Codex Security is OpenAI’s open-source security toolkit — a command-line tool and TypeScript SDK with more than 11,100 stars on GitHub — for finding, validating, and fixing vulnerabilities in your codebase with AI.
Traditional static scanners flood developers with pattern matches, many of them false positives, and stop at detection. Codex Security is built around OpenAI’s Codex models, which read code the way a security reviewer does — following data flow across files and understanding context — so findings are more likely to be real, exploitable issues. Just as importantly, it does not stop at a report: it validates suspected vulnerabilities and can propose fixes, taking a repository from “scan” to “patched” in one workflow. The toolkit ships as a CLI for local and CI use and as a TypeScript SDK (published on npm as @openai/codex-security) for teams that want to embed scanning into their own platforms and pipelines. It is Apache-2.0 licensed, developed in the open by OpenAI, and aimed at application security and DevSecOps workflows where AI-assisted review needs to fit into existing engineering habits rather than replace them.
Codex Security is free and open source under the Apache-2.0 license. Running scans uses your own OpenAI or Codex account access, so any cost is the model usage you choose — the toolkit itself is free.
Application security engineers, platform teams, and developers who want AI-assisted vulnerability review inside their existing workflow — especially teams tired of triaging noisy scanner output by hand.