Codex Security
Codex Security packages reusable workflows for security scans, analysis, validation and investigation across code, diffs and related files. It can scan a whole repo or a single change, triage findings, model threats and help verify fixes.
Skills (15)
- Scanning: security-scan, deep-security-scan, security-diff-scan, finding-discovery.
- Analysis: threat-model, attack-path-analysis, assess-patch-risk, define-security-policy.
- Findings: triage-finding, track-findings, validation, vulnerability-writeup.
- Fixes: fix-finding, verify-fix, propose-security-hardening.
- MCP: a bundled local codex-security server.
- Example prompts: “Run a Codex Security scan on this repository” and “Run a Codex Security diff scan on this PR.”
- Docs: developers.openai.com/codex/security. Version 0.1.32 in the manifest.
- Capabilities in the manifest: Interactive, Read, Write.
- Optional apps: Linear, GitHub and Atlassian.
- Data handling: OpenAI's privacy policy applies; nothing more is stated on the listing.
- Publisher: OpenAI.
- Listed in openai/plugins, folder plugins/codex-security; its manifest names github.com/openai/codex-security as the repository.
- License: Proprietary (plugin.json).
Taken from the plugin's plugin.json, .app.json, .mcp.json and skills folder in openai/plugins on GitHub. Facts marked "from the source code, not the listing" come from the item's public source files on GitHub or n8n. Anything stated nowhere is marked "Not stated".
More Codex templates
- Build Web Apps by OpenAI
- GitHub by OpenAI
- Build iOS Apps by OpenAI
- Plugin Eval by OpenAI
AgentScout links to the original public listings and doesn't host copies. We aren't affiliated with xAI, Anthropic, OpenAI, OpenClaw, Cursor, n8n or the creators listed. Names and logos belong to their owners. Official logos come from the item's own repo or listing, or its publisher's official account; Grok Bot cards show the creator's photo from the x.ai marketplace; the rest are icons made by AgentScout. Listings checked Oct 19, 2026.