On July 29, OpenAI launched a security magnifying glass for code repositories. This open-source command-line tool, called Codex Security CLI, has a straightforward mission—it helps developers scan code repositories, identify and verify security vulnerabilities, and integrate this check directly into the continuous integration and continuous delivery (CI/CD) pipeline.

Interestingly, the tool was already discovered before its official release. OpenAI says it is currently an early version and will continue to refine its features based on developer feedback. It has a command-line interface, and behind it is a TypeScript SDK. Developers can use it to scan repositories in the terminal, view code changes, track security issues across execution cycles, and even verify whether vulnerabilities have been fixed.

image.png

Once integrated into the CI/CD process, software projects under continuous development can automatically run security checks during each build, blocking potential risks before they are merged. The learning curve is low: developers can install the @openai/codex-security package via npm, run the npx command to bring up the help, then log in and scan the current directory step by step. The security status of the repository will then become clear.

Before running, the machine needs to have several things ready—Node.js 22 or higher, Python 3.10 or higher, and access rights to Codex Security. In a CI environment, no manual login is required; just set the OPENAI_API_KEY environment variable, and identity verification will be automatic. The tool also supports both ChatGPT account login and API key authentication methods, with parameters used to specify which path to take. If you want to call it directly in a TypeScript project, the official SDK also provides an interface, and after scanning, you can get the report path back.

Each scan's trace is stored in the Codex Security working directory. If the default path cannot be written, developers can use the CODEX_SECURITY_STATE_DIR variable to specify another writable directory. The code is now hosted on GitHub at openai/codex-security, open to anyone who wants to conduct a code health check. When security checks shift from manual spot checks to a single command-line instruction, the most easily overlooked defense line in the software supply chain is being quietly moved forward.