OpenAI opens Apache-2.0 Codex Security CLI for repository scans

• OpenAI open-sourced a Codex Security CLI and TypeScript SDK for vulnerability work, with repo scans, change review, finding history, and CI checks, as thsottiaux's launch post put it.
• The terminal path is npm/npx: OpenAI's install thread gave npm install @OpenAI/codex-security and npx @OpenAI/codex-security@latest --help.
• The scope reaches bulk repo scans and fix validation: rohanpaul_ai described whole-repo or selected-change scans, suspected-flaw validation, generated patches, and persistent findings.
• The GitHub repo is Apache-2.0, and gdb's open-source post was the terse first signal before OpenAI called it an early release.

Hacker News found the repo before OpenAI's own post, OpenAI said. The CLI quickstart has the operational stuff: report.md, findings.json, coverage.json, SARIF export, --max-cost, pre-commit hooks, and scan-history comparison. The CI guide is unusually specific about runner hygiene: install the package before checkout, run it by absolute path, pin Actions by commit, and keep repository credentials out of checked-out Git config.

The package lives in openai/codex-security under Apache-2.0. It was introduced publicly in two short waves: gdb's post said the CLI was open-sourced, and thsottiaux's launch post added the SDK and workflow surface.

OpenAI's docs frame the tool as a CLI and SDK for finding, confirming, and fixing vulnerabilities in code the user owns or has permission to assess.

The shipped surface breaks down cleanly:

• Scan repositories.
• Review changes before they land.
• Track findings across runs.
• Validate suspected flaws.
• Generate patches.
• Run security checks in CI.
• Use a TypeScript SDK from applications or developer tools.

The CLI quickstart supports full repositories, paths, committed diffs, and working-tree changes.

The main scan shapes are:

• Full repo: codex-security scan "$REPOSITORY".
• Selected paths: --path services/billing --path packages/auth.
• Committed diff: --diff origin/main --head HEAD.
• Working tree: --working-tree --base HEAD.
• Broader review: --mode deep.
• Architecture or policy context: repeated --knowledge-base arguments.
• Estimated model budget: --max-cost 5.
• Local commit gate: codex-security install-hook, which scans staged and unstaged changes and blocks high-severity findings plus scan errors.

The docs say scan results can include source excerpts and vulnerability details, so the examples write outputs outside the repository worktree.

OpenAI's terminal screenshot showed the org-scale path: gh auth login, then npx codex-security bulk-scan, with an example flow finding 2,048 active repositories.

According to the quickstart, the interactive GitHub flow excludes archived repos and forks, then asks for confirmation before scanning. CSV campaigns add more automation knobs:

• bulk-scan repositories.csv --output-dir ... --workers 4 runs a prepared repo list.
• Re-running the same command resumes an existing bulk scan and skips completed repos with intact artifacts.
• --max-attempts 3 retries temporary repository or scan failures.
• Docker bulk scans run without prompts when access includes OpenAI's supplied hardened Compose setup.
• Private repository scans can receive GH_TOKEN or GITHUB_TOKEN through the environment or a secret manager.

The output contract is more useful than the launch tweets. The CLI quickstart says a scan directory contains:

• report.md, the readable report.
• scan-manifest.json, target, scope, producer, and sealed artifacts.
• findings.json, severity, confidence, locations, evidence, and remediation.
• coverage.json, reviewed surfaces, exclusions, deferred work, open questions, and completeness.
• artifacts/, supporting evidence.
• exports/results.sarif, when SARIF export is produced.

Coverage has three states: complete, partial, and unknown, according to the same quickstart. The output contract keeps deferred surfaces and open questions in coverage.json, which makes incomplete review machine-visible.

Scan history is also part of the CLI, not a side file convention. The docs list commands to scans list, scans show, scans rerun, scans match, and scans compare; comparison categorizes findings as new, persisting, reopened, resolved, or unknown. The CLI FAQ says false positives can be marked with an occurrence ID and reason, and later scans reuse that context.

The CI guide uses GitHub Actions to scan exact PR changes, preserve artifacts, export SARIF, and optionally fail on severity.

The example workflow does four security-relevant things around the scanner:

• Skips fork PRs and Dependabot because normal secrets are unavailable or read-only.
• Installs the approved package under $RUNNER_TEMP before checkout.
• Runs the scanner by absolute path instead of a repository-controlled executable.
• Uses persist-credentials: false and pins Actions to verified commits.

Policy gating is explicit. --fail-on-severity accepts critical, high, medium, and low, with each threshold including findings at that severity and above.

The CI exit codes are compact:

• 0: complete coverage and configured policy passed.
• 1: completed scan contains a finding at or above the threshold.
• 2: input or runtime error, or incomplete coverage.
• 130: Ctrl-C interruption.
• 143: SIGTERM termination.

A partial or unknown coverage scan exits 2 even without a severity policy, while still writing available findings and coverage.

The SDK guide says the TypeScript SDK runs server-side as ESM on Node.js 22 or later, with Python 3.10 or later required for scans.

The minimal pattern is a long-lived client, one scan, then runtime cleanup:

The SDK exposes the same building blocks as the CLI: repository scans, selected paths, committed diffs, working-tree scans, deep mode, knowledge-base paths, and cost limits. It adds application hooks for preflight checks, progress callbacks, reconnect notices, onCost, cancellation through AbortSignal, and structured ScanResult objects with manifest, findings, coverage, artifact paths, thread ID, and estimated cost.

The repo is open, while scanner access remains gated. The CLI quickstart says the CLI and SDK are beta and require access; it also says full-repository scans may require Trusted Access for Cyber, and that signing in or setting an API key does not grant that access.

The prerequisites are narrow: Node.js 22 or later for the CLI, Python 3.10 or later for scans and exports, ChatGPT login for local use, device auth for headless machines, and OPENAI_API_KEY for CI or automation.

Michael, who identified himself on the Hacker News thread as Promptfoo cofounder and one of the people working on the CLI at OpenAI, thanked readers for flagging auth issues and said the product would evolve quickly. Comments in that HN thread focused on operational limits around auth, guardrails, rate limits, cost, and interrupted scans.