OpenAI open-sources Codex Security CLI to scan and fix your code
Apache-2.0 and npm-installable, powered by the Codex agent — it finds vulns, proposes patches, tracks fixes across runs, and drops into CI/CD.
Copy markdown
Install it in one line
`npm install @openai/codex-security` — or `npx @openai/codex-security@latest --help` to run it cold — and you're scanning repositories from the terminal. It wants Node 22+ and Python 3.10+.
It reasons about code, not just greps it
The CLI leans on the Codex agent for contextual analysis instead of pure pattern-matching, so it finds vulnerabilities, proposes patches, and verifies your fixes actually close the hole. OpenAI says the underlying system has helped fix 3,000+ critical vulns to date.
Drops straight into CI/CD
Set `OPENAI_API_KEY` in your pipeline and it gates changes before deploy, tracks findings across runs, and runs bulk scans across multiple repos at once. Scan state lives in a workbench dir you can relocate via `CODEX_SECURITY_STATE_DIR`.
Apache-2.0, with a TypeScript SDK
It's fully open source under Apache-2.0 (~1.5k GitHub stars at launch) and ships a TypeScript SDK — so you can script scans or embed it in your own tooling, not just shell out to the CLI.
The catch: it's early, and metered
OpenAI is explicit that this is an early release still being hardened, and full scanning wants an OpenAI API key (billed per use) rather than a ChatGPT login. Expect rough edges and a feedback loop.
Build this weekend
Point it at the side project you never security-reviewed: one scan surfaces the injection and secret-leak classes you'd never catch by eye, with patches you can diff before you merge.