Agentic Data Plane
beta

rpk ai run codex

Launch the OpenAI Codex CLI with its model traffic routed through the Redpanda AI gateway for the active rpai profile.

rpai generates a throwaway Codex config in a temporary CODEX_HOME, points it at the gateway’s OpenAI-compatible Responses endpoint for the chosen provider, and wires Codex’s bearer to rpk ai auth token so it refreshes itself for the life of the session. Your own ~/.codex config is never read or modified, and no token is written to disk.

The launch directory is auto-trusted under a workspace-write sandbox (approval_policy=on-request) so the fresh CODEX_HOME doesn’t prompt for trust on every run; pass --no-auto-trust to keep Codex’s normal first-run trust prompt.

Only openai / openai_compatible providers are supported (Codex speaks the OpenAI Responses API). Pass Codex’s own flags after a literal --:

rpk ai run codex -L openai -m gpt-5.3-codex -e high -- --ask-for-approval never

Usage

rpk ai run codex [flags] [-- CODEX_ARGS...]

Flags

Value Type Description

--codex-home

string

persistent CODEX_HOME dir (default: a throwaway temp dir); its config.toml is regenerated each run and the dir is tightened to 0700 — your real ~/.codex is refused.

-e, --effort

string

model reasoning effort: minimal|low|medium|high (omit to let Codex use its default).

-h, --help

-

help for codex.

-L, --llmprovider

string

aigw LLM provider name to route through (must be openai/openai_compatible).

-m, --model

string

model id to use (must be in the provider’s allowlist); omit to let Codex pick its default.

--no-auto-trust

-

do not pre-trust the launch directory; let Codex show its normal first-run trust prompt instead (default: the launch dir is auto-trusted under a workspace-write sandbox).

--print-config

-

print the generated Codex config.toml and exit (no gateway call, no codex needed).

-o, --format

string

output format: table|wide|json|yaml|markdown (env: RPAI_FORMAT) (default "table").

--no-color

-

disable colored output (env: NO_COLOR).

-c, --rpai-config

string

path to rpai config (env: RPAI_CONFIG) (default "/var/lib/redpanda/.rpai/config").

-s, --rpai-endpoint

string

override the selected environment’s AI Gateway URL for this invocation.

-p, --rpai-profile

string

rpai profile name (env: RPAI_PROFILE).

-v, --rpai-verbose

-

verbose debug logging to stderr (env: RPAI_VERBOSE).

--token

string

static bearer token override (ambient RPAI_TOKEN is ignored under rpk ai).