codex-security Codex Plugin
Codex PluginCodexSecuritySecurity, Auth & ComplianceCode Quality, Review & TestingClaude Code Customization & WorkflowThe explanation below is AI-generated. Please verify it against the sources.
codex-security is an OpenAI-authored Codex plugin that packages workflows for scanning, reviewing, and investigating security issues in code and diffs. According to its plugin manifest, it supports tasks like running a security scan, reviewing pull-request or branch diffs, triaging existing findings, and applying bounded fixes. The plugin operates within a Codex task and can also connect to Codex Security cloud, a separate research-preview service described on the homepage that scans connected GitHub repositories commit by commit. The plugin exposes interactive read/write capabilities and ships with its own skills, an app definition, and an MCP server configuration. No specific scanning engine or vulnerability database is named in the sources.
About the service
Codex Security cloud, mentioned alongside the plugin on the homepage, is a research-preview service that connects to GitHub repositories through Codex cloud. It builds a repository-specific threat model, checks code against that context, validates high-signal findings in an isolated environment, and surfaces ranked results with suggested fixes reviewable in GitHub.
What you can do with codex-security
- Run a security scan across a repository or a scoped folder
- Run a deeper, more comprehensive scan when more time is available
- Review code changes in a pull request, commit, or branch diff before merging
- Triage a backlog of existing security findings
- Apply and verify bounded patches for approved findings