OpenAI has released Codex Security as a command-line interface and TypeScript software-development kit for finding, validating and fixing vulnerabilities in source code. The project's GitHub repository and npm package provide local and continuous-integration workflows, while some protected findings and cybersecurity requests require approval through OpenAI's Trusted Access for Cyber program.
The package requires Node.js 22.13.0 or newer and Python 3.10 or newer. Users can authenticate interactively for local work, while continuous-integration environments can supply an OpenAI API key. The repository also allows another inference provider to be selected by configuring that provider's API key and model.
For teams scanning many repositories, the project includes a Docker Compose configuration. A separate workflow-runner example divides scanning into individual stages with durable state and can connect to a separately deployed findings service. This separation supports workflows that need to preserve results across runs instead of treating every scan as an isolated command.
The findings service is distributed in a separate container image. According to the repository, it stores findings and vector embeddings in SQLite and exposes paginated results. A read-only dashboard refreshes every five seconds and displays both stored findings and groups of suspected duplicates. The service can search for possible duplicate reports within one repository or, when explicitly requested, across all repositories.
Completed scans can be uploaded to a custom findings service with the CLI's publish command and a service URL. The SDK and a dedicated deduplication command then retrieve candidates, ask Codex to conduct independent local reviews, and save accepted duplicate groups. Cross-repository comparison is opt-in, which gives operators control over the scope used for similarity checks.
The repository describes Codex Security as covering three related stages: discovery, validation and remediation. That combination is intended to move beyond simply listing scanner alerts. However, the supplied material does not provide detection-rate benchmarks, false-positive measurements or comparisons with other security tools. Its release therefore establishes capabilities and deployment options, not verified performance across codebases.
Operational requirements also matter. Storing security findings creates sensitive data that teams must protect, even when the included dashboard is read-only. Running model-assisted reviews in CI requires carefully scoped credentials and decisions about which repositories or findings may be sent to an inference service. The Trusted Access requirement for some work adds another access boundary.
Codex Security's open-source CLI and SDK give developers a programmable base for incorporating AI-assisted security analysis into existing pipelines. The container and findings-service examples broaden that base from a single local scan to persistent, multi-repository operations, while leaving deployment, access control and final remediation decisions with the operator.
