---
schema_version: "newruntime-agent-readable-v0.2"
type: "post"
stable_id: "post:codex-security-cli-scan-workbench"
slug: "codex-security-cli-scan-workbench"
title: "Codex Security CLI Turns Security Review Into a Scannable Workbench"
description: "OpenAI's Codex Security CLI packages repository, diff, working-tree, export, validation, and patch flows into a security-review workbench rather than a single scanner command."
retrieval_nugget: "OpenAI's Codex Security CLI packages repository, diff, working-tree, export, validation, and patch flows into a security-review workbench rather than a single scanner command. OpenAI's Codex Security CLI is easy to misread as \"Codex, but for security.\" The useful signal is narrower and more operational: security review is being packaged as a workbench around source code, scan history, validation, patching, and."
status: "published"
published_at: "2026-07-29"
updated_at: "2026-07-29"
record_date: "2026-07-29"
date_kind: "published_at"
topics: ["security","coding-agents","developer-tools","codex"]
source_urls: ["https://x.com/OpenAI/status/2082263717916586117","https://www.npmjs.com/package/@openai/codex-security","https://github.com/openai/codex-security"]
visuals: [{"id":"codex-security-cli-scan-workbench-nano-banana","kind":"editorial-diagram","role":"hero","src":"https://newruntime.com/images/posts/codex-security-cli-scan-workbench-nano-banana.webp","alt":"Hand-drawn security workbench diagram showing a repository and diff entering Codex Security scan, then findings moving through patch, export, and CI review gates.","caption":"Codex Security is most interesting as a review workbench: scan, compare, validate, patch, export, and gate the result.","credit":"New Runtime synthesis from public source inspection","source_url":"https://www.npmjs.com/package/@openai/codex-security","generated_with":"nano-banana-style-imagegen","width":1600,"height":900,"legend":[{"label":"Repo/diff","description":"The CLI can scope scans to repositories, paths, committed diffs, or the working tree."},{"label":"Findings","description":"Results can include source excerpts, vulnerability details, and reproduction steps."},{"label":"Export gate","description":"CSV, JSON, and SARIF exports let the scan become CI and audit infrastructure."}]}]
routes: {"html":"https://newruntime.com/posts/codex-security-cli-scan-workbench/","markdown":"https://newruntime.com/posts/codex-security-cli-scan-workbench.md","json":"https://newruntime.com/posts/codex-security-cli-scan-workbench.json"}
source_format: "markdown"
---

# Codex Security CLI Turns Security Review Into a Scannable Workbench

## Retrieval answer

OpenAI's Codex Security CLI packages repository, diff, working-tree, export, validation, and patch flows into a security-review workbench rather than a single scanner command. OpenAI's Codex Security CLI is easy to misread as "Codex, but for security." The useful signal is narrower and more operational: security review is being packaged as a workbench around source code, scan history, validation, patching, and.

OpenAI's Codex Security CLI is easy to misread as "Codex, but for security." The useful signal is narrower and more operational: security review is being packaged as a workbench around source code, scan history, validation, patching, and machine-readable export.

The npm and GitHub pages describe `@openai/codex-security` as both a TypeScript SDK and a CLI. It can scan a whole repository, selected paths, committed diffs, or the current working tree. It has preflight checks, progress events for long-running scans, scan history, reruns, matching between scans, comparison of resolved and persisting findings, CSV/JSON/SARIF export, and CI severity gates.

That means the important unit is not a one-off model answer. It is a repeatable review loop:

- choose the repository, path, diff, or working tree;
- run a scan with bounded output outside the repository;
- inspect findings with source excerpts, vulnerability details, and reproduction steps;
- validate or patch a candidate finding;
- export the sealed result into SARIF, CSV, or JSON;
- let CI fail on the severity threshold instead of treating the scan as advice.

## Why does this matter?

Security agents need a different product shape from ordinary coding assistants. A useful system has to preserve evidence, compare scans over time, keep artifacts out of the source tree, expose policy exits, and avoid confusing incomplete coverage with a passing result.

Codex Security's CLI surface points in that direction. It turns the model into one component inside a security-review harness.

## New Runtime Read

The durable pattern is "agent output becomes review infrastructure." The model can search for vulnerabilities, but the product value comes from scoping, cost caps, audit artifacts, reruns, matching, CI behavior, and export formats that another tool can trust.

For agent builders, this is the same lesson as with coding harnesses: the agent is only useful when its work can be inspected, repeated, compared, and promoted through deterministic gates.