openai/codex

Selection

Select when

• You want an OpenAI coding agent that runs in a terminal.
• You need first-party Python or TypeScript APIs around agent threads and turns.
• You need streamed tool, item, file-change, and usage events.
• You need JSON-schema-constrained final output.
• You need resumable local agent sessions.
• You need to pass local screenshots or diagrams into a coding turn.
• You need host-controlled environment variables and configuration overrides.
• You need configurable filesystem permissions and OS-specific sandbox enforcement.
• You need MCP or dynamic-tool adaptation within the Codex host.
• You want configurable OpenTelemetry export for agent activity.
• You want a standalone peer tool to Claude Code rather than a Claude extension.

Boundaries

Avoid when

• You specifically need behavior injected inside Claude Code.
• You need a native Claude Code plugin, hook, slash command, or Agent Skill.
• You require a verified no-network or no-telemetry deployment without reviewing configuration.
• You must safely process untrusted repositories using only the supplied secure devcontainer defaults.
• You require identical sandbox semantics across macOS, Linux, Windows, WSL1, and WSL2.
• You cannot use a ChatGPT login or API-key authentication path.
• You cannot install a local executable or allow an SDK to spawn one.
• You require the TypeScript SDK on a Node.js version below 18.
• You need supplied evidence of an independent security audit or complete privacy assessment.
• You need fully verified present-day activity metadata because the supplied timestamps extend into 2026.

Strengths

Capabilities

Risk profile

Risks and limitations

• Uncertainty: only selected first-party README files were supplied, so command breadth, default configuration, approval UX, SDK implementation, extension API, and many security-sensitive code paths were not directly inspected.
• Uncertainty: repository update and push timestamps extend into 2026 relative to this analysis context, so recency, release status, issue counts, and adoption signals cannot be independently reconciled.
• The supplied files do not document any native Claude Code integration; classification as a companion is an inference based on its standalone CLI and SDK form.
• Authentication requires either a supported ChatGPT account flow or additional API-key setup.
• The TypeScript SDK requires Node.js 18 or newer and works by spawning the Codex CLI rather than as a self-contained agent runtime.
• Sandbox behavior differs by operating system, selected backend, and policy shape; unsupported policies can fail closed or use documented legacy semantics.
• WSL1 cannot use the bubblewrap sandbox path, while WSL2 follows the normal Linux path.
• The secure devcontainer explicitly permits DNS exfiltration and warns that allowed HTTPS destinations can also carry data from untrusted repositories.
• Its secure devcontainer relaxes Docker's outer seccomp and AppArmor controls and requires NET_ADMIN and NET_RAW so the inner sandbox and firewall can operate.
• OpenTelemetry can export prompts, account metadata, business events, traces, logs, or metrics when configured; exact defaults and redaction behavior were not established by the supplied files.
• Raw SDK configuration overrides can alter permissions and network behavior, placing security responsibility on the embedding application.
• No independent security audit, comprehensive privacy statement, supported-version matrix, or measured agent-quality benchmark was supplied.

Codex documents OS-specific sandboxing: macOS Seatbelt, Linux Landlock or bubblewrap with a bundled fallback, and policy-dependent Windows elevated or restricted-token backends. Some unsupported policy shapes fail closed. The secure devcontainer adds an outbound allowlist firewall but explicitly does not prevent DNS exfiltration or exfiltration through allowed HTTPS destinations, and it relaxes outer Docker controls to enable the inner sandbox. Security therefore depends on chosen permissions, platform support, network rules, and host configuration; no independent audit was supplied.