ChatGPT / Codex
OpenAI's Codex coding agent with an agentic diff/PR reviewer plus a separate Codex Security scanning agent (CLI, SDK, cloud).
Deployment
Cloud · Self-Hosted
Languages
Any (no fixed list)
Pricing model
Per developer seat, Usage-based credits
Free plan
Yes
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle ChatGPT / Codex operates.
5 yes 2 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Partial | /review runs on demand in the IDE extension and desktop app; no as-you-type analysis documented. |
| AI Agent Guardrails | Yes | Auto-review reviewer agent vets escalated tool calls for exfiltration, credential probing and destructive actions. |
| Local Analysis (Pre-Commit) | Yes | codex-security install-hook adds a pre-commit scan blocking high-severity findings. |
| Inline PR Comments | Yes | '@codex review' or automatic reviews post standard GitHub reviews; only P0 and P1 issues are surfaced. |
| Quality Gates (Merge Blocking) | Yes | Codex Security --fail-on-severity fails the CI step; Codex Action can gate merges. |
| Full Repo Scan | Yes | Codex Security scans full repos, selected paths, or org-wide bulk campaigns. |
| Scheduled Rescans | Partial | Codex Security cloud scans connected repos commit by commit; no cron scheduling documented. |
| Runtime Monitoring | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Security scanning
1 yes 1 partial 11 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Codex Security agent finds, validates and reports vulnerabilities with SARIF export. |
| Taint Analysis (Data-Flow) | Partial | Cloud finding pages show call-path and data-flow context 'when available'; no taint engine. |
| Secrets Detection | No | Not documented on vendor docs (security overview, FAQ, CLI reference) as of 2026-08-25. |
| Secrets Validation | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| SCA | No | Not documented on vendor docs as of 2026-08-25; incident-audit use case is reactive, not a scanner. |
| Reachability Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Malicious Package Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| License Compliance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| SBOM Generation | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| IaC Scanning | No | Not documented on vendor docs (security overview, FAQ, CLI reference) as of 2026-08-25. |
| Container Scanning | No | Not documented on vendor docs (security overview, FAQ, CLI reference) as of 2026-08-25. |
| CSPM | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| DAST | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
Code quality
1 yes 8 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | Reviewer reports prioritized findings, but docs direct mechanical formatting and lint checks to CI instead. |
| Complexity Metrics | No | Not documented on vendor docs (code review, GitHub integration) as of 2026-08-25. |
| Duplication Detection | No | Not documented on vendor docs (code review, GitHub integration) as of 2026-08-25. |
| Dead Code Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Test Coverage Tracking | No | Not documented on vendor docs (code review, GitHub integration) as of 2026-08-25. |
| Diff Coverage (New Code) | No | Not documented on vendor docs (code review, GitHub integration) as of 2026-08-25. |
| Architecture Governance | No | Not documented on vendor docs (code review, GitHub integration) as of 2026-08-25. |
| Technical Debt Quantification | No | Not documented on vendor docs (code review, GitHub integration) as of 2026-08-25. |
| Behavioral Code Analysis | No | Not documented on vendor docs (code review, GitHub integration) as of 2026-08-25. |
AI review & fixes
4 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Yes | Agentic reviewer reads a selected diff and reports prioritized actionable findings without changing the working tree. |
| PR Summaries & Walkthroughs | No | Not documented; docs state reviews surface only P0/P1 issues, no summary or walkthrough. |
| Autofix Suggestions | Yes | Findings carry remediation guidance; '@codex fix the P1 issue' starts a cloud chat with PR context. |
| Autofix Pull Requests | Yes | Codex can push a fix to the PR branch with permission; a PR can be opened from a finding page. |
| AI Triage (False-Positive Filtering) | Yes | Cloud validates findings in isolation before surfacing; CLI accepts false-positive marks. |
Rules & repo support
2 yes
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | Nested AGENTS.md '## Code Review Rules', custom review instructions, --scan-prompt-file, knowledge-base docs. |
| Monorepo Support | Yes | Nested per-service AGENTS.md rules and path-based severity overrides; review pane also handles multi-repo projects. |
AI capabilities
4 yes 2 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | Review and scanning are agentic Codex runs; Codex Security defaults to gpt-5.6-sol at xhigh reasoning effort. |
| Bring Your Own Model | Yes | Runs against OpenAI API, Amazon Bedrock, OpenRouter or Fireworks; review_model overrides the review model. |
| MCP Server | Partial | Codex consumes MCP servers (e.g. Linear); no MCP server exposing review or scan findings documented. |
| AI Code Governance | No | No AI-generated-code inventory; opt-in OpenTelemetry logs prompts, approvals and tool results instead. |
| Conversational Review | Yes | Line-scoped inline comments plus follow-up turns; any '@codex' mention starts a cloud chat with PR context. |
| Learning From Feedback | Partial | False-positive marks are 'considered but re-checked'; editing the threat model changes future scan prioritization only. |
| Code Excluded From Training | Yes | Business and Enterprise business data is not trained on by default; not covered on Plus. |
Models used
GPT-5.6 Sol (gpt-5.6-sol)GPT-5.6 TerraGPT-5.6 LunaGPT-5.5GPT-5.4GPT-5.4 miniGPT-5.3-Codex-SparkGPT-Daybreak-BlueGPT-Daybreak-Redanthropic/claude-sonnet-4.5 (runnable via OpenRouter in the Codex Security scan runtime)
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | ChatGPT Enterprise supports audit logging; Compliance API adds an append-only log stream for SIEM. |
| SSO (SAML) | Yes | SAML SSO and MFA are listed as included in the Business plan on the pricing page. |
| Role-Based Access Control | Yes | Workspace-level access controls, admin toggles, per-repo review preferences, allow-users/allow-bots in CI. |
| Compliance Reporting & Exports | Yes | Compliance API serves audit, legal, governance and e-discovery workflows; SARIF export of scan findings. |
Certifications
SOC 2 Type 2ISO 27001ISO 27017ISO 27018ISO 27701ISO 42001PCI DSSCSA STAR Level 1FedRAMP 20xTX-RAMP
Standards mapping
GDPRCCPAHIPAA (via BAA, not organizational cert)FERPA
Integrations
2 yes 5 partial 3 no
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Partial |
| GitLab | Partial |
| GitLab Self-Managed | Partial |
| Bitbucket | No |
| Bitbucket Data Center | No |
| Azure DevOps | No |
| API & CLI | Availability |
|---|---|
| REST API | Partial |
| CLI | Yes |
| Webhooks | Partial |
CI/CD systems
GitHub ActionsGitLab CI/CD
IDEs
VS Code
Issue trackers
Linear
Chat & notifications
Slack
Languages
Not limited to a fixed list: ChatGPT / Codex works with any language its underlying model can read.
Pricing & plans
$20/user/month billed annually ($25/user/month if billed monthly)
Minimum seats: 2
Trial: No permanent free trial. Limited options: student/teacher offers, referral, mobile app pop-ups (all require credit card).
Free$0/monthGeneral ChatGPT users
- Limited general ChatGPT access
- No Codex code review
- Image generation not available
Go$8/monthIndividuals who need more usage than Free for lightweight coding tasks
- Codex for lightweight coding tasks
- Everything in Free, plus more messages with tools
- No Security Review
- No cloud-based integrations (automatic code review, Slack) documented for this tier
Plus$20/monthIndividual developers
- Codex cloud chats
- Local messages and cloud chats per rate-limit table
- Slack integration
- Referral program with banked rate-limit resets
- Security Review NOT available on Plus
- Message-based usage limits
Pro (5x)$100/monthHeavy individual Codex users
- Codex cloud chats
- Higher local-message ceilings than Plus
- Security Review available
- 1-2.5 hrs ChatGPT Voice/desktop allowance
- Codex task budget applies
Pro (20x)$200/monthHighest-volume individual users
- Highest local-message ceilings
- Security Review available
- Unlimited ChatGPT Voice access
- Codex task budget still applies
Business$25/user/month billed monthlyTeams of 2+
- Codex cloud chats
- Linear and Slack integrations
- Security Review available
- Admin controls for cloud chats and Slack posting
- 2+ users required
- Same per-seat usage limits as Plus unless on flexible pricing
EnterpriseNot priced (flexible/credit-based; contact sales)Large organizations
- Full feature set including Security Review
- Compliance API and append-only log stream
- Admin governance and managed configuration
- No training on business data by default
- Per-enterprise guardian_policy_config for the auto-review reviewer
- Quote-only
- No compliance certifications named in OpenAI's documentation
- HIPAA/BAA and residency coverage explicitly 'not universal'
- A legacy rate card still applies to a small subset of Enterprise customers
EduNot priced (flexible/credit-based, similar to Enterprise)Educational institutions
- Security Review available
- Same integrations as Enterprise/Business
- Compliance API access
- Same per-seat usage limits as Plus unless on flexible pricing
- Quote-only
API key (pay-as-you-go)Usage-based standard OpenAI API ratesCI and programmatic use
- Local messages billed by usage
- Codex Action proxy via OPENAI_API_KEY
- Codex Security CLI auth in CI
- Cloud chats NOT available
- Code Reviews NOT available
- ChatGPT Voice in Desktop not available
Who it's for
Best for teams already using OpenAI's coding agent that want code review and security review in the same product.
A good fit if
- Your pull requests are on GitHub
- You want security findings validated in an isolated environment before you see them, with evidence and an attack path
- You want review rules kept in version-controlled AGENTS.md files
Consider alternatives if
- You need pull request review on GitLab, Bitbucket or Azure DevOps
- You need dependency, secrets or IaC scanning
- You need predictable review costs, since usage is billed from shared credits
Similar tools
Other AI Coding Agent tools in the directory.
FAQ
When should you choose ChatGPT / Codex?
ChatGPT / Codex is best for teams already using OpenAI's coding agent that want code review and security review in the same product. It's a good fit if:
- Your pull requests are on GitHub
- You want security findings validated in an isolated environment before you see them, with evidence and an attack path
- You want review rules kept in version-controlled AGENTS.md files
Consider alternatives if:
- You need pull request review on GitLab, Bitbucket or Azure DevOps
- You need dependency, secrets or IaC scanning
- You need predictable review costs, since usage is billed from shared credits
What languages does ChatGPT / Codex support?
ChatGPT / Codex isn't limited to a fixed list of languages. It works with any language its underlying model can read.
What does ChatGPT / Codex integrate with?
ChatGPT / Codex integrates with:
- Source control: GitHub, GitHub Enterprise Server (partial), GitLab (partial) and GitLab Self-Managed (partial)
- CI systems: GitHub Actions and GitLab CI/CD
- IDEs: VS Code
What tools are similar to ChatGPT / Codex?
Other AI coding agents tracked here:
What are ChatGPT / Codex's plans and pricing?
ChatGPT / Codex has a free plan, and paid plans start at $20/user/mo. Enterprise pricing is by quote.
Opens openai.com in a new tab. Review Radar is not affiliated with OpenAI.