Codex Security

OpenAI vulnerability finder and patcher

AI Agents / Agents · Apache-2.0 · 11.1k

Reviewed 2026-10-09 · last push 2026-10-19 · repo checked 2026-10-19

What's Good

Apache-2.0 (openai/codex-security), npm `@openai/codex-security` with `cs` / `codex-security` commands. Scans whole repos, selected paths, or Git changes; deep scans run parallel discovery workers. Validates findings, generates patches, verifies existing fixes, drafts SECURITY.md policies and threat models. Imports GitHub code-scanning alerts, exports SARIF/JSON/CSV, publishes to Linear, and runs in CI or containers. ★~11k.

The Catch

The CLI is open source but the scanning is model calls: you sign in (`cs login`) or use an OpenAI API key in CI, so real scans cost usage — set the cost limits it documents. Needs Node 22.13+/24/26 plus Python 3.10+. Some scan tiers require separate Trusted Access for Cyber approval. Vs semgrep and trivy (deterministic rule/CVE scanners, free and fast): Codex Security is the slower LLM lane that reasons about and fixes findings — run it beside them, not instead.

Verdict

Apache-2.0 agentic vuln scanner from OpenAI. Use when you want validated findings plus patches and accept paying for the model calls.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/codex-security.svg)](https://stackgems.com/gems/codex-security)

HTML

<a href="https://stackgems.com/gems/codex-security"><img src="https://stackgems.com/badge/codex-security.svg" alt="Codex Security reviewed on Stack Gems" height="20"></a>

AI Agents →

Related