plugin

Codex Security

Name: Codex Security
Author: OpenAI

Security scanning for your codebase

Codex Security workflows for security scans, analysis, and investigation. Skills cover security scans, diff scans, deep scans, threat modeling, finding triage, fix proposals and verification, vulnerability write-ups and patch-risk assessment. Listed in OpenAI's curated Codex marketplace (openai-curated); the manifest declares skills, an app connector and MCP server config.

Also available as

MCP App Basics (Apps SDK example)Eleven interactive widgets that each teach one MCP Apps APIapp · by OpenAI · 2.4k stars

OpenAI Docs MCPSearch and read OpenAI's developer documentation from Codex or any MCP clientMCP server · by OpenAI · Remote

Install

1Add it in ChatGPT
Open Plugins in the ChatGPT sidebar (web or desktop), search for “Codex Security” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.
2Or install it in Codex
```
codex plugin add codex-security@openai-curated
```
Start a new Codex session afterwards. You can also run /plugins inside the CLI to browse and install interactively.

Skills 15

Assess Patch Risk
Assess patch impact and merge risk
Attack Path Analysis
Perform attack-path analysis for a security finding
Deep Security Scan
Run a deeper security scan
Define Security Policy
Define scoped SECURITY.md scan guidance
Finding Discovery
Discover security findings
Fix Security Finding
Fix and verify a given security finding
Propose Security Hardening
Design evidence-backed security hardening options
Security Diff Scan
Run security review on a Git diff
Security Scan
Run repository or scoped-path security scan
Threat Model
Build a repository threat model
Track Findings
Track findings in Linear, Jira, GitHub issues, or draft advisories
Triage Finding
Triage existing security findings from reports, GitHub, Jira, or Linear
Validation
Validate a security finding
Verify Fix
Verify security fixes without changing code
Vulnerability Writeup
Write up a vulnerability into a polished, self-contained, source-backed report.

Things to ask

“Run a Codex Security scan on this repository.”
“Run a Codex Security diff scan on this PR, commit, branch diff, or working-tree patch.”
“Triage existing security findings against this repository.”