What is OpenQodex?
OpenQodex reviews the change your coding agent made, meaning unpushed commits plus uncommitted work, before it leaves your machine. It first runs whichever of its 22 built-in scanners fit the changed files (gitleaks and semgrep among them) and keeps findings on changed lines only. It then starts fresh Claude Code or Codex processes on your own login: finder sessions propose problems with a quoted line as evidence, a script checks every quote against the code, and verifier sessions must confirm or refute each candidate with a reason.
The result is a receipt with a verdict and one line per finding, plus HTML, Markdown, JSON and SARIF reports. A push gate and a git pre-push hook warn by default and block only at a severity you set. A separate code graph, built locally without a model for TypeScript, JavaScript, Python, Go, Ruby and Java, answers questions such as who calls a function through an MCP server with 20 tools.
Qodex, which also sells a hosted pull-request review service, maintains it. The repository was created in October 2026, is written in TypeScript under Apache-2.0, has about 1,170 GitHub stars and is at 0.18.0 (11 November 2026), installed with npx openqodex init.
Is OpenQodex worth it?
OpenQodex gets the structure of agent review right: the session that wrote the code should not be the one that approves it. A fresh reviewer process with no memory of your session reads the change, every quoted line is checked by a script, and every scanner finding must be answered. The report names any stage that did not run, and a review with a missing stage exits as incomplete rather than passing quietly.
The benchmark table is more candid than most, and it cuts both ways. On the project's own planted-bug set, Claude Code on claude-opus-5-5 found 150 of 153 bugs (98.0%) at $0.4371 per review, against 129 of 153 (84.3%) at $0.0870 under an earlier scoring version. Codex on gpt-6.1-sol found 115 of 153 (75.2%). On AACR-Bench, a set of real pull requests scored by its own evaluator, its library mode on gpt-6.1-sol reached 8.5% semantic F1 with a 77.2% noise rate. Planted bugs are the easy case; on real changes it misses most issues and most of what it flags is noise.
Privacy is the strongest part. The privacy page lists every network use: OpenQodex collects no usage data, crash reports or identifiers, semgrep runs with metrics off, and the dependency check sends only package names and versions to osv.dev. Your change still goes to the model behind your Claude Code or Codex login, and by default the reviewer can search the web unless reviewer_web is set to off. The local code graph's MCP server opens no network port.
The limits are practical. Only Claude Code and Codex can review, so Cursor, Cline and Goose users need one installed; nothing is tested on Windows or WSL; and with 107 open issues and pull requests, six weeks after the repository was created, commands and config can still change between minor releases. Against Alibaba's open-code-review, OpenQodex trades that tool's lower token bill for a heavier, verified review on a subscription you already pay for.
Where it earns its place
A solo developer shipping a Next.js app mostly written with Claude Code
Get an independent check of each change before pushing to main
npx openqodex init installs the skill, push gate and pre-push hook; ask the agent to review with openqodex and choose which findings it fixes. The review runs on the existing subscription; the vendor measured $0.4371 per review on claude-opus-5-5 for its planted-bug set.
A platform team of eight on GitHub with Terraform and Kubernetes manifests
Catch leaked secrets, vulnerable dependencies and misconfigured infrastructure in pull requests
Add the GitHub Action with an Anthropic API key for full reviews, or without one for scanner-only runs; findings upload to code scanning as SARIF. Set review.block_on_severity once the team trusts the signal, since both gates only warn by default.
A security-conscious consultancy working on client code
Review agent output without sending code to a new third party
Run with --offline to skip network scanners, downloads and the version check, and set reviewer_web to off; code then goes only to the model behind the existing Claude Code or Codex login.
Before you commit
- Setup
- Node 22 or newer and git on macOS or Linux, plus Claude Code or Codex installed and signed in; npx openqodex init detects agents, lists the files it will write, asks once, downloads the scanners the repository needs and reviews the current change.
- Integrations
- Claude Code, Codex CLI, Cursor, Cline and Goose start reviews; Claude Code and Codex can be the reviewer; GitHub Action with SARIF upload to code scanning; pre-commit hook; MCP server for the code graph; custom SARIF-producing scanners from GitHub after openqodex trust approval; a Node library.
- Data and privacy
- No telemetry, crash reports or identifiers; no server or account. The reviewer sends the brief and files it reads to your Claude Code or Codex model; osv-scanner sends dependency names and versions to osv.dev; gitleaks hits are removed from briefs and reports. Reports stay under .openqodex/ in the repo. Apache-2.0.
- Cost at scale
- No paid edition of the tool. Cost is reviewer tokens on your existing subscription or, in the GitHub Action, your Anthropic API key; the vendor reports $0.4371 per review on its planted-bug set with claude-opus-5-5. Qodex's hosted review service is separate and its pricing is not published on openqodex.com.
- Limits
- No reviewer other than Claude Code or Codex and no review on your own API key outside the GitHub Action; Codex cannot review from inside its own sandbox; no Windows support; some scanners need Ruby, Go or Cargo installed; osv.dev and Semgrep rule packs need the network.
What’s good
- Separate reviewer process; quotes and coverage checked by scripts
- 22 built-in scanners, findings limited to changed lines
- No telemetry; privacy page lists every network call
- Runs on an existing Claude Code or Codex login
What’s not
- 8.5% semantic F1 on real pull requests in its own AACR-Bench run
- Only Claude Code or Codex can act as the reviewer
- macOS and Linux only; untested on Windows and WSL
- Pre-1.0: config and commands change between minor releases
Best for
Developers on macOS or Linux who let Claude Code or Codex write most of their changes and want an independent, evidence-checked review before each push without a new account or bill.
OpenQodex alternatives
OpenQodex: common questions
- Is OpenQodex worth it?
- OpenQodex builds the second opinion a coding agent should get before every push, and its evidence checks are sound, but its own real-pull-request numbers show how much it still misses. We rate it 3.9 out of 5.
- How much does OpenQodex cost?
- Free and open source (Apache-2.0), with no account or key of its own. Reviews run on your existing Claude Code or Codex login; the GitHub Action's full review needs an Anthropic API key.
- What are the downsides of OpenQodex?
- 8.5% semantic F1 on real pull requests in its own AACR-Bench run; only Claude Code or Codex can act as the reviewer; macOS and Linux only; untested on Windows and WSL; pre-1.0: config and commands change between minor releases.
- Who is OpenQodex best for?
- Developers on macOS or Linux who let Claude Code or Codex write most of their changes and want an independent, evidence-checked review before each push without a new account or bill.
- How much does OpenQodex cost for a team or in production?
- No paid edition of the tool. Cost is reviewer tokens on your existing subscription or, in the GitHub Action, your Anthropic API key; the vendor reports $0.4371 per review on its planted-bug set with claude-opus-5-5. Qodex's hosted review service is separate and its pricing is not published on openqodex.com.
- Is OpenQodex safe for company data?
- No telemetry, crash reports or identifiers; no server or account. The reviewer sends the brief and files it reads to your Claude Code or Codex model; osv-scanner sends dependency names and versions to osv.dev; gitleaks hits are removed from briefs and reports. Reports stay under .openqodex/ in the repo. Apache-2.0.
- What are the best OpenQodex alternatives?
- The closest alternatives we have reviewed are Open Code Review and OpenAI Codex CLI.
Answers checked Nov 13, 2026.