🔌 Project 2: MCP and hooks between Claude and Codex

Goal: reproduce the inventory on your machine before changing anything, so you have a baseline.

# MCPs that Claude sees (global + per project)
claude mcp list
# expected on this machine: magnific, metricool

# per-project MCPs live in each repo's .mcp.json
ls ~/projetos/wifi/.mcp.json ~/projetos/2cerebrox/.mcp.json 2>/dev/null

# MCPs that Codex sees
codex mcp list
# expected TODAY: empty list — this is the project's gap

# hooks on both sides
grep -rho '"SessionStart"\|"PostToolUse"\|"Stop"' ~/.claude/settings.json ~/.claude/plugins/cache 2>/dev/null | sort | uniq -c
grep -o '"SessionStart"\|"PostToolUse"\|"Stop"' ~/.codex/hooks.json | sort | uniq -c

How to verify: write down both lists in context/overview.md of the project you're working on. By the end of this module, codex mcp list must no longer be empty — and that's the only metric that matters in topic 2.

Goal: register magnific and metricool in Codex referencing the keys in .env, without storing any value.

# 1. wrapper that loads the .env at runtime and hands off to the server
mkdir -p ~/.local/bin
cat > ~/.local/bin/mcp-magnific.sh <<'SH'
#!/usr/bin/env bash
set -euo pipefail
set -a; . "$HOME/projetos/openpcbotv2/.env"; set +a   # loads, does not copy
exec npx -y @magnific/mcp-server                      # replace with your MCP's real command
SH
chmod 700 ~/.local/bin/mcp-magnific.sh

# 2. register in Codex: the config stores a PATH, never a key
codex mcp add magnific  -- "$HOME/.local/bin/mcp-magnific.sh"
codex mcp add metricool -- "$HOME/.local/bin/mcp-metricool.sh"

# 3. check
codex mcp list

How to verify: codex mcp list is no longer empty and shows both names. Then open codex in any folder and ask "list the available MCP tools" — the names have to show up in the answer, not just in the file.

Goal: prove that no secret ended up in the configuration — this is the test that closes the topic.

# search for typical key prefixes inside the Codex config
grep -rIl -e 'sk-' -e 'API_KEY=' -e 'TOKEN=' ~/.codex 2>/dev/null
# expected: NO output lines

# check that the wrapper is not readable by other users
stat -c '%a %n' ~/.local/bin/mcp-*.sh
# expected: 700 on all of them

# check that the .env is still the single source
grep -c '=' ~/projetos/openpcbotv2/.env   # count only; never print the contents

How to verify: the first command must return silently. If it prints any path, stop everything: some key was copied. Remove the registration with codex mcp remove <nome>, rotate the key, and redo it through the wrapper.

Goal: automatically sort your skills into "reusable" and "adapter", so you know what to port today.

# adapter = the SKILL.md mentions an MCP, plugin or subagent
cd ~/.claude/skills
for d in */; do
  s="${d%/}"
  if grep -qE 'mcp__|AskUserQuestion|subagent_type|superpowers:|context-mode:' "$s/SKILL.md" 2>/dev/null; then
    echo "ADAPTADOR  $s"
  else
    echo "portavel   $s"
  fi
done | sort | tee ~/classificacao-skills.txt | awk '{print $1}' | uniq -c

# show only the blocked ones, and which dependency blocks them
grep '^ADAPTADOR' ~/classificacao-skills.txt | awk '{print $2}' | while read s; do
  echo "== $s"; grep -ohE 'mcp__[a-z0-9_]+' "$s/SKILL.md" | sort -u
done

How to check: the count should match the order of magnitude of the diagnosis — dozens of portable skills against about 15 adapters. If you get 80 adapters, your grep is catching mentions inside examples; adjust it to look only at instruction lines.

Goal: read what is actually registered on both sides, instead of assuming.

# which events Codex has registered on this machine
python3 -c "import json;print(list(json.load(open('$HOME/.codex/hooks.json'))['hooks']))"
# expected: ['PostToolUse', 'Stop']

# the matcher and timeout of each one
grep -E '"matcher"|"timeout"|"statusMessage"' ~/.codex/hooks.json

# does the target of both hooks exist? (the hook is written to fail silently if it doesn't)
ls -l ~/.agents/skills/impeccable/scripts/hook.mjs

# what Claude fires on SessionStart — this is the one with NO counterpart
grep -rl '"SessionStart"' ~/.claude/settings.json ~/.claude/plugins/cache 2>/dev/null

How to verify: the Codex list comes back with two names, and neither is SessionStart. If the ls of hook.mjs fails, the Codex hooks are registered but inert — the [ ! -f ... ] || at the start of the command makes them exit quietly.

Goal: add the pacing rule to ~/.codex/AGENTS.md, replacing the hook with reading.

# back up before touching the global base (Project 1 created this file)
cp ~/.codex/AGENTS.md ~/.codex/AGENTS.md.bak-$(date +%Y%m%d)

cat >> ~/.codex/AGENTS.md <<'MD'

## Pacing rule (was the fable-mindset hook in Claude)

- **Think before acting.** Before the first edit, state in one sentence
  what the problem is and what the smallest change that solves it is. If
  you don't know, read more; don't start editing to find out.
- **Close the loop by verifying.** Every change ends with a command that
  proves the result (test, `grep`, `status`, readback) and with the output
  pasted in the answer. "It should work" doesn't close the loop.
- **One fix at a time.** If the answer was to rewrite everything,
  a guard was probably missing — record that in FALHAS.md.
MD

# check that it went in and that the file is still short
tail -14 ~/.codex/AGENTS.md
wc -l ~/.codex/AGENTS.md

How to verify: run codex exec "Before editing any file, what must you say first? Cite the source." from ~. The answer must mention the sentence about the problem and the smallest change, citing AGENTS.md. If it answers well without citing the source, that's the model getting lucky, not reading — and it doesn't count as acceptance.

Goal: convert the 7 subagents into role skills, preserving the prompt body and swapping only the header.

mkdir -p ~/.agents/skills
for a in advogado-do-diabo analista-neutro estrategista-otimista \
         mestre-do-conselho diretor-ecossistema web-research-assistant \
         triple-x-responder; do
  src=~/.claude/agents/$a.md
  [ -f "$src" ] || { echo "missing: $a"; continue; }
  mkdir -p ~/.agents/skills/papel-$a
  {
    echo "---"
    echo "name: papel-$a"
    echo "description: Takes on the role of $a. Use when the task explicitly asks for that voice."
    echo "---"
    echo
    echo "> Role derived from the Claude Code subagent \`$a\`."
    echo "> There is NO parallel execution here: take on the role in the current context and"
    echo "> make it clear in the response when you are speaking for it."
    echo
    sed '1{/^---$/!b}; 1,/^---$/d' "$src"   # strip only the old front-matter
  } > ~/.agents/skills/papel-$a/SKILL.md
  echo "papel-$a"
done

How to verify: ls ~/.agents/skills | grep -c '^papel-' returns 7. Then, codex exec "Use papel-advogado-do-diabo to attack this decision: migrate everything at once." — the response must cite the skill file and hold the devil's-advocate voice from start to finish.