CLI · Coding agents · OpenAI
OpenAI Codex CLI
Inspect, change and test a local codebase with a coding agent whose filesystem access and approvals can be configured.
Read access can disclose information. A read-only filesystem does not make a session offline. Scope the project and remove secrets before sharing context with a model.
Understand the tool
What it does.
Codex CLI is the codex program for working with an AI coding agent in a terminal. It can read a repository, edit files and invoke development commands. The CLI is a local interface; a hosted model still receives the context needed for the task unless another supported provider is configured.
Why use it?
Use it when the useful output is a concrete code change or an explanation tied to files. A narrow request, a separate branch and a defined test make the result easier to review. Filesystem sandbox settings and approval rules help define what the agent may do.
A useful fit for
- Repository investigation
- Scoped changes with validation
- Repeatable coding tasks in scripts
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Understand a data path
A new maintainer needs to locate where an imported record is validated.
- Start in the intended repository.
- Ask for the relevant files and unresolved assumptions with read-only access.
- Check the cited paths before planning an edit.
Intended outputA file-based explanation that can guide the next change.
Use case 02
Create a regression fix
A specific input produces the wrong output.
- Provide the input, expected output and existing test command.
- Allow a scoped implementation in a recoverable working branch.
- Review the diff and independently inspect the test result.
Intended outputA proposed patch and validation evidence for the reported behavior.
A concrete starting point
Inspect a project without granting file writes
Replace FEATURE_NAME with a narrow question. Read-only is a filesystem policy; on-request lets the agent request additional approval when needed.
codex --sandbox read-only --ask-for-approval on-request "Explain FEATURE_NAME with file references. Do not edit files."What this can change
Starts a model session and can read project context, send it to the configured provider and save local session state. Approving an escalation can broaden what runs.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- Installed Codex CLI
- An eligible sign-in method or configured API/provider credentials
- An authorized project and its normal development dependencies
- Authentication
- ChatGPT sign-in or another supported credential configuration; account and workspace policies apply.
- Can read
- Files reachable under configured permissions
- Command output and connected tool data
- Can write or change
- Workspace files when allowed
- Local session state; external changes through permitted tools
- Network and data flow
- Configured model provider
- Other endpoints permitted by the environment and approved tools
- Approval and control
- Sandbox policy limits execution access; approval policy controls requests to expand it. These are separate controls.
Check your environment
Compatibility, costs and license.
Compatibility notes
- macOS, Linux and Windows; sandbox implementation depends on platform
- Interactive terminal and non-interactive command workflows
Costs and account requirements
Included usage and additional charges depend on the selected ChatGPT plan or API/provider billing. The open-source CLI license does not include model usage.
Current pricing or plan information ↗Apache-2.0
Applies to the CLI source. Model access and hosted services have separate terms.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Read access can disclose information
A read-only filesystem does not make a session offline. Scope the project and remove secrets before sharing context with a model.
Tool access expands the task
Shell commands, integrations and instruction files can introduce additional actions. Review configuration and keep approval settings aligned with the task.
Where it may fall short
- Source review does not establish coding quality or protection against malicious inputs.
- Tests and review remain necessary even when the agent reports completion.
Observed behavior · 2026-10-18
Runtime and security findings.
The tested alpha CLI rejected an unknown strict-config field and an invalid sandbox value, and stored/read a synthetic MCP definition. No model session or sandboxed command was run.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
Configuration validation is command-specific
The exec path rejected an unknown configuration override; the features subcommand instead rejected the strict-config flag itself. A successful configuration listing alone is not a strict validation check.
In practice: Validate the same launch path used by automation, and keep configuration checks tied to the CLI version.
Observed in this evaluation
Stored MCP configuration is not a connection test
Adding and reading the localhost MCP definition succeeded without credentials or a listening server. Enabled=true reports configuration state, not server reachability or safety.
In practice: Review the server command/URL and credentials, then separately test connection and tool permissions in a disposable workspace.
Version, environment and fixture
- Version or deployment
- 0.162.0-alpha.17.2
- Tested target
- Codex desktop-bundled Windows CLI executable
- Artifact identity
- SHA-256 e98c516f1c8935789aabe9122ee7e05ec4c3efd1ba6acf179242e031c495b99e of the installed executable; this identifies the tested file, not an independent provenance audit.
- Environment and fixture
- Windows 11 x64; Python 3.12.10 harness. Raw timestamps UTC.
- Fresh per-tool home/config/cache; child environment constructed from OS/runtime paths, explicit isolation variables and no inherited credentials. Synthetic fixtures only; no user account sign-in.
- Explicit CODEX_HOME under the fixture; no shared daemon/model session was started.
Checks and results
6 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Installed versionMet expectation
- Method
<user-home>\AppData\Local\OpenAI\Codex\bin\9614f1d9b40d9c4f\codex.exe --version- Expected
- Print the executable version.
- Observed
- Exit 0. codex-cli 0.162.0-alpha.17.2. The initial version probe warned that the fresh CODEX_HOME directory did not exist; the harness created it before subsequent checks.
Empty authentication configurationMet expectation
- Method
codex login status- Expected
- Report not logged in.
- Observed
- Exit 1. Not logged in
Strict configuration validationMet expectation
- Method
codex --strict-config -c ionbin_unknown_setting=true --no-daemon exec --skip-git-repo-check "Return fixture."- Expected
- Reject the unknown ionbin_unknown_setting override before a model session.
- Observed
- Exit 1. Error loading config.toml: unknown configuration field `ionbin_unknown_setting` in -c/--config override
Invalid sandbox modeMet expectation
- Method
codex exec --sandbox invalid "Return fixture."- Expected
- Reject a value outside the supported sandbox modes.
- Observed
- Exit 2. error: invalid value 'invalid' for '--sandbox <SANDBOX_MODE>' [possible values: read-only, workspace-write, danger-full-access] For more information, try '--help'.
Synthetic MCP configuration round tripMet expectation
- Method
codex mcp get ionbin-fixture --json- Expected
- Read the definition previously added by codex mcp add ionbin-fixture --url http://127.0.0.1:1/mcp.
- Observed
- Exit 0. JSON reported name=ionbin-fixture, enabled=true, transport.type=streamable_http and URL=http://127.0.0.1:1/mcp; no server connection was tested.
Strict flag on features subcommandMet expectation
- Method
codex --strict-config -c ionbin_unknown_setting=true features list- Expected
- Determine whether features supports the global strict-config flag.
- Observed
- Exit 1. --strict-config is not supported for codex features. Coverage limitation: use the exec validation path tested separately.
Practical caveats
- This is a desktop-bundled alpha build; results do not establish behavior of a different stable release.
- Sandbox-name validation does not demonstrate filesystem or network enforcement.
What this evaluation does not establish
- Authenticated model requests, generated edits, command approvals and sandbox boundary enforcement.
- MCP connection/authentication/tool calls, plugin trust, prompt injection resistance and cloud sessions.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
An editorial alternative for coding tasks with visible execution controls and a public CLI codebase. Position is not a measured comparison with other agents.
The number is an editorial starting order within the cli tools collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Official CLI, sandbox and approval documentation
- CLI license; local help checked for documented flags
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Codex CLI ↗learn.chatgpt.com
- Sandboxing ↗learn.chatgpt.com
- Agent approvals and security ↗learn.chatgpt.com
- Plans and usage ↗learn.chatgpt.com
- Source and license ↗github.com