Non-MCP integration

Wire custom or containerized tool runtimes through POST /api/v1/evaluate and honor ALLOW or DENY before dispatch.

Non-MCP tool callers — including containerized Codex CLI deployments — use POST /api/v1/evaluate as their enforcement gate. Place evaluate before local tool dispatch for tools routed through this wrapper or container integration.

Sector8 returns the verdict. Your application owns honoring that decision at dispatch time before any side effect starts.

This path uses the same admission and policy contract as the MCP connector. Coverage applies only to tool calls your runtime routes through evaluate or the Sector8 adapter.

Unconnected tools, direct OS dispatch, and chat or completion content that never becomes a governed tool call are not automatically covered.

The container pattern can keep the base image unchanged and add Sector8 in your approved image layer. Your runtime still needs an evaluate-before-dispatch hook that enforces the decision.

Prerequisites

• A Sector8 API key and client ID
• A container build or runtime path that you control
• A place in the tool caller where you can block dispatch on non-ALLOW decisions
• pip available in the container if you use the Python adapter

export SECTOR8_API_URL="https://sdkapi.sector8.ai"
export SECTOR8_API_KEY="YOUR_API_KEY"
export SECTOR8_CLIENT_ID="YOUR_CLIENT_ID"

---

Step 1 — Add Sector8 to the container image

Install the SDK once in your approved base image:

FROM your-registry/codex-cli-base:latest

RUN pip install sector8-sdk

COPY sector8_policy.yaml /etc/sector8/policy.yaml

ENV SECTOR8_API_URL=https://sdkapi.sector8.ai

Do not bake credentials into the image. Inject them at runtime via the environment.

Step 2 — Set required environment variables

Variable	Required	Purpose
SECTOR8_API_URL	yes	Sector8 API base URL
SECTOR8_API_KEY	yes	tenant API key for POST /api/v1/evaluate
SECTOR8_CLIENT_ID	yes	tenant or client identifier
CODEX_USER_ID	yes	developer identity recorded with the decision
CODEX_ROLE	yes	authorization role, for example developer
CODEX_SESSION_ID	yes	per-session correlation and rate-limit identity

Step 3 — Place evaluate before dispatch

For tools routed through this integration, replace direct tool dispatch with an evaluate-before-dispatch hook. Sector8 decides; your runtime enforces.

Honor the decision exactly like this:

import os
import httpx

try:
    response = httpx.post(
        f"{os.environ['SECTOR8_API_URL']}/api/v1/evaluate",
        headers={
            "x-api-key": os.environ["SECTOR8_API_KEY"],
            "x-client-id": os.environ["SECTOR8_CLIENT_ID"],
        },
        json={
            "tool_name": "bash",
            "arguments": {"command": cmd},
            "caller_id": os.environ["CODEX_USER_ID"],
            "role": os.environ.get("CODEX_ROLE", "developer"),
            "session_id": os.environ["CODEX_SESSION_ID"],
            "operation": "read",
        },
        timeout=10,
    )
    response.raise_for_status()
    decision = response.json()
except Exception as exc:
    print(f"Gate unavailable or invalid response; failing closed: {exc}")
    raise SystemExit(1)

decision_value = decision.get("decision")

if decision_value == "ALLOW":
    # Dispatch the tool call here.
    pass
elif decision_value == "DENY":
    print(f"Blocked before execution: {decision.get('reason_code')}")
else:
    print(f"Unknown decision contract; failing closed: {decision}")
    raise SystemExit(1)

Result	Runtime must
ALLOW	Dispatch only after this branch
DENY	Block; do not dispatch
Missing, unknown, or evaluate error	Fail closed; do not dispatch

Optional adapter helper for the same routed path:

from sdk.adapters.openai_tools_adapter import OpenAIToolsAdapter, ToolBlockedError
import os

adapter = OpenAIToolsAdapter(
    api_url=os.environ["SECTOR8_API_URL"],
    api_key=os.environ["SECTOR8_API_KEY"],
    client_id=os.environ["SECTOR8_CLIENT_ID"],
    caller_id=os.environ["CODEX_USER_ID"],
    role=os.environ.get("CODEX_ROLE", "developer"),
    session_id=os.environ["CODEX_SESSION_ID"],
)

try:
    result = adapter.execute(tool_name="bash", arguments={"command": cmd})
    # Local dispatch happens only after ALLOW.
except ToolBlockedError as e:
    print(f"Blocked before execution: {e.reason_code}")
    print(f"Evidence hash: {e.evidence_hash}")
    print(f"Trace ID: {e.decision_trace_id}")

If you use the adapter, still ensure missing, unknown, and evaluate failures do not dispatch. Sector8 returns the verdict; your application owns enforcement at the dispatch boundary.

Fail closed if evaluate fails, times out, or returns an unknown decision. Do not execute the proposed action by default. Fail-closed applies to tools routed through this integration; it does not stop actions on bypassed or unconfigured tool paths.

Runtime semantics

decision	Runtime behavior
ALLOW	Your runtime may dispatch the proposed tool call
DENY	Your runtime must block the proposed tool call
Missing / unknown	Fail closed; do not execute

Success state

When correctly wired:

• Your runtime calls /api/v1/evaluate before local dispatch for tools routed through this integration
• Your application honors the decision at the dispatch boundary
• ALLOW actions may execute
• DENY actions are blocked before execution
• Unknown, missing, or failed evaluate results fail closed and do not execute
• Decision artifacts include reason_code, decision_trace_id, evidence_hash, and policy_version_id

Evaluation response schema

{
  "decision": "ALLOW|DENY",
  "reason_code": "ALLOW_PASS",
  "evidence_hash": "",
  "has_forensic_payload": false,
  "decision_trace_id": "uuid",
  "policy_version_id": "string"
}

Exact reason_code and policy_version_id values depend on your active policy and environment. See Evaluate for the full contract.

Example — blocked call

{
  "decision": "DENY",
  "reason_code": "PRIVATE_IP_BLOCKED",
  "evidence_hash": "bdbde1558fb883573b0f6e8630ccba1edaf6bed8cb035fa6a48912809149f287",
  "has_forensic_payload": true,
  "decision_trace_id": "32819155-d21a-49c8-9509-79338d980fa9",
  "policy_version_id": "0dbca364d66447469637bafa2282e635124fcb99eecd6383038e3b652577ebc7"
}

Example — allowed call

{
  "decision": "ALLOW",
  "reason_code": "ALLOW_PASS",
  "evidence_hash": "4cb7f786d1f3b57e6f98f3e60d2eb6b81c402d6d3efeb6c9551049f7c14df2f0",
  "has_forensic_payload": false,
  "decision_trace_id": "74dc8812-2cd7-4c0d-bfcb-98438a57fcb3",
  "policy_version_id": "0dbca364d66447469637bafa2282e635124fcb99eecd6383038e3b652577ebc7"
}

Gotchas

• session_id is required for rate limiting. A missing or static session_id will cause all requests to share a rate limit bucket.
• owned_objects must list what the caller actually owns. BOLA checks compare object_id against this list — an empty list means every object-level request is denied.
• Do not cache ALLOW decisions. Evaluate every call independently. A cached ALLOW is not a security property.
• Do not treat adapter install as full coverage. Only tool calls that go through evaluate or the adapter are governed.

Honest scope

This path governs tool calls that route through evaluate or the adapter. It does not govern:

• inline completions or chat content that never becomes a governed tool call
• tools the runtime can still dispatch without calling evaluate
• bypassed or unconfigured execution paths

For MCP-connected Claude Code tooling, see the Guard MCP Server. For the shared decision contract, see Evaluate and Guardrails.