Manage Codex's "trust this folder?" prompt in config.toml with the projects trust_level setting
How Codex records project trust under [projects."<absolute path>"] trust_level, what it ignores for untrusted projects (.codex/config.toml, hooks, rules), and its precedence.
Launch codex in a freshly cloned repository and it asks whether you trust the folder. The answer is recorded in ~/.codex/config.toml, and it decides whether the settings inside the project's .codex/ directory are read at all.
In short: trust is stored as trust_level under [projects."<absolute path>"], and for an untrusted project Codex ignores .codex/config.toml, project hooks, and project rules entirely.
KEY POINT
What you will learn
- The syntax and the two values of
trust_level - Exactly which settings are skipped for untrusted projects
- Where project configuration sits in the precedence order
Writing trust_level
The format from the sample configuration. The path is absolute and quoted as the table name.
[projects."/Users/you/work/my-app"]
trust_level = "trusted"
[projects."/Users/you/tmp/someones-repo"]
trust_level = "untrusted"| Value | Meaning |
|---|---|
trusted | load the project's .codex/ layer |
untrusted | ignore the project's .codex/ layer |
Answering the startup prompt writes the same entry automatically, so you edit by hand mainly to revoke trust you granted earlier or to set several paths at once. Each worktree counts as a separate path.
用語解説
Project-scoped configuration: settings kept in the repository's .codex/ directory: .codex/config.toml plus project-local hooks and rules. They travel with the repository, so you do not know who wrote them.
What untrusted disables
The docs state that, for security, Codex loads project-scoped config files only when the project is trusted. For an untrusted project these are ignored:
.codex/config.toml(model, approval policy, sandbox, MCP servers, and other project settings)- project-local hooks
- project-local rules
So a hostile repository that ships sandbox_mode = "danger-full-access" or an unexpected MCP server in .codex/config.toml has no effect until you trust it. The flip side is that everything takes effect the moment you do, so look inside .codex/ before answering yes in a repository you are opening for the first time.
Read .codex/ before you trust
Before saying yes, check .codex/config.toml and any hooks under .codex/. approval_policy, sandbox_mode, mcp_servers, notify, and hook commands all run with your privileges as soon as the project is trusted.
Where it sits in precedence
Project configuration is the second-highest layer. In a trusted project it beats your profile and user settings.
| Priority | Layer |
|---|---|
| 1 (highest) | CLI flags and -c / --config overrides |
| 2 | the project's .codex/config.toml (closest to the working directory wins; trusted projects only) |
| 3 | the profile file selected with --profile |
| 4 | user ~/.codex/config.toml |
| 5 | cloud-managed defaults |
| 6 | system config (/etc/codex/config.toml on Unix) |
| 7 | built-in defaults |
To standardize approvals or sandboxing across a team, commit a .codex/config.toml; every member who trusts the project gets the same settings. The approval and sandbox combinations are covered in the hub article Codex approval modes and sandbox settings, and the layers in Configuring Codex with config.toml.
Summary
- Trust is recorded in
~/.codex/config.tomlas[projects."<absolute path>"] trust_level, eithertrustedoruntrusted - Untrusted projects skip
.codex/config.toml, project hooks, and project rules entirely - Everything in
.codex/takes effect the moment you trust, so inspect it first in unfamiliar repositories - Trusted project config outranks profiles and user settings
- Worktrees are separate paths
FAQ
- What does untrusted disable?
- The whole project-scoped .codex/ layer: .codex/config.toml, project-local hooks, and project-local rules are not loaded.
- Where does trust_level go?
- In your user ~/.codex/config.toml, as trust_level = "trusted" or "untrusted" inside a [projects."/absolute/path"] table.
- Anyone can commit a .codex/config.toml, right?
- Yes. It ships with the repository, which is exactly why it is ignored until you trust the project.
Primary sources
This article was drafted by AI from official documentation and reviewed by the site operator before publishing. Found a mistake? Let us know via the contact page.