# Codex Security (ChatGPT Plugin)

> Security scanning for your codebase

- Type: plugin
- Publisher: OpenAI (official)
- Categories: Security, Development
- Website: https://github.com/openai/plugins/tree/main/plugins/codex-security
- Docs: https://learn.chatgpt.com/docs/plugins
- Source: https://github.com/openai/plugins
- Open in ChatGPT: https://chatgpt.com/plugins/Plugin_1e648473be9c8191a91ac3947151af55
- GitHub stars: 7248
- Listed: 2026-04-30

## About

Codex Security workflows for security scans, analysis, and investigation. Skills cover security scans, diff scans, deep scans, threat modeling, finding triage, fix proposals and verification, vulnerability write-ups and patch-risk assessment. Listed in OpenAI's curated Codex marketplace (openai-curated); the manifest declares skills, an app connector and MCP server config.

## Install

1. **Add it in ChatGPT** Open Plugins in the ChatGPT sidebar (web or desktop), search for “Codex Security” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

2. **Or install it in Codex**

   Codex CLI:

   ```bash
   codex plugin add codex-security@openai-curated
   ```

## Disconnect or uninstall

1. **In ChatGPT** Disconnect an account in Settings → Apps or Plugins. To remove the plugin itself, open Codex Security in the Plugin Directory and select Uninstall plugin. Uninstalling can disconnect every account connected through it, and plugins your workspace installs may not offer the option.

2. **In Codex**

   Codex CLI:

   ```bash
   codex plugin remove codex-security@openai-curated
   ```

## Skills

- **Assess Patch Risk**: Assess patch impact and merge risk
- **Attack Path Analysis**: Perform attack-path analysis for a security finding
- **Deep Security Scan**: Run a deeper security scan
- **Define Security Policy**: Define scoped SECURITY.md scan guidance
- **Finding Discovery**: Discover security findings
- **Fix Security Finding**: Fix and verify a given security finding
- **Propose Security Hardening**: Design evidence-backed security hardening options
- **Security Diff Scan**: Run security review on a Git diff
- **Security Scan**: Run repository or scoped-path security scan
- **Threat Model**: Build a repository threat model
- **Track Findings**: Track findings in Linear, Jira, GitHub issues, or draft advisories
- **Triage Finding**: Triage existing security findings from reports, GitHub, Jira, or Linear
- **Validation**: Validate a security finding
- **Verify Fix**: Verify security fixes without changing code
- **Vulnerability Writeup**: Write up a vulnerability into a polished, self-contained, source-backed report.

## Example prompts

- "Run a Codex Security scan on this repository."
- "Run a Codex Security diff scan on this PR, commit, branch diff, or working-tree patch."
- "Triage existing security findings against this repository."

## Also available as

- app: [MCP App Basics (Apps SDK example)](https://chatgptplugins.directory/apps/apps-sdk-mcp-app-basics.md)
- MCP server: [OpenAI Docs MCP](https://chatgptplugins.directory/mcp/openai-docs.md)

## Codex Security alternatives

- [Superpowers](https://chatgptplugins.directory/plugins/superpowers.md): Plan, develop, and debug code
- [Build Web Apps](https://chatgptplugins.directory/plugins/build-web-apps.md): Build frontend-focused web apps with generated assets, browser testing, payments, and...
- [GitHub](https://chatgptplugins.directory/plugins/github.md): Triage PRs, issues, CI, and publish flows
- [Figma](https://chatgptplugins.directory/plugins/figma.md): Figma design-to-code workflows
- [Shopify](https://chatgptplugins.directory/plugins/shopify.md): Build and manage your store
- [PostHog](https://chatgptplugins.directory/plugins/posthog.md): Analyze your product data

---
Source: https://chatgptplugins.directory/plugins/codex-security · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.