Codex Security CLI
Codex Security scans code, validates findings and fixes, saves evidence and exports results for review and CI workflows.
- 11,307 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- Codex Security reads sources and creates reports; separate user commands can prepare patches or publish findings externally.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/codex-securityDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Codex Security reads sources and creates reports; separate user commands can prepare patches or publish findings externally.
This is third-party code. Review the repository files before installing.
What it does
The user selects a repository, paths or Git changes. Codex Security investigates code and saves findings with evidence and coverage limits. The user then chooses which candidates to validate or patch. Run scans locally, in CI or from Codex. Analysis uses `SECURITY.md`. Separate commands verify patches, export SARIF, JSON or CSV for the team to investigate further. A threat model is retained when available.
Who it is for. Application security engineers reviewing repositories with finding evidence and retained reports.
Good fit when
- Review authorization before releasing an application.
- Compare security-sensitive branch changes against their base revision.
- Collect evidence that an existing fix addresses a finding.
- Send local security findings to CI in SARIF format.
Not a fit when
- A report must guarantee no vulnerabilities beyond its coverage.
- Sources cannot be shared with the selected analysis provider.
- You need the removed local serve dashboard.
Example request
Review authorization in src and save findings, evidence and coverage limits without editing code or publishing results.Limitations
Prepare compatible Node.js and Python, authentication and access to the selected models. Some protected findings and actions require Trusted Access for Cyber approval, which installing the CLI does not grant. Results cover investigated code; the report records exclusions and unfinished work. Before applying patches or sharing findings, review code diffs, evidence contents and the selected publication destination.
How to disable. Stop scanning and disable its CI or Codex job. Reports remain separate; revoke provider keys that are no longer needed.
FAQ
Which executable should I use?
Use `cs` or `codex-security`; the full name avoids an alias conflict.
Can I limit analysis to branch changes?
Yes. `cs scan . --diff origin/main` reviews changes against origin/main; `--diff` selects the base revision.
Is Cloud required?
No. Local scans need a configured provider; Cloud is a separate connection.
Where does scan guidance come from?
From root or component `SECURITY.md` files. Files at .github/SECURITY.md and docs/SECURITY.md do not automatically supply repository-wide scan guidance.
Is a generated patch already accepted?
No. Generation, fix validation and reviewer acceptance are separate steps.
Discussion
No questions or reviews yet.
Related
CLI toolsA security research framework on Claude Code: static analysis, LLM validation of findings, exploits and patches
Independent security checks for code from people and AI: it scans, repairs and issues a fix record that can be verified offline.
An AI security verification CLI: scans models and code, probes live endpoints and MCP servers, and analyzes recorded agent runs
A skill for reviewing code for vulnerabilities against OWASP Top 10:2025, ASVS 5.0 and the 2026 lists for LLM and AI agent security
A SAST scanner with cross-file dataflow analysis and an MCP server: the agent sees call graphs, taint sources and sinks
A local dashboard for Claude Code, Codex CLI and OpenCode: what the agent loads, its token cost and an MCP server security scan
README in short
The policy command saves a SECURITY.md draft outside the repository. Review its changes and copy the chosen text to the indicated file; the existing policy is not overwritten automatically.