# Dependency Audit
Audited for version 0.1.0.
- `serde_json`: encodes and decodes the Codex JSON-RPC protocol. It receives no
credential and performs no network or process IO.
- `tokio`: owns asynchronous process, standard-IO, timeout, and channel
mechanics. It receives no reusable credential.
The Codex executable is an explicit runtime boundary, not a Rust dependency.
This crate removes `OPENAI_API_KEY` and `CODEX_API_KEY` and relies on the
launcher's existing ChatGPT login.