Is OpenAI Codex Security free to use?

The Codex Security CLI and TypeScript SDK are open source under Apache-2.0 on GitHub, but the scanner is a client for the Codex Security service and needs authorized access. Developers log in interactively for local use, and CI jobs read `OPENAI_API_KEY` from the environment. OpenAI has not yet published a separate price list for the backend service.

How do I run OpenAI Codex Security in CI?

Install `@openai/codex-security` from npm on a Node.js 22 runner, set `OPENAI_API_KEY` as a secret, and call `npx codex-security scan .` in the workflow. Codex Security tracks findings between runs, so the pipeline can fail only when a new vulnerability appears in the change, not when a known issue is still open.

What does OpenAI Codex Security actually scan for?

The README describes Codex Security as a tool to find, validate, and address security vulnerabilities across a codebase, and lists repo-wide scans, per-change diff review, and finding history as core features. OpenAI has not published the full vulnerability class list on the repo; the public docs are the source of truth for the backing service.

OpenAI · 2026-07-28 · major

OpenAI Codex Security — Apache-2.0 CLI scans repos for vulnerabilities

OpenAI open-sourced Codex Security, an Apache-2.0 CLI and TypeScript SDK that scans repositories, reviews pull-request changes, tracks findings over time, and plugs into CI as a security gate.

openai/codex-security GitHub repository social card

OpenAI's new Apache-2.0 tool for finding, tracking, and gating security bugs in a codebase, from the command line or inside CI.

Key specs

License	Apache-2.0
GitHub stars	285

Quick facts

Maker	OpenAI
Released	2026-07-28 (repo made public)
License	Apache-2.0
Package	@openai/codex-security (npm)
Runs	Node.js 22+, Python 3.10+
Auth	Interactive login or OPENAI_API_KEY
Surfaces	CLI, TypeScript SDK, CI hook

What is it?

Codex Security is a CLI and TypeScript SDK from OpenAI, released as `@openai/codex-security` on npm under Apache-2.0. The tool scans a repository, reviews the diff on a change, keeps a record of findings, and can block a CI job when new vulnerabilities appear.

How does it work?

Codex Security runs as a Node.js CLI (`npx codex-security scan .`) backed by the Codex Security service. Developers authenticate once with `codex-security login`; in CI the tool reads `OPENAI_API_KEY` instead. Scans compare the current tree against tracked findings so the same issue does not re-alert once triaged.

Why does it matter?

OpenAI Codex Security drops a first-party security scanner into the same repos that already use Codex for coding, and hands teams an Apache-2.0 SDK they can wrap into their own review flows. Because the CLI is TypeScript with a matching SDK, teams can call it from an existing Node review bot, a GitHub Action, or a pre-commit hook without a new agent framework.

Who is it for?

Security-conscious engineering teams, platform engineers wiring CI, Codex users

Frequently asked questions

Is OpenAI Codex Security free to use?: The Codex Security CLI and TypeScript SDK are open source under Apache-2.0 on GitHub, but the scanner is a client for the Codex Security service and needs authorized access. Developers log in interactively for local use, and CI jobs read `OPENAI_API_KEY` from the environment. OpenAI has not yet published a separate price list for the backend service.
How do I run OpenAI Codex Security in CI?: Install `@openai/codex-security` from npm on a Node.js 22 runner, set `OPENAI_API_KEY` as a secret, and call `npx codex-security scan .` in the workflow. Codex Security tracks findings between runs, so the pipeline can fail only when a new vulnerability appears in the change, not when a known issue is still open.
What does OpenAI Codex Security actually scan for?: The README describes Codex Security as a tool to find, validate, and address security vulnerabilities across a codebase, and lists repo-wide scans, per-change diff review, and finding history as core features. OpenAI has not published the full vulnerability class list on the repo; the public docs are the source of truth for the backing service.

Try it

npm install -g @openai/codex-security && npx codex-security scan .