DeveloperHA / AI agents / OpenAI Codex CLI
Terminal coding agent · CLI agents

OpenAI Codex CLI

Learn where Codex CLI fits, how to start a bounded task, and how to review permissions, instructions, tests and diffs rather than treating it as an unattended deployment system.

Made by OpenAISeparate agent guideReviewed 2026-09-26Model ≠ harness ≠ orchestrator
Scope note This is an independent guide to a third-party project or a developer concept. Installation commands, feature boundaries, plans, model availability and security defaults change. Follow the official source links before using it with private code, credentials or automation.

What it is and who makes it

A terminal coding agent from OpenAI that can work against a local project and is also available through editor and app surfaces.

Maker or project: OpenAI. Classification: Terminal coding agent; this page treats the surrounding context, tools, permissions and verification as the relevant harness boundary.

1
Start the CLI inside a trusted project directory.

Start the CLI inside a trusted project directory.

2
The agent reads relevant context and proposes or performs tool actions according to its approval mode.

The agent reads relevant context and proposes or performs tool actions according to its approval mode.

3
It edits files or runs commands in the configured environment.

It edits files or runs commands in the configured environment.

4
You inspect the diff and verification output before accepting the change.

You inspect the diff and verification output before accepting the change.

Who it may fit

Pick an agent by its control surface and trust boundary, not only by its model label.

Useful scenarios

  • Terminal-first software development
  • Repository exploration, implementation and review tasks
  • Developers who want an OpenAI coding-agent workflow close to Git and the shell

Trade-offs and checks

  • Approval modes, instruction files and command flags change; use the current official CLI reference.
  • Treat shell access and repository writes as privileged actions.
  • Never allow an agent to deploy or rotate production credentials without an explicit, separate release process.

Interactive vs headless and CI

These modes change the approval, identity and observability boundary.

Interactive work is the natural terminal or app workflow: inspect the plan, approve actions and review the diff. For headless or CI use, follow the current documented non-interactive/automation surface and keep the workspace, permissions, time and test exit contract explicit.

Request-to-verification workflow

Use this mental model when debugging a surprising edit, tool call or cost.

Input

Intent + context

Your prompt, repository instructions, selected files, history and environment become model context.

Action

Tool + permission

The harness proposes a read, edit, shell, web, MCP or other action; policy decides whether it can run.

Feedback

Result + verification

Command output, compiler errors, tests and your review return to the loop before acceptance.

Setup outline

Start with the smallest safe experiment, then follow the current official documentation for the real installation.

1
Install from the official Codex documentation or repository.
2
Authenticate using the supported account or API path for your environment.
3
Start in a disposable branch or worktree with a narrow task.
4
Review the generated diff and run the repository's normal tests.
Illustrative workflow
# Install path documented by the project
npm install -g @openai/codex

# Start in a repository
cd your-project
codex

# Begin with a bounded task
codex "Explain the request flow. Do not edit files."

Instructions, skills, MCP and hooks

These surfaces can shape context or add actions; they are part of the trust boundary.

Use the current Codex documentation for repository instruction files, skills, MCP and hooks. Treat instruction precedence and any extension that can run commands or read files as part of the permission model, not as harmless prompt text.

Security and isolation checklist Use a disposable branch or worktree; keep secrets outside the readable path; require approval for writes, shell, network and deployment actions; inspect commands before allowing them; constrain server bindings; review MCP servers, plugins, skills, hooks and instruction files; and run tests independently of the agent's own summary.

Official sources

Use these sources for current installation, capabilities, plans, releases and security notices.

Reviewed 2026-09-26. This date is a change-tracking note, not a promise that the product remains unchanged.

Related learning

Related agent guides

Want the foundations behind the workflow?

Study AI fundamentals, prompt design, AI-assisted development, agents and MCP without a forced linear course.

Open AI learningAI tools