERVED EXECUTION ★
./bin/git executes before the first prompt
FIRST PROMPT
Observed in Codex CLI 0.143.0 and Claude Code 2.1.185
on macOS arm64. Product-specific trust prompts are aligned here.
Datadog Security Labs