# Introducing the Open-Source Codex Security CLI

**URL:** <https://community.openai.com/t/introducing-the-open-source-codex-security-cli/1388319>\
**Category:** Codex\
**Tags:** cybersecurity, codex-cli\
**Created:** [July 29, 2026, 8:02am UTC](https://community.openai.com/t/introducing-the-open-source-codex-security-cli/1388319 "2026-07-29T08:02:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![VeitB](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/veitb/32/712987_2.png) [@VeitB](https://community.openai.com/u/VeitB)\
**Post date:** [July 29, 2026, 8:02am UTC](https://community.openai.com/t/introducing-the-open-source-codex-security-cli/1388319/1 "2026-07-29T08:02:06Z")

</div>

Codex Security helps security and engineering teams find, confirm, and fix vulnerabilities.

Use its command-line interface (CLI) to scan repositories you own or have permission to assess, review findings over time, and check changes before they land.

- [Quickstart Guide](https://learn.chatgpt.com/docs/security/plugin) for an interactive scan
- [Cloud set-up](https://learn.chatgpt.com/docs/security/setup) for connected GitHub repositories
- Link to the public repo: [Codex Security](https://github.com/openai/codex-security)

This is an early release, and we’re listening to your feedback as we continue improving it.

> The Codex Security CLI and SDK are in beta and require access. Follow the installation instructions provided with your access. For an interactive scan in Codex, start with the [Codex Security plugin quickstart](https://learn.chatgpt.com/docs/security/plugin). For connected GitHub repositories, see [Codex Security cloud setup](https://learn.chatgpt.com/docs/security/setup).

Install the open-source Codex Security CLI,:  
`npm install @OpenAI/codex-security`

Or start with:

`npx @OpenAI/codex-security@latest --help`

NPM: [npmjs.com/package/@openai/codex-security](http://npmjs.com/package/@openai/codex-security)

---

<div class="post-metadata">

**Author:** ![abdelstark](https://sea2.discourse-cdn.com/openai1/user_avatar/community.openai.com/abdelstark/32/753984_2.png) [@abdelstark](https://community.openai.com/u/abdelstark)\
**Post date:** [July 29, 2026, 3:38pm UTC](https://community.openai.com/t/introducing-the-open-source-codex-security-cli/1388319/2 "2026-07-29T15:38:52Z")

</div>

This looks like a useful direction. For engineering teams, trust in each finding will matter as much as raw detection.

One output format I would find genuinely useful is a finding split into:

- evidence and exact source locations
- exploitability assumptions and reachability
- proposed fix
- a verification command or test
- confidence and unresolved uncertainty

That would keep the result reviewable instead of turning an AI severity score into a blind CI gate. Machine-readable SARIF or JSON, plus suppressions with an owner and expiry, would also make adoption much easier.

Is reachability analysis and evidence-backed verification already on the roadmap?

---

<div class="post-metadata">

**Author:** ![foikloak](https://avatars.discourse-cdn.com/v4/letter/f/34f0e0/32.png) [@foikloak](https://community.openai.com/u/foikloak)\
**Post date:** [August 23, 2026, 3:17pm UTC](https://community.openai.com/t/introducing-the-open-source-codex-security-cli/1388319/3 "2026-08-23T15:17:03Z")

</div>

What model is used for Codex Security cloud?