Codex Security Review 2026 — OpenAI's Open-Source CLI and SDK for AI-Powered Code Vulnerability Scanning

Overview

Codex Security (@openai/codex-security) is a CLI and TypeScript SDK released by OpenAI in mid-July 2026 that brings AI-powered security vulnerability scanning to your codebase. Published under the Apache-2.0 license, the project quickly hit 348+ GitHub stars and landed on the Hacker News front page with 241 points — a clear signal that the developer community is paying attention.

The project comprises two parts:

1. A CLI tool (npx codex-security scan .) that scans repositories, reviews changes, and tracks findings over time
2. A TypeScript SDK for embedding Codex Security into custom tooling, CI pipelines, and IDE extensions

Both are open-source and published on npm as @openai/codex-security.

What Makes Codex Security Different

Traditional SAST (Static Application Security Testing) tools like Semgrep, SonarQube, and CodeQL use deterministic rule matching — they flag code that matches known vulnerability patterns. This is effective for common issues (SQL injection, XSS, hardcoded credentials) but misses context-dependent vulnerabilities:

• Logic errors that span multiple files
• Business logic flaws
• Insecure design patterns that don’t match a known CVE signature
• Authentication bypasses that are valid syntax but wrong semantics

Codex Security approaches analysis differently: it uses Codex’s AI models to understand what the code is supposed to do and whether it does it securely. This AI-driven approach catches issues that pattern-matching tools miss — but it also introduces the tradeoffs of any AI-based security tool.

CLI Usage

Installation and Authentication

npm install @openai/codex-security
npx codex-security login

The login flow authenticates with your OpenAI account (the same subscription that powers Codex). For CI environments, you set OPENAI_API_KEY instead of interactive login.

Scanning

# Scan an entire repository
npx codex-security scan .

# Scan specific paths
npx codex-security scan ./src/api --output json

# Scan changes in a PR (diff-based)
npx codex-security scan --diff origin/main

# Review a specific file
npx codex-security review ./src/auth/login.ts

CI Integration

Codex Security is designed for CI-first usage:

# In your CI pipeline
npx codex-security scan . --output sarif --fail-on critical

The tool supports SARIF output format for integration with GitHub Advanced Security, Azure DevOps, and other SARIF-compatible platforms.

TypeScript SDK

For teams that want to embed security scanning into their own tooling:

import { CodexSecurity } from "@openai/codex-security";

const security = new CodexSecurity();
const result = await security.run(".");

console.log("Report:", result.reportPath);
console.log("Findings:", result.summary);

// Access individual findings
for (const finding of result.findings) {
  console.log(`[${finding.severity}] ${finding.message}`);
  console.log(`  File: ${finding.file}:${finding.line}`);
  console.log(`  Fix: ${finding.suggestedFix}`);
}

await security.close();

The SDK provides typed access to all scan results, including suggested fixes that can be applied programmatically or reviewed before committing.

Capabilities

Based on the available documentation and community reports, Codex Security supports:

Feature	Details
Language Support	All languages that Codex understands (Python, TypeScript, JavaScript, Rust, Go, Java, C++, and 20+ more)
Scan Types	Repository-wide, incremental (diff), targeted path, single file
Finding Categories	Injections (SQL, command, LDAP), XSS, SSRF, hardcoded secrets, auth bypasses, insecure deserialization, path traversal, and logic-level issues
Output Formats	JSON, SARIF, human-readable summary
Fixes	AI-generated suggested fixes with line-level precision
Deduplication	Persistent findings across runs — track vulnerability remediation over time
CI Integration	GitHub Actions, GitLab CI, Jenkins, and any CI supporting CLI tools

Pricing

The SDK and CLI are free and open-source under the Apache-2.0 license. However, the actual analysis runs on OpenAI’s servers and requires a Codex subscription. This means:

• Installing and configuring the tool costs nothing
• Each scan consumes Codex API credits
• Costs scale with codebase size and scan frequency

For teams already using Codex, this is a natural extension of their existing subscription. For teams evaluating Codex Security as a standalone tool, the API costs need to be factored into the budget.

Verdict

Codex Security represents an interesting shift in how we approach code security: from deterministic pattern matching to AI-powered semantic understanding. It won’t replace traditional SAST tools (which are deterministic, fast, and work offline), but it fills a genuine gap for context-dependent vulnerabilities that pattern-based tools miss.

What	Score
Ease of Use	8/10 — Simple CLI, npx codex-security scan . just works; CI integration is straightforward
Features	7/10 — Solid core scanning; needs more output options, custom rules, and integration support
Value	8/10 — Free SDK; API costs are reasonable for teams already on Codex
Performance	8/10 — Scan speed depends on Codex model latency, but incremental (diff) scans are fast
Ecosystem	7/10 — New project; documentation is sparse; no community plugin marketplace yet

Overall: 7.6/10 — Silver

The tool is strongest as a complement to existing SAST tooling — not a replacement. Use Semgrep or CodeQL for fast, deterministic scanning in CI, and add Codex Security for deeper analysis on critical paths and during code review.

How to Get Started

# Install
npm install @openai/codex-security

# Authenticate
npx codex-security login

# Scan your project
npx codex-security scan .

# For full documentation
open https://learn.chatgpt.com/docs/security/cli