Codex Security CLI

What it is

OpenAI's Apache-2.0 command-line tool and TypeScript SDK for security reviews of a codebase, plus a GitHub Action for scheduled or pull request scans. It also works as a plugin inside Codex sessions.

What it helps with

- Scanning whole repositories, selected paths, or Git changes, with a deep scan mode
- Validating candidate findings, generating patches, and verifying existing fixes
- Drafting SECURITY.md policies and saving threat models
- Exporting SARIF, JSON, or CSV and importing GitHub code scanning alerts

Who it's for

Developers and AppSec teams who want AI-assisted vulnerability review in their terminal, scripts, or CI.

Daybreak Defense Factory
Daybreak Defense Factory, available in research preview, is installed from the plugin marketplace and connected to a GitHub repository. It can run a one-time repository scan or monitor new commits in a Codex cloud environment. Where practical, likely issues are validated in an isolated environment, and it can take in findings from your existing security tools and from Daybreak Red Team. It prepares suggested patches for human review before a pull request is opened, and a scan may take several hours for a larger repository.

Worth knowing

The tool itself is free, but scans run on OpenAI models, so you sign in with a ChatGPT account or use an OpenAI API key, where usage is billed.

Is Codex Security CLI free?
The code is free, but model usage counts against your ChatGPT plan or is billed to your API account.

Do some findings need special access?
Yes, certain cybersecurity requests and protected findings require approval through OpenAI's Trusted Access for Cyber program.

How does it relate to Semgrep or CodeQL?
In our view it complements rule-based scanners like Semgrep and CodeQL by using an AI agent to investigate and validate findings.