Codex Security

Open source alternative to Snyk, Semgrep Pro and GitHub Advanced Security

11.7K stars
Apache-2.0
Active this week
Last commit today

Last verified Nov 12, 2026

Analyze application code for security vulnerabilities with AI-powered scanning, then generate patches and verify fixes through the CLI, SDK, or GitHub Actions.

Visit website GitHub11.7K

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Codex Security is for#

Security engineers triaging findings across repositories

Codex Security's bulk scan mode and Linear, Jira, and GitHub integrations let security teams run resumable campaigns across a list of repositories, track findings by owner, and export SARIF reports for existing vulnerability management tools.

Skip if:

Teams that only need dependency scanning (SCA) rather than code-level SAST are better served by a dedicated tool. Codex Security scans application code, not package manifests or container images.

Development teams adding security checks to CI

The GitHub Actions workflow example runs scheduled repository scans against an API key stored as a repository secret, with configurable cost limits per scan. The same workflow supports pull request checks and severity thresholds for blocking merges on critical findings.

Skip if:

If your CI pipeline already has a SAST tool covering the same codebase, evaluate whether Codex Security adds coverage or duplicates it before adding another scan step.

Developers verifying fixes before merging a pull request

Running `cs scan . --diff origin/main` scans only committed changes from a base revision to HEAD, keeping scope narrow for pre-merge checks. The tool generates a candidate patch for a confirmed finding and can verify whether an existing fix resolves the issue before the pull request is submitted.

Skip if:

Teams using the Codex plugin interactively in the desktop app may find the diff-scanning CLI redundant. The plugin handles findings in context during active development.

the problem

The problem it solves#

Security vulnerabilities accumulate silently during development. Most teams find them late: either through a manual penetration test, a CI scan that reports issues without guidance on fixing them, or after an incident. The gap between finding a vulnerability and confirming a fix is typically measured in days or weeks, often because the finding lacks enough context to act on immediately.

Existing paid code scanning platforms surface findings as reports with severity ratings, but leave patch generation and fix verification to the developer. For teams without dedicated security staff, this means triaging a backlog of uncertain findings without clear remediation steps. The developer who introduced the vulnerability is often not the one who reviews the scanner's output.

how Codex Security solves it

How it solves it#

AI-powered vulnerability scanning with patch generation

Runs a standard or deep scan on a repository, selected paths, or committed Git changes (via `--diff`). After confirming a finding, the tool generates a candidate patch and can verify whether an existing fix resolves the issue. Deep scans repeat standard scans and deduplicate findings across runs.

CLI, SDK, and GitHub Actions support

The `@openai/codex-security` npm package installs as both a global CLI (`cs`) and a local TypeScript SDK. Scans run from the terminal, inside CI via a GitHub Actions workflow with configurable cost limits, or embedded directly in an application or developer tool using the SDK.

Multi-provider AI backend

Scans run against OpenAI inference by default, with direct support for Amazon Bedrock (using AWS credentials, no separate OpenAI login), OpenRouter, Fireworks AI, and Cheaper Inference. Set the provider's API key and choose a supported model; no changes to scan commands are required.

Findings export and issue tracker integration

Completed scans export findings as SARIF, JSON, or CSV for integration with existing security workflows. Findings can be tracked in Linear, Jira, or GitHub directly from the CLI, and scans can be published to Codex Security Cloud when available. ServiceNow Application Vulnerability Response is also supported via a dedicated export guide.

SECURITY.md policy generation and threat model export

The `cs policy` command drafts a new SECURITY.md or updates an existing one, taking component paths and architecture documents as input. It saves its draft outside the repository so changes can be reviewed before copying only the target file. Threat models from scans can be exported independently with `cs export`.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Apache 2.0 license: no per-seat or per-repository feesThe Apache 2.0 license allows running the CLI, SDK, and GitHub Action across any number of repositories for any purpose, including commercial team use, without paying for a seat or a managed service account. Cost is limited to AI inference API usage.
Patch generation and fix verification in one workflowMost commercial SAST tools stop at reporting. Codex Security generates candidate patches and verifies fixes within the same `cs scan` workflow, reducing the gap between a confirmed finding and a deployed fix without a separate remediation product.
Multiple AI provider options, including AWS BedrockScans are not locked to OpenAI infrastructure. Teams using Amazon Bedrock can point Codex Security at their own AWS credentials and keep code and findings within their existing cloud boundary. OpenRouter, Fireworks AI, and Cheaper Inference are also supported.
Containerized bulk scans for multi-repo campaignsThe included Docker Compose configuration keeps results and authentication between runs for scanning a list of repositories. A workflow runner can connect to a separately deployed findings service and run individual CLI stages in containers, covering multi-repo security reviews in one resumable campaign.

Trade-offs

-Requires an external AI provider API key for every scanScans depend on AI inference, which means an API key is required at runtime. While Amazon Bedrock, OpenRouter, Fireworks AI, and Cheaper Inference are all supported, the tool does not operate in air-gapped environments or as a fully self-contained static analyzer. Scan costs accumulate with API usage.
-Node.js 22.13.0+ and Python 3.10+ prerequisitesThe CLI requires Node.js within the 22.x, 24.x, or 26.x range and Python 3.10 or later (Python 3.10 also requires the `tomli` package). Teams whose CI environments pin older runtimes will need to update or provision separate containers before adding Codex Security scans.

versus alternatives

Codex Security vs alternatives#

Codex Security vs Snyk

Both tools find vulnerabilities in application code, but they differ in pricing model and what happens after a finding. Snyk is a managed, proprietary SaaS platform; Codex Security is Apache 2.0 licensed and runs from your own environment.

Feature	Codex Security	Snyk
License	Apache-2.0	Proprietary
Self-hosting	Yes (CLI + SDK)	No (managed SaaS)
AI inference	OpenAI, Bedrock, OpenRouter, others	Snyk's own AI
Patch generation	Yes	Not in free tier
Pricing	AI API costs only	Per-seat subscription

Codex Security suits teams that want AI-powered vulnerability detection without per-seat subscription fees. Its patch generation and fix verification run in the same workflow, while Snyk's free tier reports findings without generating patches. Snyk is the stronger fit for teams that need dependency scanning (open source packages and containers) alongside code analysis, as Codex Security focuses on application code rather than package manifests.

Codex Security vs Semgrep Pro

Semgrep Pro uses a rule-based SAST engine with AI-assisted rule authoring and PR-native feedback; Codex Security uses AI inference directly for each scan rather than a fixed rule set.

Feature	Codex Security	Semgrep Pro
License	Apache-2.0	Proprietary
Self-hosting	Yes	No (managed)
Analysis approach	AI inference per scan	Static rules + AI suggestions
Patch generation	Yes	Limited
CI integration	GitHub Actions, CLI	Native PR checks

Codex Security works well when the codebase changes rapidly and rule maintenance would be expensive. Semgrep Pro's rule-based approach produces more consistent results for known vulnerability classes and delivers lower false-positive rates from its curated rule library. Teams that need low false-positive SAST for a known language set, with PR-native feedback on every push, may find Semgrep Pro the better fit.

Codex Security vs GitHub Advanced Security

GitHub Advanced Security uses CodeQL for code scanning alongside secret scanning and dependency review. It integrates natively with GitHub repositories and CI.

Codex Security is the better choice when you want AI-generated patches alongside findings, need to scan repositories on providers other than GitHub, or want an Apache 2.0 tool that runs outside GitHub's platform. GitHub Advanced Security is the natural fit for GitHub-hosted repositories where secret scanning and dependency review are as important as code scanning, and where native GitHub integration is preferred over a separate CLI install.

install · quick start

Quick start#

bash

Install the CLI globally with npm (requires Node.js 22.13.0+ and Python 3.10+), then sign in and run your first scan.

```bash
npm install --global @openai/codex-security
cs login
cs scan .
```

tech stack · detected from GitHub

What it's built on#

Languages: JavaScriptPythonTypeScript
Runtimes: Node.js
Tooling: esbuildnpm

frequently asked

FAQ#

Does Codex Security require an OpenAI account to run scans?

Yes: scans require either an OPENAI_API_KEY or CODEX_API_KEY for OpenAI inference, or credentials for one of the supported alternative providers: Amazon Bedrock, OpenRouter, Fireworks AI, or Cheaper Inference. Bedrock uses standard AWS credentials and does not require an OpenAI account. There is no fully offline mode; AI inference is required at scan time.

How does Codex Security differ from the Codex AI coding assistant?

Codex Security is a separate tool for finding and fixing vulnerabilities in existing application code. It runs as a CLI, TypeScript SDK, or Codex plugin and uses AI inference for security analysis. The Codex coding assistant and Codex Security are related products from OpenAI but serve different purposes; Codex Security is specifically for security scanning, not general-purpose code generation.

How do I run Codex Security in a CI pipeline?

The README includes a GitHub Actions workflow example that runs scheduled repository scans. Add an OpenAI API key as the CODEX_SECURITY_API_KEY repository secret, copy the example workflow from github-action/examples/repository.yml to .github/workflows/codex-security.yml, replace the reviewed commit SHA, and trigger it manually or on schedule. The CLI also reads OPENAI_API_KEY or CODEX_API_KEY from the environment for other CI providers.

Can Codex Security export findings for use in other security tools?

Yes. Completed scans export as SARIF, JSON, or CSV using the cs export command. SARIF output is accepted by GitHub Advanced Security, most CI systems, and security management platforms. Findings can also be tracked in Linear, Jira, or GitHub through the CLI's integration workflows. For ServiceNow Application Vulnerability Response, the docs include a dedicated export guide.

What is a deep scan and how does it differ from a standard scan?

Deep scans repeat standard scans and deduplicate their findings across runs, returning a combined set of results. Use cs scan . --mode deep to run one. The README also documents --max-time for setting an advisory time allowance; deep scans have their own time limits documented in the CLI reference. For most repositories, a standard scan is sufficient for a first review.

also worth a look

Similar open-source tools#

ship-safe

Alternative toSnyk

Security scanner for AI agents, MCP servers, and LLM codebases.

872 GitHub stars
Licence MIT

Sandchest

Alternative toSnyk

AI code security reviewer using abliterated, unrestricted models

57 GitHub stars
Licence AGPL-3.0

Shannon

Alternative toXBOW

Autonomous AI pentester for web apps and APIs, AGPL-licensed

51,664 GitHub stars
Licence AGPL-3.0

security-audit-skill

Alternative toSnyk

Multi-phase security audits with machine-readable findings

65,109 GitHub stars
Licence MIT

strix

Alternative toXBOW

Autonomous AI pentesting with proof-of-exploit and auto-fix PRs.

74,914 GitHub stars
Licence Apache-2.0

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

450,612 GitHub stars
Licence MIT

by category

Open source tools in these categories#

183

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,987 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

7,869 GitHub stars
Licence Apache-2.0
#AI Agents

SnitchFeed

Live monitoring on LinkedIn, X, Reddit & more. Agentic social listening for startups.

Marketing & Growth

Advertise your product

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Codex Security vs Snyk

Feature	Codex Security	Snyk
License	Apache-2.0	Proprietary
Self-hosting	Yes (CLI + SDK)	No (managed SaaS)
AI inference	OpenAI, Bedrock, OpenRouter, others	Snyk's own AI
Patch generation	Yes	Not in free tier
Pricing	AI API costs only	Per-seat subscription

Codex Security vs Semgrep Pro

Semgrep Pro uses a rule-based SAST engine with AI-assisted rule authoring and PR-native feedback; Codex Security uses AI inference directly for each scan rather than a fixed rule set.

Feature	Codex Security	Semgrep Pro
License	Apache-2.0	Proprietary
Self-hosting	Yes	No (managed)
Analysis approach	AI inference per scan	Static rules + AI suggestions
Patch generation	Yes	Limited
CI integration	GitHub Actions, CLI	Native PR checks

Codex Security vs GitHub Advanced Security

GitHub Advanced Security uses CodeQL for code scanning alongside secret scanning and dependency review. It integrates natively with GitHub repositories and CI.

Who Codex Security is for#

Security engineers triaging findings across repositories

Skip if:

Development teams adding security checks to CI

Skip if:

Developers verifying fixes before merging a pull request

Skip if:

The problem it solves#

How it solves it#

AI-powered vulnerability scanning with patch generation

CLI, SDK, and GitHub Actions support

Multi-provider AI backend

Findings export and issue tracker integration

SECURITY.md policy generation and threat model export

Strengths and trade-offs#

Strengths

Trade-offs

Codex Security vs alternatives#

Codex Security vs Snyk

Codex Security vs Semgrep Pro

Codex Security vs GitHub Advanced Security

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Developer Tools

AI & Machine Learning

Find open source alternatives to paid software

Who Codex Security is for#

Security engineers triaging findings across repositories

Skip if:

Development teams adding security checks to CI

Skip if:

Developers verifying fixes before merging a pull request

Skip if:

The problem it solves#

How it solves it#

AI-powered vulnerability scanning with patch generation

CLI, SDK, and GitHub Actions support

Multi-provider AI backend

Findings export and issue tracker integration

SECURITY.md policy generation and threat model export

Strengths and trade-offs#

Strengths

Trade-offs

Codex Security vs alternatives#

Codex Security vs Snyk

Codex Security vs Semgrep Pro

Codex Security vs GitHub Advanced Security

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Security & Monitoring

Developer Tools

AI & Machine Learning

Find open source alternatives to paid software