OpenAI open-sources Codex Security CLI and TypeScript SDK

Overview

OpenAI has released the Codex Security CLI and TypeScript SDK as open source. The repository @openai/codex-security provides a command‑line interface and a TypeScript SDK for finding, validating, and fixing security vulnerabilities in code. It can scan repositories, review changes, track findings over time, and run security checks in CI.

Installation and Quick Start

To use the tool, install the npm package, log in, and run a scan on a directory. The quick start instructions state that Node.js 22 or later and Python 3.10 or later are required, along with access to Codex Security. Installation is done with:

npm install @openai/codex-security

After installing, users log in via:

npx codex-security login

A scan of the current directory is started with:

npx codex-security scan .

For CI environments, the OPENAI_API_KEY environment variable can be set instead of performing the interactive login.

How It Works

The CLI and SDK invoke the Codex Security service to analyze code for vulnerabilities and produce a report. The TypeScript SDK example shows the basic flow:

import { CodexSecurity } from "@openai/codex-security\);\nconst security = new CodexSecurity();\nconst result = await security.run(".