This is the Codex version. The strategy and risk thinking match the Claude Code guide; what’s different is how you connect and how you pin guardrails — Codex can’t install the SecProve safety skill (Claude-only), so you carry the rules in your Codex config. For a developer audience that’s actually a clean fit: the guardrails live in version-controlled instructions.

We’ll use NVIDIA (NVDA) and a bounded buy-the-dip strategy to keep it concrete — illustrations, not recommendations. Agentic trading can lose your whole funded balance; this method keeps that exposure small and in your control.

Step 1 — Prerequisites

  • A Robinhood individual investing account in good standing, on a desktop device.
  • A funding decision. We’ll use $500 — money you could lose entirely. (How much to fund.)

Step 2 — Add the Robinhood MCP server

From settings: Settings → MCP servers → Streamable HTTP, then add:

https://agent.robinhood.com/mcp/trading

Or from the CLI:

codex mcp add robinhood-trading --url https://agent.robinhood.com/mcp/trading

Authenticate when prompted, then open + fund your agentic account with $500. Auth runs through Robinhood. Full detail: connect Codex to Robinhood.

Step 3 — Pin the guardrails in config (the Codex difference)

No auto-applying skill here, so you make the rules part of Codex’s standing context:

  1. Generate a conservative, $500 config with the SecProve Agent Safety Kit — per-trade ($25), daily ($75), and concentration ($100) caps, an approval gate at $25, a circuit breaker, a kill switch, and a prompt-injection rule.
  2. Drop it into your Codex standing instructions (e.g. an AGENTS.md / config the agent always loads) so every run starts bounded. Version it like any other config.
  3. Have Codex restate the active limits before it places anything.

Because the guardrails are committed to your config, they don’t drift between sessions — that’s the upside of doing it the Codex way.

Step 4 — Point it at NVDA, bounded

Give Codex the playbook and its bounds explicitly (the strategy skills are Claude-only; the logic isn’t):

"Watch NVDA. On a 2%+ daily drop, buy $20 — never exceeding the caps in my config, and ask before any order of $25 or more. Stop once I hold $100 of NVDA."

Bounded result: $20 dip-buys, up to $100 of NVDA, never more than $75/day, approval gate and injection rule in force.

Step 5 — The risks, and the control on each

  • Single-stock concentration → the $100 concentration cap contains a rough NVDA week.
  • Falling knife → averaging down stops at the $100 cap; your funded amount is the real floor. (What can go wrong.)
  • Prompt injection → if Codex pulls in news or other text to inform trades, keep it advisory and human-gated (below). (How injection works.)
  • Soft vs hard guardrails → config rules make Codex behave; Robinhood’s funded-account isolation and removing the MCP server are the hard backstop.

Advanced: feeding Codex signals

Codex is happy pulling structured inputs — a script’s output, a feed, a news summary — into a decision. Keep one rule and you stay safe: signals inform the decision, they never fire the order.

"Summarize these NVDA headlines and tell me if they change the dip thesis. Don’t place or size a trade from this — surface it for my approval."

Keep signals on the input side and caps fixed regardless of how strong a signal looks, and you get a sharper agent without widening exposure. Crafted or planted input is exactly what the advisory-only rule neutralizes.

Stopping it

Say "STOP" to halt, and remove the Robinhood MCP server for the hard stop. (Kill switch.)

Want the guardrails enforced automatically instead of pinned in config? That’s the Claude Code build. Whichever you choose, the durable skill is spotting an attack aimed at your agent — test yours at secprove.com.