Skip to main content

OpenAI's New CLI Tool Spots Code Vulnerabilities Before They Become Problems

OpenAI has released a new open-source tool that puts security review right where developers live: the command line. Called Codex Security CLI, it scans code repositories for vulnerabilities and integrates directly into continuous integration and continuous delivery (CI/CD) pipelines. The goal? Catch security issues before they ever make it into production.

The tool was actually spotted before its official announcement, but OpenAI has now confirmed it's an early version that will evolve based on developer feedback. Under the hood, it's a TypeScript SDK with a command-line interface. Developers can run it in the terminal to scan repositories, view code changes, track security issues across multiple runs, and even verify whether a vulnerability has been fixed.

Image

Once integrated into CI/CD, every build automatically runs a security check. If a vulnerability is found, the pipeline can block the merge until it's resolved. The learning curve is low: install the @openai/codex-security package via npm, run npx codex-security to see help, log in, and scan the current directory. The security status of the repository becomes clear in moments.

Before running, your machine needs Node.js 22 or higher, Python 3.10 or higher, and access to Codex Security. In a CI environment, no manual login is required—just set the OPENAIAPIKEY environment variable, and authentication happens automatically. The tool also supports ChatGPT account login and API key methods, with parameters to specify which path to take. If you want to call it directly in a TypeScript project, the SDK provides an interface, and after scanning you get the report path back.

Each scan's trace is stored in the Codex Security working directory. If the default path isn't writable, you can use the CODEXSECURITYSTATE_DIR variable to specify another directory. The code is now on GitHub at openai/codex-security, open to anyone who wants to run a code health check.

When security checks shift from manual spot checks to a single command-line instruction, the most easily overlooked defense line in the software supply chain gets moved forward. It's a small step for a developer, but a giant leap for code security.

Key Points

  • OpenAI open-sourced Codex Security CLI on July 29, 2026.
  • Integrates into CI/CD pipelines to automatically scan for vulnerabilities before code merges.
  • Requires Node.js 22+, Python 3.10+, and an OpenAI API key (or ChatGPT login).
  • Supports npm installation and can be used in TypeScript projects via SDK.
  • Early version—features will be refined based on developer feedback.