OpenAI Codex CLI

OpenAI Codex CLI is an open-source, terminal-native coding agent released by OpenAI on April 16, 2025 under the Apache 2.0 license. It runs locally in your shell, reads files from the working directory, edits code, and executes commands, routing task reasoning through OpenAI's API. The repository lives at github.com/openai/codex and has crossed 74,000 GitHub stars with over 14 million monthly npm downloads as of April 2026. Unlike IDE-embedded assistants such as GitHub Copilot or Cursor, Codex CLI requires no editor plugin and works with any text editor or workflow that runs in a terminal.

The CLI ships with three sandboxed approval modes, Model Context Protocol (MCP) integration with parallel tool call support, an experimental hooks engine for custom session logic, a built-in /review command for automated diff analysis, and cross-session context resumption via codex resume. It was originally written in TypeScript, then rewritten almost entirely in Rust in June 2025, reducing startup time and memory footprint to roughly 80MB. The current default model is GPT-5.5; users can switch to GPT-5.4 (1M token context) or GPT-5.3-Codex mid-session with the /model command. Authentication works through a ChatGPT subscription (Plus, Pro, Business) or a bare OpenAI API key.

What OpenAI Codex CLI actually does in May 2026

Codex CLI operates as a local loop: you describe a task in natural language, the agent reads relevant files in the current directory, plans a sequence of edits and commands, presents or auto-applies changes depending on your approval mode, and iterates until the task completes or you intervene. The loop runs entirely in your terminal, which means it integrates with any CI pipeline, git workflow, or automation script that can invoke a shell command.

Sandboxing is enforced at the operating system level. On Linux, Codex CLI uses bubblewrap with Landlock and seccomp to confine the agent process. On macOS it uses Seatbelt. This is kernel-level process isolation, not an application-layer approval prompt that can be bypassed by the model itself. The default Auto mode allows the agent to read, edit, and run commands within the working directory. Read-only mode lets it browse but requires human confirmation before writing. Full Access grants network access and broader system reach, intended for trusted automation pipelines.

MCP server integration is configured through ~/.codex/config.toml. Codex launches configured servers automatically at session start and, critically, issues eligible tool calls in parallel rather than sequentially. OpenAI's internal testing shows this cuts wall time by roughly 50% on multi-tool sessions (58 seconds serial vs. 31 seconds parallel). The CLI also reads AGENTS.md configuration files, the same open standard used by Cursor and Aider, which means teams with existing per-project context files do not need to maintain a separate config for Codex.

Additional commands worth knowing: codex exec runs the agent non-interactively for automation, /review spins up a second Codex agent to analyze a diff before committing, and codex resume reopens a prior session with its context intact. The Rust-based binary installs via npm (npm install -g @openai/codex), Homebrew, or direct binary download from GitHub Releases, and runs on macOS and Linux across both x86_64 and arm64.

Where Codex CLI sits versus Aider and Claude Code

Aider is the older, more mature terminal coding agent in this category. Launched in 2023, it is written in Python and is model-agnostic: it connects to OpenAI, Anthropic, Google, or any locally hosted model through a common interface. Aider's design is fundamentally git-centric. Every edit it makes is committed automatically, every session can be reviewed as a branch, and the entire workflow is oriented around diff review. Pawel Jozefiak, writing in a 2026 comparison of CLI coding agents, noted that Aider demonstrates "the git-first philosophy" as a distinct advantage: "It's more like having a disciplined pair programmer who never skips a commit." Aider uses roughly 4.2x fewer tokens per task than heavier agents, making it more cost-efficient for repetitive edits. What Codex CLI has that Aider does not: OS-level process sandboxing, native parallel MCP tool calls, and a desktop app. What Aider has that Codex CLI does not: model flexibility, provider independence, and a more mature plugin ecosystem built over three years.

Claude Code is Anthropic's competing terminal agent and the most direct comparison. Claude Code also runs locally, also reads the filesystem, and also ships as an npm package. The mechanical differences matter. Claude Code uses application-layer hooks (26 lifecycle events) rather than OS-level process isolation. Codex CLI's Landlock/seccomp/Seatbelt enforcement is stricter. On the other side, Claude Code benchmarks higher on Terminal-Bench 2.0: 92.1% versus Codex CLI's 77.3% with GPT-5.3-Codex. Claude Code uses CLAUDE.md configuration files with a layered context-sensing hierarchy; Codex CLI uses AGENTS.md, which is an open standard that Cursor and Aider also read, reducing per-team configuration duplication. Cost model differs: Claude Code bills purely per token through the Anthropic API. Codex CLI can be bundled into an existing ChatGPT subscription, which is cheaper for developers already paying for Plus or Pro. Claude Code's Opus 4.7 exposes 1M token context at standard pricing; Codex CLI's GPT-5.4 also reaches 1M tokens but requires switching from the default GPT-5.5.

A direct security comparison from Blake Crosley's 2026 analysis found that in a FastAPI code review test, Opus 4.7 identified a timing side-channel vulnerability in password comparison while Codex missed it, but Codex caught an SSRF vector that Claude Code approved. Each tool has blind spots the other catches, which has led some teams to run both tools on the same diff before merging.

What the agent loop reality looks like

For contained, single-step tasks, Codex CLI performs well. OpenAI employee avital described landing "7 small-to-medium-size pull requests before lunch" by using the parallel execution model: fire off multiple tasks on separate feature branches, let them run, review the PRs. swyx noted from early testing that Codex supports "60 concurrent instances per hour" compared to Devin's 5 or Cursor's 1, which changes the economics of bulk task execution entirely.

The friction appears at step three or four of a multi-step chain. Multiple developers testing in 2025 and 2026 found that Codex CLI loses coherence when tasks have interdependencies that accumulate over a longer session. Jozefiak's comparative testing: "it's cold..it doesn't feel like it's building toward something the way Claude Code does." An April 2025 HN user, gklitt, tested Codex on their production codebase on launch day and found that "it hallucinated a bunch of stuff that wasn't in the code and completely misrepresented the architecture," inventing REST API backends that the application did not have. CSMastermind summarized a common frustration: "Anything that requires a bit of critical thought gets completely lost.. it's like a bad junior engineer" that "creates technical debt pretty quickly without supervision."

Rate limits are a real operational concern. On the Plus tier ($20/month), the rolling 5-hour limit burns through faster than most users expect. After OpenAI updated the limit calculation on April 9, 2026, the community forum saw significant complaints. Sasha123 wrote: "After 5h limit change I can do approx 10x-15x less of what I was doing just a week ago." milesdr reported: "7 prompts used my entire 5 hour limit, in 10 minutes." Heavy use effectively requires Pro at $200/month. This puts the real cost of Codex CLI roughly in line with what Claude Code costs for API-heavy workflows, despite the "free" starting price.

"After 5h limit change I can do approx 10x-15x less of what I was doing just a week ago." - Sasha123, OpenAI Community forums, April 4, 2026

"It's strictly worse than Claude Code presently but I'm hopeful it improves through open-source contributions." - mgdev, Hacker News, April 16, 2025

The codebase search performance issue is worth flagging separately. On large repositories, Codex sometimes loads unnecessary adjacent file context when executing a targeted function search, running grep-adjacent operations for 75 seconds on tasks that a purpose-built subagent handles in 5 seconds. For projects with large monorepos, this translates directly into rate limit consumption and slower iteration cycles. The codex resume feature and AGENTS.md scoping instructions help manage this but do not eliminate it entirely.

Who Codex CLI is built for

Developers already paying for ChatGPT Plus or Pro get Codex CLI as part of their subscription, which is a compelling value proposition. If you're already on Pro at $200/month, adding a capable terminal agent at no additional cost changes the economics significantly compared to paying separately for Claude Code's API usage. Teams that have invested in AGENTS.md configuration files for Cursor or Cline will find Codex CLI reads the same files without additional setup.

Security-conscious teams operating on sensitive codebases benefit from the OS-level sandboxing. Kernel-level Landlock/Seatbelt enforcement provides stronger guarantees than application-layer approval hooks that rely on the model respecting a prompt constraint. For regulated environments or teams auditing agent behavior, the contained working-directory execution model is a meaningful property.

The parallel execution model suits a particular workflow: generate many small PRs or code reviews in parallel rather than iterating in a single long session. Users report the highest productivity when running Codex across multiple isolated tasks simultaneously, reviewing the outputs as PRs, and discarding failures without cost beyond token usage. Tools like OpenHands take a similar parallel-task approach but add a web UI layer; Codex CLI keeps everything in the terminal.

What Codex CLI is not

Codex CLI is not a replacement for Claude Code if multi-step, long-running agentic sessions are your primary workflow. Claude Code's 92.1% Terminal-Bench score versus Codex CLI's 77.3% reflects a real capability gap on complex, chained tasks. Claude Code maintains session memory better across long sessions and handles architectural reasoning tasks with more consistency across multiple testers' reports.

It is not a model-agnostic tool. Every API call goes to OpenAI's servers. If you want to run Claude 3.5 Sonnet, Gemini 2.0 Flash, or a locally hosted Llama model, you need Aider or a provider-agnostic harness. This is not a configuration option in Codex CLI, it is a design constraint.

It is not suitable for projects that rely on containerized test environments. The sandbox prevents spawning new containers, which means LocalStack, Docker-in-Docker, and similar test infrastructure cannot be used from within a Codex session. alexjplant called this a "showstopper" for AWS-native applications on launch day in April 2025, and the constraint persists. If your test suite requires a running container, Codex CLI cannot verify its own edits autonomously.

It is not a budget tool for heavy users despite the free open-source label. The code is free; the inference is not. Plus tier at $20/month delivers surprisingly limited headroom after the April 2026 rate limit changes. Developers who need to run dozens of tasks per day will hit the ceiling and need to either upgrade to Pro ($200/month) or pay per-token via API key, at which point total cost converges with Claude Code or Aider alternatives.