OpenQodex CLI
OpenQodex reviews your change before a push: scanners with no model first, then a separate Claude Code or Codex process triages findings on your login
- 789 ★ on the repository
- Last commit
- Apache-2.0
Broad access
Why this level
- init writes global agent instructions, MCP settings, a git pre-push hook and Cursor and Cline rules
- Project changes go to the model of your Claude Code or Codex login, and scanners download executables on first run
- A scanner you connect runs its own command with your permissions after trust
Install
- Works in
Manual install
npx openqodex initRequires Node.js 22 or newer and git. The command finds Claude Code, Cursor, Codex CLI and Cline, lists the files and asks once. Then tell your agent to review the change with openqodex.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- init writes global agent instructions, MCP settings, a git pre-push hook and Cursor and Cline rules
- Project changes go to the model of your Claude Code or Codex login, and scanners download executables on first run
- A scanner you connect runs its own command with your permissions after trust
This is third-party code. Review the repository files before installing.
What it does
OpenQodex is installed with `npx openqodex init` and reviews code before `git push`. The change under review is unpushed commits plus every uncommitted edit. The `openqodex review` command first runs the scanners that fit the changed files: 22 built-in scanners cover secrets, code and dependency vulnerabilities, linters, GitHub Actions workflows, Dockerfiles, Terraform, Kubernetes, SQL and migrations. Findings on changed lines are kept, findings in test fixtures and in disabled rules are dropped. Then a reviewer starts: a separate Claude Code or Codex process on your own login, with no extra keys. By default the agent that wrote the code does not review it. The reviewer receives every changed line and must raise or drop each scanner finding with a reason, and scripts check that every finding got an answer. Claude Code starts without your settings and with read, search and list tools only; Codex runs in a read-only sandbox. The command prints the result as a receipt: a verdict, one line per finding and the path to `report.html`. `report.md`, `report.json` and `report.sarif` are written beside it. The skill tells the agent to show the receipt and ask which findings to fix. `review --all` reviews the whole repository, `review <branch>` a branch and `review '#42'` a pull request. `init` prints the list of files it will write and asks once. It creates global agent instructions, a `git push` gate for Claude Code and Codex, rules for Cursor and Cline, a `pre-push` hook in the repository and an `openqodex` MCP server that answers questions about the code graph, such as who calls a function. A custom scanner is added in `.openqodex/config.yaml` and approved with `openqodex trust`.
Who it is for. For developers and teams that write code in Claude Code, Codex, Cursor or Cline and want to check changes with scanners and an independent reviewer before pushing, without setting up a separate model key.
Good fit when
- Before a push you want secret and vulnerability scanners and linters run on the change with one command
- An agent wrote a function and a different process, not the same agent, should review it
- Every agent on the team must pass a check before `git push`, and the `pre-push` hook must catch manual pushes too
- You need a report in SARIF, HTML and Markdown that you can attach to a pull request
- You want to add your own scanner from GitHub to the check and approve it by hand
Not a fit when
- You work on Windows or WSL: checks run on macOS and Linux, and no test runs on Windows or WSL
- Neither Claude Code nor Codex is installed and signed in: there is no full review, only unchecked scanner findings
- You need a review on your own API key in the terminal: a key is supported only in the GitHub Action, not in the local review
- You need pull request reviews on an Anthropic model with no local process: Claude Code Security Reviewer covers that
Example request
Review my change with openqodex before I push and show me the findings, I will say which to fixLimitations
- Apache-2.0 license. The project is on its way to 1.0: commands, flags and the settings file can change between minor releases.
- Node.js 22 or newer and git are required. The package is tested on macOS and Ubuntu, with no tests on Windows or WSL. Some scanners need a runtime that OpenQodex does not install: brakeman and rubocop need Ruby, golangci-lint needs Go, cargo-deny needs Cargo.
- Only Claude Code and Codex can be the reviewer. Cursor cannot, and inside the Codex sandbox a second Codex process does not start. With no reviewer, `review` prints "Full review unavailable" and exits with code 2.
- The hook in the agent checks that a review of the current work exists, not what the push contains. The `pre-push` hook looks at the exact commits, but `git push --no-verify` skips it. By default both checks only warn. They block a push when `review.block_on_severity` is set in `.openqodex/config.yaml`.
- The author gives their own measurement: on planted bugs Claude Code found 129 of 153 and Codex 115 of 153. No mode finds every problem, and the report names the stages that did not run.
- There is no local copy of the vulnerability databases: osv-scanner asks osv.dev and cargo-deny downloads the RustSec database. The `--offline` flag turns such scanners off, but the reviewer still sends the change to the model of your login.
How to disable. `openqodex init --uninstall` removes the sections and files `init` wrote and leaves your own text beside them. `init --hook none` turns off the `pre-push` hook and `--no-mcp` skips registering the MCP server. The `~/.openqodex` folder holds scanners, cache and approved entries, and can be deleted by hand.
FAQ
Do I need a separate API key for the review?
No. The reviewer runs on your Claude Code or Codex login and OpenQodex asks for no keys. The exception is the GitHub Action: it runs a full pull request review only if the workflow sets `ANTHROPIC_API_KEY`. Without a key the Action runs scanners only, and so does the pre-commit hook.
Who reviews the code if both Claude Code and Codex are installed?
If both are signed in, the agent you ran `review` from does it: Codex from Codex, Claude Code from Claude Code. From elsewhere the default is Claude Code. You can pick Codex with `--reviewer codex` or `reviewer: codex` in `~/.openqodex/config.yaml`.
What is sent to outside services?
OpenQodex itself and the built-in scanners send no code and collect no telemetry. The exception is network use for downloads and databases: osv-scanner sends dependency names and versions from a lockfile to osv.dev, and semgrep fetches rule packs from its registry. The reviewer sends the change to the model of your login and by default can search the web; `reviewer_web: off` turns that off.
How do I add my own scanner?
Add it to `.openqodex/config.yaml` under `scanners.custom` with a run command and a target. Then run `npx openqodex trust`: it downloads the release into a quarantine folder, shows what will run and asks for approval. The scanner must write SARIF or one JSON document that a `map` block turns into findings. The skill forbids the agent to run `trust` without asking.
What does the package do when there is no reviewer?
It prints "Full review unavailable", exits with code 2 and saves the scanner findings, unchecked, to `unchecked-candidates.json`. It suggests a fallback, `review --agent`: the agent you are working in reviews the change from the brief it is given. The first line after the verdict in the report then says the coding agent itself reviewed it.
Discussion
No questions or reviews yet.
Related
CLI toolsReviews the git diff and the conversation with the agent: catches bugs and gaps between your request and the agent's result. CLI, skill, GitHub Action
An adversarial code-audit skill: Hunter finds bugs, Skeptic challenges them, Referee rules, and no source edit happens without your permission
An extendable code review agent that reads your diff, explores the codebase with real developer tools and leaves focused PR comments
QA agents, skills and an MCP server: test generation, coverage gaps, flaky tests, security scans and chaos testing
A skill that tests your agent's code in a real browser: reads your changes, builds a test plan and runs it through Playwright with your own cookies
Open-source AI agent for pull request review: descriptions, feedback and improvement suggestions on GitHub, GitLab and more
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| OpenQodex (this entry) | no | 789 | |
| review-loop | no | 723 | a Claude Code plugin: after a task a stop hook starts a Codex review, with no scanners and no push gate |
| open-code-review | no | 47,953 | an ocr command reads git diff and writes line-level comments, with no scanners, answer checks or push gate |
| Claude Code Security Reviewer | no | 6,474 | a GitHub Action that has Claude check a pull request for vulnerabilities, running in CI rather than before a push from your machine |
README in short
The repository holds the CLI as one file, the skill, agent templates, documentation and a demo. The project description covers installation, agent roles, requirements, the review flow, limits and the 22 built-in scanners. It also has measurements on planted bugs, example reports, plugins for Claude Code and Cursor, a GitHub Action and a pre-commit hook.