What is Codex Security CLI and SDK?
Codex Security is OpenAI's model-driven vulnerability scanner, and this repo holds its command-line tool (cs or codex-security), TypeScript SDK, Codex plugin and GitHub Action. It scans a repository, selected paths or a Git diff, saves a Markdown report with source evidence, and can validate findings, generate patches, verify fixes, draft a SECURITY.md and export SARIF, JSON or CSV. Findings can go to Linear, Jira or GitHub.
The analysis runs on a model provider: OpenAI through a ChatGPT sign-in or API key, or Amazon Bedrock, OpenRouter, Fireworks AI or Cheaper Inference. The client is Apache-2.0 and has been public since late July 2026; npm v0.10.0 shipped on 12 November 2026.
Is Codex Security CLI and SDK worth it?
This is a serious, fast-moving security tool from a vendor that documents its own limits in unusual detail. It has a model read the code in context, the way a reviewer would, rather than matching patterns, and it saves evidence for each finding so a person can check the reasoning. A Standard scan, a Deep scan that repeats Standard scans and deduplicates them, diff scans for pull requests and an export to SARIF cover most of what a security team needs from CI.
What it can reach matters more here than for most tools. The SECURITY.md says it runs under your local account and tells you to scan only repositories you trust. Policy generation gets read-only access to the selected source with network, web, apps and MCP disabled. Finding validation is read-only with network and web search off, and skips builds, tests, proof-of-concept exploits and running the application. Patching is the step that writes: it checks that its sandbox starts and refuses with SANDBOX_UNAVAILABLE if not, while --external-sandbox switches Codex's file and network enforcement off and leaves isolation to your container. Deep-scan workers are read-only but, in OpenAI's words, not an isolated, offline environment, and they inherit any MCP servers the parent session has. Your code goes to whichever model provider you pick.
The catch: the client is open but the scanner is a model you pay for, and some requests and protected findings need OpenAI's Trusted Access for Cyber programme. Costs are estimates, --validate cannot be combined with --max-cost, and the docs warn that on macOS write restrictions under /tmp are not fully enforced. The project moves quickly, with 12,856 stars, 156 open issues and pull requests, and upgrade notes in the changelog for recent versions, so pin the Action to a reviewed commit SHA as the README asks.
Our take: its natural home is pull-request diffs and weekly full scans, with a person reading every report before a patch merges. It belongs alongside a conventional scanner such as Trivy or Semgrep, which is cheaper per run and deterministic, rather than in place of one.
Where it earns its place
A platform team running GitHub Actions for 40 repositories
Get a weekly vulnerability report per repo without a new SaaS contract
Copy the weekly workflow, add CODEX_SECURITY_API_KEY and pin the reviewed commit SHA. The example caps each scan at an estimated $5 and reports findings without failing the job.
A security engineer reviewing a payments service
Check a pull request's changes for auth and injection bugs before merge
cs scan . --diff origin/main scans only committed changes; --validate re-checks each finding read-only, with network and web search off. Validation calls are not cost-tracked, so watch spend.
A head of security at a 30-person SaaS company
Write a SECURITY.md and a threat model for the main API
cs policy . --path services/api drafts the policy outside the repo and leaves existing files unchanged; cs export pulls the saved threat model as Markdown for review.
Before you commit
- Setup
- Node.js 22.13+ (22.x), 24.x or 26.x and Python 3.10+. npm install --global @openai/codex-security, cs login, then cs scan . from the repository; CI uses OPENAI_API_KEY or CODEX_API_KEY.
- Integrations
- Codex plugin, TypeScript SDK, GitHub Action, GitLab CI, Docker Compose bulk scans; Linear, Jira and GitHub issues; SARIF, JSON, CSV and ServiceNow exports; imports from other scanners such as CrowdStrike.
- Data and privacy
- Source is sent to the model provider you configure. Scan state stays in a local directory. Codex usage analytics are on unless you pass --codex analytics.enabled=false. Runs under your local account; Deep-scan workers inherit the parent session's MCP servers.
- Cost at scale
- Model usage per scan; Deep scans repeat Standard scans and cost more. --max-cost and --max-total-cost set estimated limits; GitHub Actions minutes are extra.
- Limits
- Cost limits are estimates and in-flight requests can exceed them; dry runs do not test the Deep-scan sandbox; macOS /tmp write restrictions are not fully enforced; some findings need Trusted Access for Cyber.
What’s good
- Saves source evidence for every finding
- Validation runs read-only with network and web search off
- Diff scans, SARIF export and a pinned GitHub Action fit CI
- Works with OpenAI, Bedrock, OpenRouter and Fireworks AI
What’s not
- Runs under your account; Deep-scan workers are not isolated and inherit MCP servers
- Every scan costs model usage, and cost limits are estimates
- Some findings need Trusted Access for Cyber approval
- Fast-changing CLI with frequent upgrade notes
Best for
Security and platform teams that want model-driven code review in CI and can give each report a human reader.
Codex Security CLI and SDK alternatives
Codex Security CLI and SDK: common questions
- Is Codex Security CLI and SDK worth it?
- A careful, well-documented security scanner, provided you treat it as a model reading your source under your own account rather than an isolated sandbox. We rate it 4.1 out of 5.
- How much does Codex Security CLI and SDK cost?
- The client is free under Apache-2.0. Scans spend model usage on your ChatGPT plan or API key; the example GitHub Action sets an estimated $5 limit per scan, which in-flight requests can exceed.
- What are the downsides of Codex Security CLI and SDK?
- Runs under your account; Deep-scan workers are not isolated and inherit MCP servers; every scan costs model usage, and cost limits are estimates; some findings need Trusted Access for Cyber approval; fast-changing CLI with frequent upgrade notes.
- Who is Codex Security CLI and SDK best for?
- Security and platform teams that want model-driven code review in CI and can give each report a human reader.
- How much does Codex Security CLI and SDK cost for a team or in production?
- Model usage per scan; Deep scans repeat Standard scans and cost more. --max-cost and --max-total-cost set estimated limits; GitHub Actions minutes are extra.
- Is Codex Security CLI and SDK safe for company data?
- Source is sent to the model provider you configure. Scan state stays in a local directory. Codex usage analytics are on unless you pass --codex analytics.enabled=false. Runs under your local account; Deep-scan workers inherit the parent session's MCP servers.
- What are the best Codex Security CLI and SDK alternatives?
- The closest alternatives we have reviewed are Trivy, security-guidance plugin (Claude Code), Cloudflare Security Audit Skill and Open Code Review.
Answers checked Nov 13, 2026.
Make Codex Security CLI and SDK? Show this rating on your site
