Codex Security
An AI security scanner with a local CLI and Docker workflows. Uses OpenAI, Bedrock, OpenRouter or Fireworks AI for analysis; licensed under Apache 2.0.
Codex Security is a locally run vulnerability scanner for developers and security teams, available as a CLI and TypeScript SDK. It can run on your machine, in CI or in containers, but sends AI analysis requests to a cloud model provider. Scans require provider credentials and an internet connection.
It scans whole repositories, selected paths or Git changes. Deeper scans use parallel discovery workers to investigate repositories and selected paths. Beyond identifying suspected vulnerabilities, it can validate findings, propose patches and check fixes already present in the code.
Saved results support review and triage: you can inspect findings, identify duplicates, judge severity against your own rubric and get owner suggestions based on source code and Git history. The scanner also drafts SECURITY.md guidance and saves threat models for later review or export.
For existing security workflows, it imports GitHub code scanning alerts, exports SARIF, JSON or CSV, and publishes findings to Linear. Its GitHub Action supports scheduled and pull request scans and reports findings by default. Docker Compose supports scanning multiple repositories while retaining results and authentication between runs.
The software is open source under Apache 2.0 and requires Node.js and Python. Supported analysis providers are OpenAI, Amazon Bedrock, OpenRouter and Fireworks AI. Bedrock uses AWS credentials without a separate OpenAI login. Some cybersecurity requests and protected findings require Trusted Access for Cyber approval.
