diff --git a/bun.lock b/bun.lock
index 2a10aa8..3d06931 100644
--- a/bun.lock
+++ b/bun.lock
@@ -105,7 +105,7 @@
     },
     "sdk": {
       "name": "@runloop/remote-agents-sdk",
-      "version": "0.4.4",
+      "version": "0.4.13",
       "dependencies": {
         "@agentclientprotocol/sdk": "0.18.0",
       },
diff --git a/sdk/AGENTS.md b/sdk/AGENTS.md
index a931a42..eb12aa9 100644
--- a/sdk/AGENTS.md
+++ b/sdk/AGENTS.md
@@ -241,6 +241,7 @@ await conn.disconnect();
 | `startReview(target?, delivery?)` | Start a Codex review (`review/start`); defaults to uncommitted changes |
 | `compactThread()` | Compact the active thread's context (`thread/compact/start`) |
 | `readConfig(params?)` | Read the app-server's effective config (`config/read`) |
+| `readConfigRequirements()` | Read enforced managed requirements (`configRequirements/read`) |
 | `onApprovalRequest(method, handler)` | Handle server-initiated approval or MCP elicitation requests (returns unsubscribe fn) |
 | `threadId` | The active thread id (`string \| undefined`) |
 | `onAxonEvent(listener)` | Subscribe to all Axon events (returns unsubscribe fn) |
diff --git a/sdk/README.md b/sdk/README.md
index 9fdb98e..c29c230 100644
--- a/sdk/README.md
+++ b/sdk/README.md
@@ -617,6 +617,7 @@ Like ACP/Claude, call `initialize()` after `connect()` — it runs the app-serve
 | `startReview(target?, delivery?)` | Start a Codex review (`review/start`); defaults to reviewing uncommitted changes |
 | `compactThread()` | Compact the active thread's context (`thread/compact/start`) |
 | `readConfig(params?)` | Read the app-server's effective configuration (`config/read`) |
+| `readConfigRequirements()` | Read the managed requirements the app-server enforces, such as allowed sandbox modes (`configRequirements/read`) |
 
 **Listeners**:
 
diff --git a/sdk/src/codex/connection.test.ts b/sdk/src/codex/connection.test.ts
index adc14d9..ba179d2 100644
--- a/sdk/src/codex/connection.test.ts
+++ b/sdk/src/codex/connection.test.ts
@@ -309,6 +309,7 @@ describe("CodexAxonConnection", () => {
     await conn.connect();
     await conn.startThread();
     await conn.getAccountRateLimits();
+    await conn.readConfigRequirements();
     await conn.getAccountTokenUsage();
     await conn.readThread({ includeTurns: true });
     await conn.setThreadName("renamed");
@@ -321,6 +322,7 @@ describe("CodexAxonConnection", () => {
     const byMethod = Object.fromEntries(frames.map((frame) => [frame.method, frame]));
     // Option<()> wire params: the field must be absent, not an empty object.
     expect(byMethod["account/rateLimits/read"]).not.toHaveProperty("params");
+    expect(byMethod["configRequirements/read"]).not.toHaveProperty("params");
     expect(byMethod["account/usage/read"]).not.toHaveProperty("params");
     expect(byMethod["thread/read"]).toMatchObject({
       params: { threadId: "thr-1", includeTurns: true },
diff --git a/sdk/src/codex/connection.ts b/sdk/src/codex/connection.ts
index c984282..1da20f6 100644
--- a/sdk/src/codex/connection.ts
+++ b/sdk/src/codex/connection.ts
@@ -22,6 +22,7 @@ import type {
   CollaborationMode,
   ConfigReadParams,
   ConfigReadResponse,
+  ConfigRequirementsReadResponse,
   GetAccountRateLimitsResponse,
   GetAccountTokenUsageResponse,
   InitializeParams,
@@ -745,6 +746,18 @@ export class CodexAxonConnection {
   async readConfig(params: ConfigReadParams = {}): Promise<ConfigReadResponse> {
     return (await this.request("config/read", params)) as ConfigReadResponse;
   }
+  /**
+   * Reads the managed requirements the app-server enforces
+   * (`configRequirements/read`), such as allowed sandbox modes and permission
+   * profiles; `requirements` is null when none apply.
+   * Wire params are `Option<()>`: the params field must be omitted, not `{}`.
+   */
+  async readConfigRequirements(): Promise<ConfigRequirementsReadResponse> {
+    return (await this.request(
+      "configRequirements/read",
+      undefined,
+    )) as ConfigRequirementsReadResponse;
+  }
   /**
    * Reads the account's current rate limits (`account/rateLimits/read`).
    * Wire params are `Option<()>`: the params field must be omitted, not `{}`.
diff --git a/sdk/src/codex/protocol/index.ts b/sdk/src/codex/protocol/index.ts
index 919cd58..27114f7 100644
--- a/sdk/src/codex/protocol/index.ts
+++ b/sdk/src/codex/protocol/index.ts
@@ -3,6 +3,8 @@ export type * from "./generated/index.js";
 export type {
   ConfigReadParams,
   ConfigReadResponse,
+  ConfigRequirements,
+  ConfigRequirementsReadResponse,
   GetAccountRateLimitsResponse,
   GetAccountTokenUsageResponse,
   ListMcpServerStatusParams,