{"data":{"slug":"codex-security","name":"Codex Security","tagline":"OpenAI vulnerability finder and patcher","category":"agents","categoryName":"AI Agents","url":"https://developers.openai.com/codex/security","github":"https://github.com/openai/codex-security","pricing":"open-source","hook":"Codex Security is OpenAI’s scanner-as-an-agent: point `cs scan .` at a repo, it hunts for vulnerabilities, validates the candidates, and can draft patches — instead of handing you a wall of pattern matches.","whatsGood":"Apache-2.0 (openai/codex-security), npm `@openai/codex-security` with `cs` / `codex-security` commands. Scans whole repos, selected paths, or Git changes; deep scans run parallel discovery workers. Validates findings, generates patches, verifies existing fixes, drafts SECURITY.md policies and threat models. Imports GitHub code-scanning alerts, exports SARIF/JSON/CSV, publishes to Linear, and runs in CI or containers. ★~11k.","theCatch":"The CLI is open source but the scanning is model calls: you sign in (`cs login`) or use an OpenAI API key in CI, so real scans cost usage — set the cost limits it documents. Needs Node 22.13+/24/26 plus Python 3.10+. Some scan tiers require separate Trusted Access for Cyber approval. Vs semgrep and trivy (deterministic rule/CVE scanners, free and fast): Codex Security is the slower LLM lane that reasons about and fixes findings — run it beside them, not instead.","verdict":"Apache-2.0 agentic vuln scanner from OpenAI. Use when you want validated findings plus patches and accept paying for the model calls.","addedAt":"2026-10-09","featured":false,"domain":"AI Agents","subSpecialty":"Agents","subcategory":"Security","tags":["self-host","permissive","coding-agents","security","active","young-repo","fast-stars"],"capabilities":[],"surfaces":["Self-host"],"ecosystem":["Multi-platform"],"licenseModel":"Apache-2.0","githubStars":11133,"starsPerWeek":791,"access":"free","archived":false,"repo":{"createdAt":"2026-07-13","pushedAt":"2026-10-19","license":"Apache-2.0","archived":false,"checkedAt":"2026-10-19"}},"related":[{"slug":"claude-code","name":"Claude Code","tagline":"Terminal-first coding agent with deep repository context"},{"slug":"cursor","name":"Cursor","tagline":"The AI-first code editor that understands your codebase"},{"slug":"devin","name":"Devin","tagline":"Autonomous AI engineer for defined engineering tasks"},{"slug":"stagehand","name":"Stagehand","tagline":"AI-native browser automation that mixes code and natural language"},{"slug":"browser-use","name":"Browser Use","tagline":"Open-source framework for LLM-driven browser agents"}],"links":{"self":"/api/gems/codex-security","html":"/gems/codex-security","markdown":"/gems/codex-security.md","category":"/api/gems?category=agents","categoryPage":"/stacks/agents"}}