Bex Security CLI
Bex Security finds, validates and fixes repository vulnerabilities through Codex, Claude Code and other ACP-compatible agents.
- 54 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- An agent reads the whole repository and validates findings while source goes to an external model.
- The tool finds and validates vulnerabilities, so use it only on your own code or with the owner's permission.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/bex-securityDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- An agent reads the whole repository and validates findings while source goes to an external model.
- The tool finds and validates vulnerabilities, so use it only on your own code or with the owner's permission.
This is third-party code. Review the repository files before installing.
What it does
Bex Security is a fork of OpenAI Codex Security that keeps the same workflow: find vulnerabilities, validate findings, fix and report. Any agent that speaks the Agent Client Protocol can run the scan. Codex is the default, and Claude Code, Kimi Code, Muse Code, Qwen Code and MiMo Code are supported in alpha. The command `bex-security scan /path/to/repository --agent claude` runs the scan with the chosen agent, and flags set the model, provider and effort. Results land in `report.md`, and a failed review leaves `incomplete-report.md` with an explanation. Each reported candidate gets two independent checks.
Who it is for. Teams that audit their own code for vulnerabilities and want to pick the agent and model per repository instead of tying to one vendor.
Good fit when
- Your own repository needs a security pass with a report before release.
- The same audit must run on Codex, then on Claude Code, with results compared.
- A team uses Qwen or Kimi and wants the same security workflow.
- A finding must be confirmed by an independent check instead of taken on faith.
Not a fit when
- A system must be tested without the owner's permission.
- Source code cannot be sent to an external model.
- You need a ready dependency scan with no agent run.
Example request
Scan this repository for vulnerabilities with Bex Security using the Claude agent and show the report.Limitations
Node.js 22.13+ (the 22 line), 24 or 26 and Python 3.10 or newer are required, plus an authenticated agent. Support for every agent except Codex is still alpha. Repository code goes to the chosen model, and cybersecurity requests and protected findings may require approval. Scan only your own repositories or projects where an audit is permitted.
How to disable. Remove the package with `npm uninstall --global @bex-co/bex-security`. Delete scan output and report folders by hand.
FAQ
How do I run a scan through Claude Code?
Sign in to Claude locally and run `bex-security scan /path/to/repository --agent claude`. The `--model` and `--effort` flags set model and effort.
How does Bex differ from Codex Security?
It is a fork with the same process and an open agent layer over ACP. It tracks upstream main so it does not fall behind improvements.
Which providers can be attached?
Claude Code scans can switch provider with `--provider`, for example `zai` or `kimi`. Other agents start through their own ACP commands.
Where does the result go?
The scan directory gets `report.md`. If assignment review did not finish, `incomplete-report.md` remains.
Is Docker required?
The repository ships Compose files and a Dockerfile for the environment, but running the package through `bex-security` does not need them.
Discussion
No questions or reviews yet.
Related
CLI toolsCodex Security scans code, validates findings and fixes, saves evidence and exports results for review and CI workflows.
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
A Claude Code skill that finds vulnerabilities in one session: threat model, verified findings, CWE and CVSS report.
A code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
Security scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Bex Security (this card) | no | 54 | |
| Codex Security | no | 12,959 | the OpenAI original built on Codex; Bex Security adds Claude Code, Qwen, Kimi and other agents over ACP |
| Semgrep Skills | yes | 342 | provides Semgrep rules and skills; Bex Security drives an agent scan from discovery to fix |
README in short
ACP connects the agents, and evidence and reports pass one shared format validation. Codex, Claude Code, Kimi, Muse and Qwen each have their own launch commands.