{"id":"openai.com/codex","name":"OpenAI Codex CLI","commands":["codex"],"examples":[{"run":"codex","does":"Start an interactive session; first run asks you to sign in with ChatGPT"},{"run":"codex exec \"<task>\"","does":"Run a task non-interactively, for scripts and CI"},{"run":"codex resume","does":"Resume a saved conversation"}],"description":"Lightweight coding agent from OpenAI that runs in the terminal.","homepage":"https://developers.openai.com/codex/cli","repository":"https://github.com/openai/codex","license":"Apache-2.0","agentic":true,"latest_version":"0.162.1","vendor":"OpenAI","install":"curl -fsSL https://chatgpt.com/codex/install.sh | sh","publisher":"third-party","w3bs":"w3bs install openai.com/codex","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":7801,"summary":{"critical":1,"high":13,"medium":3,"low":200,"info":0},"malware":0,"truncated":true,"version":"0.162.1","sources":{"installer":"https://chatgpt.com/codex/install.sh","installerSha256":"44ac252c1b9a68c02bdf0de8e1c6cbfde36fc1afa8684624962eae7d4c461e70","repository":"github.com/openai/codex","commit":"62d650d5278ad1cf000e5050ca5bec6a26068b9a"},"notes":[],"scannedAt":"2026-11-03T10:50:03.450Z","findings":[{"ruleId":"secret-private-key","title":"Private Key","severity":"critical","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":3047,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/.github/scripts/macos-signing/notarize_with_akv.py","line":260,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/.github/scripts/macos-signing/notarize_with_akv.py","line":373,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/.github/scripts/macos-signing/notarize_with_akv.py","line":405,"malware":false},{"ruleId":"tls-verification-disabled","title":"TLS certificate verification disabled","severity":"high","category":"code","cwe":"CWE-295","file":"source/.github/scripts/publish_r2_release.py","line":433,"malware":false},{"ruleId":"sensitive-file-committed","title":"Sensitive file","severity":"high","category":"file","cwe":"CWE-538","file":"source/codex-rs/http-client/tests/fixtures/test-ca-trusted.pem","line":1,"malware":false},{"ruleId":"sensitive-file-committed","title":"Sensitive file","severity":"high","category":"file","cwe":"CWE-538","file":"source/codex-rs/http-client/tests/fixtures/test-ca.pem","line":1,"malware":false},{"ruleId":"sensitive-file-committed","title":"Sensitive file","severity":"high","category":"file","cwe":"CWE-538","file":"source/codex-rs/http-client/tests/fixtures/test-intermediate.pem","line":1,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/bedrock_api_key_tests.rs","line":42,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/codex-rs/model-provider/src/provider_tests.rs","line":118,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/scripts/codex_package/dotslash.py","line":172,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/sdk/python/_runtime_setup.py","line":163,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/sdk/python/_runtime_setup.py","line":191,"malware":false},{"ruleId":"py-ssrf-outbound-request","title":"outbound request to a non-constant URL","severity":"high","category":"code","cwe":"CWE-918","file":"source/sdk/python/_runtime_setup.py","line":223,"malware":false},{"ruleId":"secret-jwt","title":"JSON Web Token","severity":"medium","category":"secret","cwe":"CWE-798","file":"source/codex-rs/model-provider/src/auth_tests.rs","line":31,"malware":false},{"ruleId":"sh-unquoted-expansion-destructive","title":"unquoted expansion in a destructive command","severity":"medium","category":"code","cwe":"CWE-78","file":"source/scripts/test-remote-env.sh","line":76,"malware":false},{"ruleId":"sh-eval-expansion","title":"eval on an expanded string","severity":"medium","category":"code","cwe":"CWE-78","file":"source/scripts/test-remote-env.sh","line":141,"malware":false},{"ruleId":"secret-private-key","title":"Private Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/agent-identity/src/lib.rs","line":832,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/analytics/src/client_tests.rs","line":1234,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server-client/src/lib.rs","line":1622,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server-protocol/src/protocol/common.rs","line":3634,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server-protocol/src/protocol/item_builders_tests.rs","line":14,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server-protocol/src/protocol/item_builders_tests.rs","line":14,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server-transport/src/transport/remote_control/tests.rs","line":121,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server-transport/src/transport/remote_control/websocket.rs","line":2074,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server/src/models_refresh_worker_tests.rs","line":257,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server/tests/suite/v2/account.rs","line":1170,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server/tests/suite/v2/account.rs","line":1332,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server/tests/suite/v2/account.rs","line":1564,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs","line":310,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs","line":310,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server/tests/suite/v2/connection_handling_websocket.rs","line":338,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/app-server/tests/suite/v2/gateway_oauth_tests.rs","line":234,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/cli/src/doctor.rs","line":3301,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/cli/src/doctor/desktop/windows_security_tests.rs","line":67,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/cli/src/doctor/output.rs","line":1899,"malware":false},{"ruleId":"secret-aws-access-key","title":"AWS Access Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/cli/src/doctor/output.rs","line":1900,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/cli/tests/exec_server_websocket_auth.rs","line":40,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/cli/tests/exec_server_websocket_auth.rs","line":40,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/cloud-config/src/service_tests.rs","line":996,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/cloud-config/src/service_tests.rs","line":1053,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/codex-mcp/src/connection_manager_tests.rs","line":6981,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/loader/tests.rs","line":266,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/loader/tests.rs","line":351,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/loader/tests.rs","line":1141,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/loader/tests.rs","line":1149,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/mcp_ema_tests.rs","line":287,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/mcp_ema_tests.rs","line":293,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/mcp_ema_tests.rs","line":304,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/mcp_ema_tests.rs","line":319,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/config/src/mcp_types_tests.rs","line":392,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/agent/host/spawn_tests.rs","line":68,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/realtime_conversation_tests.rs","line":50,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/realtime_conversation_tests.rs","line":64,"malware":false},{"ruleId":"secret-github-token","title":"GitHub Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_sandbox_tests.rs","line":77,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":740,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":742,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":744,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":746,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":747,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":750,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":753,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":953,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":1293,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":1348,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":1416,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":1418,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":1420,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":1528,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/shell_snapshot_tests.rs","line":1547,"malware":false},{"ruleId":"secret-github-token","title":"GitHub Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/tools/runtimes/mod_tests.rs","line":773,"malware":false},{"ruleId":"secret-github-token","title":"GitHub Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/tools/runtimes/mod_tests.rs","line":777,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/tools/runtimes/mod_tests.rs","line":822,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/tools/runtimes/mod_tests.rs","line":832,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/tools/runtimes/mod_tests.rs","line":836,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/src/tools/runtimes/mod_tests.rs","line":1259,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/tests/suite/client.rs","line":1530,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/tests/suite/exec_policy.rs","line":701,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/core/tests/suite/scenarios_credential_masking.rs","line":44,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/exec-server/src/environment_toml.rs","line":387,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/exec-server/src/process_sandbox_tests.rs","line":558,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/exec-server/tests/exec_process.rs","line":524,"malware":false},{"ruleId":"secret-jwt","title":"JSON Web Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/exec/tests/suite/apply_patch.rs","line":404,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/ext/guardian-v2/src/async_scorer/sampler_routing_tests.rs","line":232,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/http-client/src/route_aware_client_pool_tests.rs","line":449,"malware":false},{"ruleId":"secret-private-key","title":"Private Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/agent_identity.rs","line":573,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":160,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":161,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":267,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":1255,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":1256,"malware":false},{"ruleId":"secret-openai-key","title":"OpenAI API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":1280,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":1436,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/auth_tests.rs","line":1437,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/manager/workspace_switching_tests.rs","line":42,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/personal_access_token_tests.rs","line":41,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/personal_access_token_tests.rs","line":72,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/storage_policy_tests.rs","line":325,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/storage_policy_tests.rs","line":326,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/codex-rs/login/src/auth/storage_policy_tests.rs","line":419,"malware":false}]}}