On this page · 12 sections
Summary. OpenAI open-sourced the Codex Security CLI and TypeScript SDK on 29 July 2026 under an Apache-2.0 licence, as the public npm package @openai/codex-security. The tool scans a repository, validates each finding, and drafts a patch, and it slots into CI with proper exit codes and SARIF output. The catch is in the engine. The client is open, but it only runs by calling OpenAI's hosted models, defaulting to gpt-5.6-sol at extra-high reasoning, and access to the full managed scanner reportedly remains a limited beta for approved customers. The product began inside OpenAI as "Aardvark," shipped as a research preview in March 2026, and by April had helped fix more than 3,000 critical vulnerabilities on OpenAI's own figures. It needs Node.js 22 or later and Python 3.10 or later to scan. This guide covers what you can run today, how to wire it into a pipeline, and where it sits next to Semgrep at about $30 per contributor per month, CodeQL, and Snyk at about $25 per developer per month.
What OpenAI actually shipped
The release is a command-line tool and a TypeScript SDK, not a model. The README describes Codex Security as "an open-source CLI and TypeScript SDK for finding, validating, and reviewing security issues in code you own or have permission to assess." The package follows semantic versioning and warns that its public API may change before version 1.0.0, so treat it as early software.
The distribution is the real story. OpenAI dropped this into the same terminal where its Codex agent already runs, and Codex passed 5 million weekly users in June 2026. That points the tool straight at Snyk, Semgrep, and Veracode, at GitHub's own fix suggestions, and at Anthropic's Claude Security, which does a similar scan-and-patch job. When the default install path for a security scanner is one npm command inside an editor five million developers already open, distribution, not detection, is the competitive lever.
Open wrapper, gated engine
The "open source" label needs an asterisk, and it is the first thing to understand before you plan a rollout. The CLI and SDK code are public under Apache-2.0. The intelligence is not. Every scan calls OpenAI's hosted models, and the README is explicit that you must "sign in with your OpenAI account or provide an OpenAI API key before running a scan." As TheNextWeb's Ana Maria Constantin described it, the release is "open plumbing bolted to a gated engine." Per the same report, access to the underlying managed scanner remains a limited beta for approved customers, and any generated patch still needs a human to sign off.
For a buyer, that has three consequences. You cannot self-host the detection logic or run it air-gapped, because the analysis happens in OpenAI's cloud. Your source code, or the slices the agent reads, leaves your network on every scan. And your cost is metered per token rather than fixed per seat, which changes the budgeting model entirely. None of that makes the tool bad. It makes it a hosted service with an open client, and it should be evaluated as one.
Install and run your first scan
The install path is short. You need Node.js 22 or later on macOS, Linux, or Windows, and Python 3.10 or later for scanning and exporting findings. Python is not required just to install the package or print --help.
npm install @openai/codex-security
npx codex-security login
npx codex-security scan /path/to/repo
On a headless box, authenticate with npx codex-security login --device-auth and open the printed verification URL. For unattended runs, set OPENAI_API_KEY or CODEX_API_KEY through your shell, CI secret, or secret manager. An environment key takes precedence over a stored sign-in.
The scan is report-only by default. Useful flags include --diff origin/main to scan only what changed, --path src to narrow the target, --json for machine-readable output, and --knowledge-base ./threat-models to feed the agent your architecture notes and threat models as Markdown, text, PDF, or Word files. Results must be written outside the repository with --output-dir, and on macOS or Linux that directory must be private to your user at chmod 700, because scan artifacts contain source excerpts and reproduction steps.
By default the CLI uses gpt-5.6-sol with extra-high reasoning effort. You can trade depth for cost with a lighter model:
npx codex-security scan . --model gpt-5.6-terra --codex 'model_reasoning_effort="high"'
Wire it into CI
The CLI is built for pipelines. It exits 0 on a completed report-only scan or a passing policy, 1 on a completed policy violation, 2 on invalid input, incomplete coverage, or a runtime error, 130 on interruption, and 143 on termination. That exit-code contract is what lets you fail a build deterministically. The README's own CI pattern scans the pull-request diff, writes findings outside the checkout, and blocks on high severity:
SCAN_ROOT="$(mktemp -d)"
npx codex-security scan . \
--diff origin/main \
--output-dir "$SCAN_ROOT/results" \
--json \
--fail-on-severity high > "$SCAN_ROOT/findings.json"
For GitHub Actions, store the key as a repository secret and reference it in the job, check out the code before the scan, and keep the output directory outside the working tree. Codex Security can emit SARIF with export --export-format sarif, written to <scan-dir>/exports/results.sarif, which uploads into GitHub code scanning like any other SARIF producer. A pre-commit path exists too: npx codex-security install-hook scans staged and unstaged changes before each commit and blocks high-severity findings, respecting core.hooksPath and leaving an existing hook in place.
For fleet-wide runs, bulk-scan discovers repositories pushed in the last 90 days through your GitHub CLI sign-in, or takes a CSV of id, repository, and immutable revision columns. A hardened Docker image runs those bulk scans noninteractively, dropping all Linux capabilities, setting no-new-privileges, running as a nonroot user, and applying a default-deny seccomp profile, with each scan in a separate unprivileged sandbox. Full-repository scans can take tens of minutes each at the default extra-high reasoning setting, so run large campaigns as asynchronous batch jobs.
How the scan works
OpenAI frames the workflow in three stages: identification, validation, and remediation. In identification, the agent reads the repository and explores realistic attack paths rather than matching fixed patterns. In validation, it attempts to reproduce each candidate issue to confirm it is real before reporting it, which is the step aimed at the false-positive problem that plagues traditional static analysis. In remediation, it drafts a concrete patch a team can review and raise into a pull request. The CLI surfaces its ranking, file-review, validation, and attack-path phases as it runs, and records false-positive feedback so repeat scans improve. Findings persist in a local workbench database, and scans compare labels each finding across two runs as new, persisting, reopened, or resolved, which is how you track drift over time.
Codex Security vs Semgrep vs CodeQL vs Snyk
The incumbents price by seat and mostly let you run the engine yourself. Codex Security prices by token and does not. That single difference drives most of the trade-off.
| Vector | Codex Security | Semgrep | CodeQL | Snyk |
|---|---|---|---|---|
| Tool licence | Apache-2.0 (CLI and SDK) | LGPL CE plus commercial | Free for open source; commercial via GitHub Advanced Security | Commercial |
| Engine | Gated OpenAI models, default gpt-5.6-sol | Rules plus Pro Engine cross-file | Semantic QL queries | Proprietary Snyk Code |
| Cost model | Metered API tokens | Per contributor | Per committer | Per developer |
| Indicative 2026 price | gpt-5.6-sol at $5 in and $30 out per 1M tokens | ~$30 per contributor per month | ~$30 per committer per month | ~$25 per developer per month, 5 to 10 devs |
| Self-host the engine | No | Yes | Yes | No |
| CI integration | GitHub Action, exit codes, SARIF | Yes | Yes | Yes |
| Autofix | AI patch with human sign-off | Limited autofix | Copilot Autofix | Snyk fixes |
On raw detection, the older engines are proven. On the OWASP Benchmark, CodeQL posts a higher F1 score than Semgrep, about 74.4% against 69.4%, with the caveat that the academic test used Semgrep's open-source edition rather than the commercial Pro Engine with cross-file analysis, so the real gap is narrower. Semgrep beats Snyk on SAST in independent testing, and for deep taint analysis dedicated engines like Semgrep or Checkmarx return more complete results. Codex Security has no comparable public benchmark yet, so its accuracy claim rests on OpenAI's own 3,000-vulnerability figure from the Aardvark preview, not third-party numbers.
The cost model is the real catch
A per-seat SAST licence is predictable: Semgrep at roughly $30 per contributor per month, or Semgrep's full stack of Code, Supply Chain, and Secrets at $30 plus $30 plus $15, which is $75 per contributor per month. Snyk's Team tier runs about $25 per contributing developer per month with a 5-developer minimum and a 10-developer cap, and moving past 10 developers raises the per-seat cost. You know the bill in advance.
Codex Security replaces that with token metering. The default gpt-5.6-sol model costs $5 per 1M input tokens and $30 per 1M output tokens, and a full-repository scan at extra-high reasoning takes tens of minutes and consumes a large, variable number of tokens per repository. For a monorepo scanned on every pull request, that is an open-ended line item, not a fixed one. The lever is the model flag: dropping to gpt-5.6-terra or a lower reasoning effort cuts cost per scan, and scanning the diff rather than the whole tree cuts it further. Budget this like inference spend on an AI agent, not like a software licence, and put a policy on which branches trigger a full scan.
Where it fits
Codex Security is strongest as a second pair of eyes on changed code, not as the system of record for every rule your auditors expect. Use it on pull-request diffs to catch logic-level flaws and to draft patches, keep a deterministic engine like Semgrep or CodeQL as the gate that must pass, and let the AI tool add validated findings and fix suggestions on top. It reads like the pattern for AI coding agent harnesses such as the Codex CLI: powerful inside a bounded, reviewed workflow, risky as an unattended autopilot. Treat every generated patch as a proposal that a human reviews, exactly as OpenAI requires, and apply the same guardrails you would for any AI agent security setup, because the scanner reads your source and runs untrusted analysis on it.
For teams standardising on GitHub-native scanning, our walkthrough of CodeQL AI code scanning setup pairs well with this as the deterministic baseline, and the broader picture of running these agents in production sits in our guide to enterprise AI agents in production. If your supply chain is the exposure, combine it with MCP server hardening.
India-specific considerations
The gated-engine design has a data-governance edge that matters more for Indian teams handling regulated data. Because the analysis runs in OpenAI's cloud, source code, or the portions the agent reads, leaves your network on every scan. Where that code embeds personal data, secrets tied to personal data, or regulated financial logic, the Digital Personal Data Protection Act 2023 (DPDP) obligations on cross-border processing and purpose limitation apply to that transfer, and a per-token security scan does not remove them. For a BFSI or health workload, a self-hostable engine like Semgrep or CodeQL keeps analysis inside your boundary, while Codex Security should be scoped to repositories where sending code to a third-party model is contractually cleared. Decide the boundary first, then choose the tool that respects it.
FAQ
How eCorpIT can help
eCorpIT wires AI and traditional code scanning into CI/CD pipelines that fail builds on real risk without drowning teams in noise. We set up the exit-code policies, SARIF uploads, and branch rules that make a tool like Codex Security useful, keep a deterministic engine as the gate, and scope where source code may leave your network so a scan does not breach a data agreement. Our senior engineering teams, certified to CMMI Level 5 and ISO 27001:2022, design secure AI-assisted development workflows aligned with DPDP requirements. To harden your pipeline, contact eCorpIT.
References
_Last updated: 1 August 2026._
