Introducing the Open-Source Codex Security CLI

Codex
,
1

Codex Security helps security and engineering teams find, confirm, and fix vulnerabilities.

Use its command-line interface (CLI) to scan repositories you own or have permission to assess, review findings over time, and check changes before they land.

This is an early release, and we’re listening to your feedback as we continue improving it.

The Codex Security CLI and SDK are in beta and require access. Follow the installation instructions provided with your access. For an interactive scan in Codex, start with the Codex Security plugin quickstart. For connected GitHub repositories, see Codex Security cloud setup.

Install the open-source Codex Security CLI,:
npm install @OpenAI/codex-security

Or start with:

npx @OpenAI/codex-security@latest --help

NPM: npmjs.com/package/@openai/codex-security

2

This looks like a useful direction. For engineering teams, trust in each finding will matter as much as raw detection.

One output format I would find genuinely useful is a finding split into:

  • evidence and exact source locations
  • exploitability assumptions and reachability
  • proposed fix
  • a verification command or test
  • confidence and unresolved uncertainty

That would keep the result reviewable instead of turning an AI severity score into a blind CI gate. Machine-readable SARIF or JSON, plus suppressions with an owner and expiry, would also make adoption much easier.

Is reachability analysis and evidence-backed verification already on the roadmap?