OpenAI Releases Codex Security CLI for Repository Scans and CI Checks

OpenAI has released Codex Security, an open-source command-line tool and TypeScript SDK for code-security review. The company says the early release can scan repositories, track findings across runs, verify fixes, and add security checks to CI/CD. (OpenAI on X)

The project is available as @openai/codex-security, with the CLI and SDK documented in the official repository. (Codex Security on GitHub)

What Codex Security does

Codex Security is meant to sit closer to a security-review workflow than a one-shot scanner. OpenAI describes it as a tool for finding, validating, and fixing vulnerabilities in code, while the CLI documentation says teams can scan repositories they own or have permission to assess, review findings over time, and check changes before they land. (Codex Security CLI quickstart)

The CLI keeps structured results that can include findings, coverage, a Markdown report, artifacts, and SARIF output. Findings can include severity, confidence, locations, evidence, and remediation guidance. Coverage records reviewed surfaces, exclusions, deferred work, and open questions, so a partial scan is not presented as proof that every part of a repository was reviewed. (Codex Security CLI quickstart)

The workflows it supports

The documented CLI supports several practical review loops:

• Repository scans: Review a repository or a path within it, with optional deep mode for broader analysis. (Codex Security CLI quickstart)
• Diff scans: Check committed changes between a base revision and HEAD. (Codex Security CLI quickstart)
• Working-tree scans: Review staged and unstaged changes against HEAD. (Codex Security CLI quickstart)
• Scan comparison: Compare saved scans to identify findings that are new, persisting, reopened, resolved, or still unknown. (Codex Security on GitHub)
• Pre-commit checks: Install a Git hook that scans staged and unstaged changes before each commit and blocks high-severity findings and scan errors. (Codex Security CLI quickstart)

For CI and other unattended workflows, the project documents API-key authentication. The repository says environment API keys are passed to the current scan rather than stored in Codex's credential home or system keyring. (Codex Security on GitHub)

Access and prerequisites

The npm package and source repository are public, but OpenAI's documentation says that running scans requires Codex Security access. Depending on the account and repository, full-repository scans may also require Trusted Access for Cyber; signing in or setting an API key does not grant that access. (Codex Security CLI quickstart)

The current quickstart lists Node.js 22 or later and Python 3.10 or later as requirements for the CLI's scan and export workflows. It also warns that scan results can contain source excerpts and vulnerability details, so teams should choose a private output location and an appropriate retention policy. (Codex Security CLI quickstart)

What to test first

For a small engineering team, the least disruptive starting point is a diff or working-tree scan on a repository where you already have permission to assess the code. Review the report and coverage before treating the result as complete, then compare a later scan to see whether findings persist or resolve.

If you want the check to run before commits, the documented pre-commit hook is the more direct integration point. For CI, keep API-key authentication in the secret manager and make the scan output directory private. Codex Security is a review aid, not a substitute for a broader security program or human approval of a proposed fix.

Sources

• OpenAI announcement: https://x.com/OpenAI/status/2082263717916586117
• Codex Security repository: https://github.com/openai/codex-security
• Codex Security CLI quickstart: https://developers.openai.com/codex/security/cli