openai/codex-security

Codex Security – AI‑powered security scanner for code

What it is

• A command‑line tool and TypeScript SDK (@openai/codex-security) that uses large‑language‑model (LLM) back‑ends (OpenAI, Bedrock, OpenRouter, Fireworks) to automatically discover, validate, and remediate security vulnerabilities in source code.
• Designed for developers, security teams, and CI pipelines. It can run locally, in containers, or as a GitHub Action.

Core capabilities

Feature	What it does
Scanning	Walks a repository, selected paths, or a Git diff. A deep mode runs parallel discovery workers for thorough coverage.
Validation & patch generation	After a finding is reported, the tool can ask the model to confirm the issue, suggest a fix, and produce a patch that can be applied automatically.
Policy drafting	Generates a draft SECURITY.md (security policy) and threat‑model documents, saved outside the repo for review before committing.
Finding management	Stores scans, de‑duplicates results, ranks severity against a user‑provided rubric, and suggests owners based on code ownership and Git history.
Export & integration	Exports results as SARIF, JSON, or CSV; can import GitHub code‑scanning alerts; can publish findings to Linear or a custom findings service.
Automation	Supports bulk scans via Docker Compose, CI/CD (GitHub Actions), and container‑sandboxed runs. Environment variables (OPENAI_API_KEY / CODEX_API_KEY) control authentication.
Multi‑provider support	Works with OpenAI models (e.g., gpt‑5.6‑sol), Amazon Bedrock, OpenRouter, and Fireworks AI, letting teams use existing cloud credentials.

Typical workflow

1. Install – npm install -g @openai/codex-security (or use npx).
2. Log in – cs login (or device‑auth/SSH forwarding for headless machines).
3. Create / update policy – cs policy . creates a draft SECURITY.md you review and copy into the repo.
4. Run a scan – cs scan . (or cs scan . --mode deep, --path src, --diff origin/main).
5. Review findings – The CLI shows duplicates, severity, and suggested owners; you can generate patches or export reports.
6. Integrate – Add the provided GitHub Action or Docker‑Compose bulk‑scan setup to run on schedule or in PRs.

Installation & requirements

• Node.js 22.x (or 24/26) and Python 3.10+ (Python needs tomli).
• Optional sandbox dependencies for the GitHub Action: bubblewrap and apparmor on Ubuntu 24.04.

Example TypeScript usage

import { CodexSecurity } from "@openai/codex-security";

const sec = new CodexSecurity();
try {
  const result = await sec.run("/path/to/repo");
  console.log("Report written to", result.reportPath);
} finally {
  await sec.close();
}

The SDK mirrors the CLI: configure deep‑scan options, handle validation, severity classification, and retrieve the generated report.

Docs & help

• Online docs: https://learn.chatgpt.com/docs/security/cli
• CLI reference: sdk/typescript/docs/cli.md
• Project config guide, examples, and provider‑specific setup are in the repository.

Who it’s for

• Development teams that want AI‑assisted static security analysis without leaving their CI pipeline.
• Security engineers looking for automated threat‑model generation and consistent reporting.
• Organizations that already use OpenAI or other LLM providers and need a way to leverage those models for code security.

---

All details above are taken directly from the repository’s README; no additional features are inferred.