Super-Instruct: a Codex CLI MITM proxy that rewrites system prompts and tampers with refusals

What Super-Instruct actually does to Codex CLI traffic

Codex CLI sends its requests to OpenAI with a system role that carries the tool's own instructions. Super-Instruct puts a local reverse proxy on HTTP :8080 between the CLI and the upstream API, then rewrites that system role before forwarding. The README states the goal plainly: "递归遍历 JSON，替换所有 system role 内容为 bridge.md", which is a recursive walk of the request JSON that swaps every system role for the contents of bridge.md. The bridge file is a two-layer instruction set: entity normalization plus banned-word lists at generation time, and a CLOUD-AUDIT ROUTING rule that diverts sensitive output to the filesystem at output time. The intended user is someone studying prompt injection or building a red-team harness around a coding agent, not someone who wants better code completions. The project describes itself as a 破甲 framework, and the repository topics (instructor-tool, mitm-proxy, openai-codex, openai-proxy) match that framing.

The pipeline: three extension traits and six mount points

The core is deliberately thin. The README says the Core "对扩展内容一无所知" and only supplies a pipeline plus mount points. The traits in src-tauri/src/core/traits.rs are RequestInterceptor, ResponseParser and ResponseInterceptor. M1 SystemPromptInjector is a RequestInterceptor, M4 UniversalSseParser is the ResponseParser, and M3 TamperEngine, M5 MemoryKernel and M6 MonitorPanel are ResponseInterceptors. M4 handles SSE streams, plain OpenAI JSON and the Responses API, separating chain-of-thought from the final reply so downstream modules see a parsed object rather than raw bytes. M3 runs 22 multilingual regexes over the reply; on a match it substitutes Rei Protocol text. M5 writes successful interactions to memory.json and extracts word frequencies. M6 has no gate and pushes every interaction to the Tauri frontend through events. The self-gating table is the most interesting design detail: M3 fires only when modified_body.is_none(), M5 adds reply.len() > 50 to that condition, and M6 never gates. That means a response already rewritten by M3 is never overwritten again, and a rewritten response is never counted as a success.

Installing and running it on a development machine

The README requires Rust 1.75+, Node.js 18+ and npm 10+. From the repository root, install the Tauri CLI and start the dev build. The package.json exposes the same commands as scripts, so npm run dev and npm run build are equivalent to the npx forms.

cd /path/to/Super-Instruct-Codex-5.6
npm install
npx tauri dev

For a packaged binary, run the release build. The README says the artifacts land in src-tauri/target/release/bundle/.

npx tauri build

On Windows there is a build-release.ps1 at the repository root and a copy-resources script in package.json that copies bridge.md and codex-skills/ into src-tauri/resources/ before packaging. Once the app is running, the README gives five steps: click 启动代理, let the app modify Codex config.toml and back the original up to .super-instruct-bak, talk to Codex CLI as usual, watch the dashboard, then click 停止代理 to restore the original config. The dashboard window is 960x620 and frameless, per tauri.conf.json.

What the 8% refusal rate does and does not tell you

The README publishes a refusal table: 100 requests across all 28 skill categories, 3 to 4 per category, with 92 passes and 8 refusals, an 8% total refusal rate. Five categories account for every refusal (exploit-dev, phishing-kit, card-key, web-pentest, exploit-attack), and the README says all eight were caught by M3 and replaced through Rei Protocol. Treat this as the author's own measurement, not an independent benchmark. There is no control run without the proxy, no repeated trial, and no statement about which model snapshot was used beyond "gpt-5.6-sol" at xhigh reasoning. A single-digit refusal rate on a 100-sample suite with 3 to 4 samples per category also means one refusal moves a category by 25 to 33 points, so the per-category numbers are noisy. The aggregate number is the only one worth quoting, and even that is a claim from the project's own README.

Where the design breaks, and when this is the wrong tool

The proxy is an HTTP reverse proxy on a fixed port. If anything else holds :8080, the pipeline never sees a request. The deploy step edits Codex config.toml directly, so a crash between modification and restore leaves the CLI pointed at a dead proxy; the README documents a .super-instruct-bak backup but does not document what happens if the app is killed before 停止代理 runs. The 22-regex TamperEngine is the other sharp edge: a false positive silently replaces a legitimate answer with Rei Protocol text, and because M5 gates on modified_body.is_none(), that replaced response is never persisted to memory.json. The maintenance note in the README is explicit that the author is busy and updates are 随缘. The last push was on 2026-09-01, so the repository is not abandoned, but the README itself sets expectations for irregular cadence. Finally, this is the wrong tool if you want the model to answer questions about Codex or GPT 5.6 at all: it intercepts and rewrites, it does not inform.

How it differs from mitmproxy plus a script

The obvious alternative is mitmproxy with a custom addon. mitmproxy is a general-purpose TLS-intercepting proxy with a Python addon API; you would write request and response hooks yourself, handle SSE framing yourself, and build your own UI or read the console. Super-Instruct ships the framing already done: axum for the reverse proxy, reqwest for streaming upstream forwarding, a UniversalSseParser that already separates chain-of-thought from reply across SSE, OpenAI JSON and the Responses API, and a Tauri dashboard wired to the M6 monitor. The trade-off is scope. mitmproxy works against any client and any host; Super-Instruct targets Codex CLI, writes to Codex config.toml, and deploys into ~/.codex/skills/. If your target is not Codex, the deployment half of this project is dead weight and you are better served by the general tool.

Licence, upgrade cost and what the README leaves open

The repository is MIT licensed with a LICENSE file at the root. That permits reuse and modification with attribution, and it also means downstream forks carry no obligation to contribute fixes back. For upgrade cost, the version is 0.1.0 with a single release dated 2026-08-01, so there is no migration history to reason about. The frontend is plain HTML, CSS and JavaScript with no framework, and the Rust side is a small Tauri 2.x app, which keeps dependency churn low. Two things the README does not cover: whether the proxy handles TLS interception or relies on plain HTTP to the local port, and how config.toml is restored if the process exits abnormally. Anyone deploying this should read src-tauri/src/deploy.rs rather than trusting the five-step summary.

Editorial conclusion

Adopt it only if you are deliberately studying prompt injection, SSE interception, or Tauri-based proxy dashboards, and you accept the risk of an 8% refusal rate on its own test suite. Do not adopt it if you want a coding assistant that answers questions about GPT 5.6 or Codex availability, because the project does none of that. Before anything else, verify the MITM port :8080 is free, confirm the .super-instruct-bak backup of config.toml is created, and check that the 22-regex TamperEngine does not rewrite responses you actually need intact.

Frequently asked questions

Official sources

1. FuDie0915/Super-Instruct-Codex-5.6 on GitHub
2. Issues
3. License: MIT
4. README
5. Releases