Codex reads AGENTS.md from the repo it works in. So does every other coding agent now. That makes AGENTS.md part of the input to every review, and the 2026 attacks on coding agents went for exactly that: Ghostcommit, Deadbugz, poisoned skills.
Slipmark 0.6 adds an MCP server. Three lines in ~/.codex/config.toml:
[mcp_servers.slipmark]
command = "npx"
args = ["-y", "slipmark@0.6.1", "mcp"]
Codex then has two tools. slipmark_attest records its verdict with the SHA-256 of each file it read, and of AGENTS.md, skills and MCP config. slipmark_verify checks every verdict against the files as they are now.
In CI, the Slipmark Action refuses a pull request when:
- a file changed after the verdict that covered it
- the agent's instructions changed after the verdict
- AGENTS.md changed without a person approving it
- changed instructions hide text from reviewers
The MCP server is deliberately narrow. An agent can't record a human approval through it, can't run commands, and can't overwrite another verdict.
Demo, each attack as an open pull request, plus one verdict recorded through the MCP server: https://github.com/founder-ship-it/slipmark-context-demo
Top comments (0)