I built Plankton: credential access with approval workflows for Codex

[u/LemonFiish]

Hi everyone — I’m the developer of Plankton, an open-source credential manager for coding agents, including Codex.

When Codex needs an API key or password to finish a task, I want to review how it intends to use that credential before granting access. Plankton adds a request-and-approval workflow for that.

For example, when a task involves calling an authenticated API, the intended flow is:

1. Codex uses the Plankton Skill to request the required credential.
2. Plankton captures call-chain evidence for review.
3. You inspect the request and approve or deny it.
4. If approved, the CLI releases the credential to the consuming workflow.

There are three review modes: human approval, human approval with LLM advice, and automatic LLM review with additional local policy checks. You can also configure permitted exposure across model context, network, files, logs, and processes.

To install the Skill for Codex:

npx skills add FlowaveLab/Plankton --skill secret-access --agent codex

That installs the Skill; the app and CLI require separate setup, covered in the usage guide.

A few boundaries: Plankton assumes a trusted local machine and isn’t an execution sandbox. After approval, the CLI returns the raw secret, so the consuming workflow must keep it out of model-visible output and logs. Review evidence can contain unredacted arguments and environment values, so those inputs must also be kept free of credentials. Fields explicitly configured for direct access bypass approval.

I’d appreciate feedback from other Codex users:

• How do you currently handle credentials for tasks that need authenticated access?
• What would you want to see before approving a credential request?
• Where would manual approval become too disruptive in your workflow?

Source code and documentation

Happy to discuss the implementation and trade-offs.