Codex Code Review: Setup, Limits, and a Separate Reviewer

Codex code review is OpenAI's reviewer for GitHub pull requests and for diffs on your own machine. On GitHub, you comment @codex review or turn on automatic reviews. Codex then posts a standard GitHub review that flags only P0 and P1 issues. Locally, /review reads your diff and leaves your files unchanged. OpenAI's pricing page lists automatic code review from the $20 Plus plan.

By default, the local Codex review uses your session's model, which may be the one that wrote the change. If you want a reviewer that did not write it, OpenQodex, our open source tool, adds one before you push.

Every OpenAI fact on this page comes from OpenAI's own documentation, read on 12 November 2026. Each section links the page it came from.

How Codex code review works

Codex "reviews the pull request diff" and "follows your repository guidance," says OpenAI's GitHub review page. It then "posts a standard GitHub code review focused on serious issues."

Repository guidance means AGENTS.md files. Codex looks for them in the repository and follows their code review rules.

The review is narrow on purpose. In OpenAI's words, Codex "flags only P0 and P1 issues so review comments stay focused on high-priority risks." P0 and P1 are the top two priority levels. Lower-priority notes do not appear on GitHub.

Security Review is a separate pass, in research preview. OpenAI says it goes deeper on security risks than the general review. It reads the diff, the repository context and any threat model you configured.

According to OpenAI's code review page, GitHub code review is generally available. GitLab merge request support is in preview.

How to set up Codex code review on GitHub

You need a GitHub repository connected to Codex. To set up automatic reviews, you also need push or admin permission on that repository.

Step 1: Connect the repository to Codex

Connect your GitHub repository to Codex. OpenAI lists this connection first among the things you need before you start.

Step 2: Turn on code review for the repository

Open the code review settings at chatgpt.com/settings/code-review. Choose the repository. Turn on Automatic review under Review code.

Step 3: Ask for a review on a pull request

Leave a pull request comment that mentions @codex review. Codex reacts with an eyes emoji, then posts its review like a teammate would.

Step 4: Turn on automatic reviews for your own pull requests

In the same settings, open Personal preferences and turn on Automatic review. Pick when reviews run with Review trigger. Your pull requests then get a review without a comment.

Step 5: Add review rules to AGENTS.md

Add a Code Review Rules section to the AGENTS.md file closest to the code it governs. The next section shows one.

These three comments come from OpenAI's GitHub review page. They go in a pull request comment, not a terminal.

@codex review
@codex review for issues in the database migration
@codex security review

The second form adds a one-off focus to a single review. The third asks for a Security Review. If nothing happens, OpenAI's troubleshooting list says to check three things. Code review must be on for the repository. The repository must be connected to Codex. The comment must use the exact trigger @codex review.

Write review rules in AGENTS.md

Rules are how you teach Codex what matters in your code. OpenAI asks for a section headed Code Review Rules, with ### headings to group related checks.

Here is an example rule for a billing service, in that shape:

## Code Review Rules

### Billing
- Take the tenant id from the session, never from the request body.
  Safe path: read it from the verified session on the server.

Put rules for the whole repository in the root AGENTS.md. Put rules for one service in a nested file, such as services/billing/AGENTS.md. Codex applies the root rules plus the more specific ones that cover each changed file.

OpenAI's own advice on writing them is short:

• Start small. Begin with two or three concise rules that encode checks reviewers often explain.

• Say what is safe. State the safe path or the exception, so Codex can tell a real issue from expected behavior.

• Keep mechanical checks in CI. Formatting, lint and other deterministic checks stay out of review rules.

• Tune on a real pull request. Request a review on a representative change, then narrow any rule that produces noise.

One line on that page sets the limit of every rule: "Code review rules guide Codex; they don't replace tests, branch protections, or required approvals."

Review locally with /review and codex review

You can review a change before it reaches GitHub. In the Codex CLI, type /review to open the review presets. OpenAI says Codex then "starts a dedicated reviewer that reads the selected diff." It reports findings without changing your working tree.

The CLI offers four scopes:

• Against a base branch. Codex finds the merge base and reviews your branch diff.

• Uncommitted changes. Staged, unstaged and untracked files.

• A commit. The exact change set of one commit.

• Custom instructions. A review focused on criteria you write.

The desktop app and the IDE extension offer the base branch and uncommitted scopes. In the IDE, /review appears only when the project is inside a Git repository.

For scripts, codex review runs the same review without an interactive session. OpenAI's command line reference says to choose exactly one target:

codex review --uncommitted
codex review --base main
codex review --commit <sha>

Those flags match the help text of codex-cli 0.167.0. We did not run a review here, because a review sends the diff to OpenAI.

Which plans include Codex code review

The plan cards on OpenAI's Codex pricing page decide this. Here is what each card says, read on 12 November 2026.

The page gives no price per review and no review count. It says local messages and cloud chats share your plan's usage allowance. Weekly limits may also apply.

Two practical points follow. A team that signs in with an API key gets local review in the CLI, but no GitHub review. And a free plan does not show GitHub review on its card. Our free AI code review guide compares what each free tier includes.

What Codex code review checks, and what it leaves out

OpenAI's pages describe what the review does in plain terms. Here is what they say it covers:

• The pull request diff, read with the repository's AGENTS.md guidance.

• Serious issues, posted on GitHub only at P0 and P1.

• Security risks in more depth, through Security Review, which is in research preview.

And here is what the same pages say, or leave unsaid, about its limits:

• Review rules do not replace tests, branch protections or required approvals.

• OpenAI tells you to check the review findings against the diff.

• The GitHub page describes reading the diff. It does not describe running your tests against the change.

• GitLab support is in preview, and an API key gets no GitHub review.

None of this makes the review weak. It tells you where the review sits: one reader of the diff, beside your tests and your human approval.

The gap: the same model family writes and reviews

One point sits outside the setup steps. When Codex wrote the change, a Codex review is the same family checking its own work.

OpenAI's command reference says /review "uses the current session model unless you set review_model in config.toml." So by default, the reviewer is the model your session runs.

You can set review_model to another model. But every model on OpenAI's Codex pricing page is an OpenAI model, such as GPT-6.1 Sol and GPT-6 Luna.

Why does this matter? A reviewer that shares the writer's training can share its blind spots. A mistake the writer tends to make can be one the reviewer tends to accept. This is a design point, not a measured rate.

Anthropic makes the same argument about its own tool. Its Claude Code best practices page lists a review "by someone who didn't write the code." Such a reviewer, it says, "isn't swayed by the reasoning that produced the code."

The fix is a separate reviewer. That means a fresh process with no memory of the session, and ideally a different model family. Keep the Codex review too.

Add a separate reviewer

Qodex makes two products for this. They run at different times and need different things, so we keep them apart.

Before you push: OpenQodex, open source

OpenQodex is open source code review for coding agents, under the Apache 2.0 licence. It runs on your machine, inside your coding agent, before you push. It needs no account or API key of its own.

Install it from a terminal:

npx openqodex init

Then say to your agent: "review my change with openqodex". OpenQodex first runs scanners on the files you changed, such as gitleaks or semgrep. Then it starts a separate reviewer process.

OpenQodex runs in Claude Code, Codex, Cursor, Cline and Goose. Only Claude Code and Codex can be the reviewer. The review needs one of them installed and logged in.

By default, the reviewer is a fresh process of the agent you work in, with no memory of your session. For a Codex user, that is a new Codex process. To get a different model family, pick Claude Code as the reviewer:

~/.openqodex/bin/openqodex review --reviewer claude

Or set reviewer: claude in ~/.openqodex/config.yaml. Inside the Codex sandbox, a second Codex process cannot start. There, OpenQodex starts the first agent that can review.

With Claude Code as the reviewer, OpenQodex found 98.0% of planted benchmark bugs over 3 reviews of each case. That run cost $0.44 per review on average. The benchmark results are in the OpenQodex repository.

The reviewer sends your change to the model service of your Claude Code or Codex login. OpenQodex itself sends no telemetry. The source is at github.com/openqodex/openqodex.

After the pull request opens: Qodex code review, hosted

Qodex code review is our hosted reviewer, and it needs a sign-up. A review starts when a pull request opens or changes, or when someone comments @qodex-ai review.

Findings below 0.7 confidence are dropped. With a preview deployment, Qodex sends one safe GET request to check a finding. A finding that reproduces is marked verified. The AI code review product page shows the full flow.

Pricing, from our pricing page:

• Free: 1 developer and 20 reviewed pull requests a month.

• Pay as you go: $0.50 per reviewed pull request after the free 20.

• Own key: your own OpenAI key or a connected ChatGPT plan. It is free up to 200 reviewed pull requests a month, then $99 a month per team.

One honest note on Own key. There, Qodex makes its model calls on your OpenAI account. So the separation is the reviewing pipeline, not the model family. Our ChatGPT plan page covers the Own key route.

To try the hosted review, sign up for Qodex code review. If you are still choosing a pull request reviewer, our CodeRabbit alternatives guide compares the main options.

A review setup that holds up

Turn on Codex code review and write two or three rules in AGENTS.md. Keep your tests and your human approval as required checks. Then add a reviewer that did not write the code. On your machine that is OpenQodex, set to Claude Code. On every pull request it can be Qodex code review. For the Claude side of the same question, read our Claude code review guide.

Frequently Asked Questions

What is Codex code review?

It is OpenAI's code reviewer in Codex. On GitHub, it reads the pull request diff and your AGENTS.md rules, then posts a standard GitHub review. Locally, /review and codex review review your diff without changing files.

How do I start a Codex review on a pull request?

Connect the repository to Codex and turn on code review in the Codex settings. Then comment @codex review on the pull request. Codex reacts with an eyes emoji and posts its review.

Can Codex review every pull request automatically?

Yes. Turn on Automatic review for the repository, and under Personal preferences for your own pull requests. Review trigger sets when reviews run. No @codex review comment is needed.

Is Codex code review free?

OpenAI's pricing page lists automatic code review on the $20 Plus plan. The Free and Go cards do not list it. The page gives no per-review price; reviews share your plan's usage allowance. Read 12 November 2026.

Does Codex code review work with an API key?

Only locally. OpenAI's pricing page says the API key route has "No cloud-based features (GitHub code review, Slack, etc.)". You can still run /review or codex review in the CLI.

Why does Codex only flag P0 and P1 issues on GitHub?

OpenAI says it does this "so review comments stay focused on high-priority risks." Lower-priority notes do not appear on the pull request.

Does Codex code review support GitLab?

In preview. OpenAI's code review page says GitHub code review is generally available and GitLab merge request support is in preview.

Can Codex review code that Codex wrote?

Yes, and it can find real problems. By default, /review uses the current session model, so the writer and the reviewer are the same family. A separate reviewer, ideally from another model family, is the independent check.

Does OpenQodex need an account?

OpenQodex needs no account or API key of its own. It needs Claude Code or Codex installed and logged in, because one of them does the review. The hosted Qodex code review is a different product and needs a sign-up.