openai/codex-security

Codex Security is a command line tool and TypeScript library from OpenAI for scanning your codebase, finding security vulnerabilities, confirming they are real, and helping fix them. It is published as the npm package @openai/codex-security and needs Node.js 22 or newer, Python 3.10 or newer, and access granted to the Codex Security product before it will run. Once installed you sign in and run a scan command against a folder, and it uses an AI model to look through the code for problems. You can pick which AI model and how much effort it spends, and choose different scan modes, including a deep scan mode that keeps digging with multiple parallel workers until it stops finding anything new or hits a time limit you set, up to 96 hours. It is not locked to OpenAI's own models either. You can point it at other providers like OpenRouter, Fireworks, or Amazon Bedrock by setting the right API key and choosing a model from that provider. Beyond a single scan, it keeps a history of findings so you can list open issues in a repository over time, and it can compare two scans to show what is new, what has been fixed, and what is still open. There is a verbose diagnostics mode for debugging scans, though the README notes that this verbose output can contain sensitive data and should be reviewed before sharing. For teams that want to run scans automatically rather than by hand, there is a TypeScript SDK for scripting scans directly, plus an official Docker container and Docker Compose setup for running bulk, repeatable scans across many repositories pinned to specific code versions, with support for sharing extra security documentation and custom prompts across those scans.