Codex CLI

Codex CLI is OpenAI's coding agent that runs on your computer, and the code is open under Apache-2.0. You install it with one command, run codex, and sign in with a ChatGPT plan or an API key. If you already pay for ChatGPT, it is the cheapest agent to try. Facts checked 31 October 2026.

At a glance

What it is

OpenAI describes Codex CLI as "a coding agent from OpenAI that runs locally on your computer." The same name covers a few products, which confuses people, so here is the split the README gives:

• Codex CLI: this page. A terminal agent.
• Codex in your editor: an extension for VS Code, Cursor and Windsurf.
• Codex app: a desktop experience, started with codex app.
• Codex Web: the cloud-based agent at chatgpt.com/codex.

The CLI is the open-source part. That makes it unusual among the big vendors' agents: you can read the code, build it yourself and file issues against the real thing. The repository's license file is Apache-2.0, which is a permissive license that allows commercial use.

Install

The README gives several routes. Pick the one that matches how you manage tools.

# macOS and Linux: standalone installer
curl -fsSL https://chatgpt.com/codex/install.sh | sh

# Windows PowerShell
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

# npm
npm install -g @openai/codex

# Homebrew
brew install --cask codex

The standalone installers download from releases.openai.com/codex and fall back to GitHub Releases if that is unavailable. If you want GitHub Releases only, set CODEX_INSTALLER_USE_RELEASES_OPENAI_COM=false before the installer.

You can also download a binary from the latest GitHub release. The README names these archives:

Each archive holds one executable with the platform in its name, so rename it to codex after extracting.

Windows has its own sandbox and WSL pages in the docs. The security docs say Windows supports a native sandbox, with older elevated and unelevated modes as fallbacks, and that inside WSL2 Codex uses the Linux sandbox. WSL1 was supported only through Codex 0.114, because the Linux sandbox moved to bwrap in 0.115. So native Windows works, and WSL needs to be version 2.

First run and sign-in

Run codex in a project folder. It shows a sign-in choice. The README recommends Sign in with ChatGPT, so that Codex counts as part of your Plus, Pro, Business, Edu or Enterprise plan. An API key works too, but "requires additional setup", which the auth docs describe.

A few commands you will use early, from the CLI page:

The CLI page does not name the sandbox and approval modes, but the security docs do: sandbox modes read-only, workspace-write and danger-full-access, and approval policies such as on-request and never. The older untrusted policy is retired, and a leftover setting can stop the client starting.

Plans and prices

Codex is bundled with ChatGPT plans, so its price is the plan's price. The pricing page lists these plans:

The dollar amounts, from our Codex pricing page, are Go $8, Plus $20, Pro from $100 (with $200 and $500 tiers) and Business $20 per seat on annual billing or $25 monthly.

The part we could confirm in the page text is the per-model message estimate for Plus and Business, local messages per five hours:

Weekly limits may also apply. For credit-based usage the page lists rates per million tokens (input, cached input, output):

The page says a typical GPT-5.6 Sol task may use 2 to 15 credits. It does not give the dollar value of a credit, so we do not convert. If you sign in with an API key, usage is billed at the API rates instead; see our OpenAI API pricing comparison.

The wide range in message estimates is the main thing to understand. The same plan gives you ten times more small-model messages than large-model messages, so which model you select matters more than which tier you buy.

Models

Codex uses OpenAI models. The /model command chooses both the model and the reasoning effort, and the docs show a sample session on gpt-6.1-sol at medium effort. The pricing page names these model families: GPT-6.1 Sol, GPT-6.1 Terra, GPT-6 Sol, GPT-6 Astra and GPT-6 Luna, plus older GPT-5.6 entries. Names and availability shift often, so treat this list as the page of 31 October. Enterprise admins can control access; the page says GPT-6.1 Sol is off by default until an admin enables it.

Unlike Cursor, you do not choose a model from a different vendor. If you want Claude models in a terminal, look at Claude Code; if you want to mix, look at OpenCode.

MCP, skills and plugins

Three extension routes are documented on the CLI page.

• MCP. codex mcp adds local or remote servers, handles authentication when needed, and lists the tools available in a session. Servers you already use in other clients, such as Playwright MCP or GitHub MCP, are the first to try. Browse the MCP server list.
• Skills. You package repeatable instructions as skills. See skills.
• Plugins. Plugins connect Codex to team tools and data, and you browse them from available marketplaces. See plugins.

Project guidance lives in AGENTS.md. That file is also read by several other agents, and Claude Code can read it in place of a CLAUDE.md, so one file can serve a mixed team.

Sandbox and approvals, set deliberately

Codex splits the question "what may it touch" into two settings, and the defaults suit a quick trial more than a production repository. The security docs describe them like this.

In the Auto preset, which is workspace-write with on-request, Codex can read files, make edits and run commands in the working directory automatically. It asks before editing outside the workspace or running commands that need the network. The docs add that network access is off by default in workspace-write, and you turn it on in configuration, not by accident. For chat or planning with no changes, use read-only, which the /permissions command switches to.

A conservative starting point for an unfamiliar repository goes in ~/.codex/config.toml:

sandbox_mode = "read-only"
approval_policy = "on-request"

Or start one session the same way with codex --sandbox read-only --ask-for-approval on-request. Then widen as trust grows. When you want edits, switch to workspace-write. Reserve danger-full-access for a throwaway container, since it removes the protection that makes unattended runs reasonable. If a tutorial shows approval_policy = "untrusted", delete it. The docs say that policy is retired and can prevent the client from starting.

Where configuration lives

The config basics page gives a precedence order, from strongest to weakest, which is worth knowing when a setting seems ignored.

1. Command-line flags
2. Project files at .codex/config.toml, closest to your working folder first, and only for projects you trust
3. Profile files chosen with --profile name, kept at ~/.codex/name.config.toml
4. Your user file, ~/.codex/config.toml
5. Defaults delivered by your workspace admin, when signed in
6. A system file, /etc/codex/config.toml on Unix

Codex loads project .codex/ layers only after you trust the project, which is a sensible guard against a cloned repository that tries to loosen your settings. Profiles are the clean way to keep a strict default and a looser one for a sandboxed container, with a flag to pick between them.

What a message estimate means for a working day

The plan table gives message ranges per five hours. Turn them into a day to see what a plan can carry. These ranges are OpenAI's estimates for Plus and Business, and a work session of an eight-hour day spans a bit under two windows.

The spread is the point. Complex tasks with a large model sit at the bottom of each range, because each message does more work, and small edits sit at the top. A person who runs long agent tasks on the biggest model can use up a plan in a single morning. Someone who asks for small changes on a mid-size model will rarely notice a limit. If you hit the ceiling often, the cheaper fixes come before the upgrade: drop to a smaller model for routine steps, keep sessions short and start a fresh one for each task, and attach less context. The credit rates in the table above show the same spread from the other side, with GPT-6 Luna at 2.5 credits per million input tokens against 250 for GPT-6 Astra.

A first hour with Codex

1. Install and sign in. Use the installer for your platform, run codex in a scratch folder, and choose Sign in with ChatGPT.
2. Set the sandbox. Run /permissions and confirm you are in a mode you chose, not the default you did not read.
3. Make it read. In a real repository, ask for an explanation of the folder layout. This costs little and shows whether it finds the right files.
4. Generate guidance. Run /init and read the AGENTS.md it proposes. Delete anything wrong or obvious. Add the exact test command.
5. One small edit with a test. Ask for a change that has a pass or fail check, and run the check yourself.
6. Review. Use /review on the diff, then read it yourself.
7. Script one thing. Try codex exec with a harmless prompt, such as summarizing the latest commits, to see the non-interactive route.

Running it in CI

codex exec runs one prompt and exits, which fits a pipeline step. Keep to a few rules.

• Pin the version. Download one of the release archives by tag instead of following the latest installer, so a release cannot change a pipeline overnight.
• Use an API key for pipelines. A personal ChatGPT login does not belong on a shared runner. An API key bills at API rates, and you can scope and rotate it.
• Choose the narrowest sandbox. A job that summarizes a diff needs read-only. A job that fixes lint errors needs workspace-write and no network.
• Set `approval_policy` to `never` only inside a throwaway runner. No human is there to answer a prompt, so the sandbox is your safety net.
• Treat output as untrusted. Review anything it writes before merging, and never give the job a token that can push to your main branch.

Limits, privacy and data handling

The CLI runs on your computer, but the model runs at OpenAI, so your prompts and the code the agent reads go to OpenAI's servers while you work. What happens to that data depends on the account: ChatGPT consumer plans, Business and Enterprise have different data controls. The one thing we can say from the docs is that /permissions and the sandbox control what the agent can touch on your machine: edit files, run commands, and which folders are writable.

Practical limits:

• Plan limits are the real ceiling. The five-hour message estimates above are estimates, not guarantees.
• Pro plans have, per the pricing page, no five-hour limit at present.
• Image input, web search and cloud tasks are separate flags or commands, so check that the one you need is on.

Who it suits

• ChatGPT subscribers who want an agent without a second bill.
• People who want to read the code of their agent, or run a build they control.
• Teams on Business or Enterprise who already administer ChatGPT and want admin control over models.
• Terminal and CI users, through codex exec.

It suits less well if you want several vendors' models in one picker, or a Claude-centered workflow.

Moving to it from another agent

1. Carry your instructions: if your repo has AGENTS.md, Codex reads it. If you only have a CLAUDE.md, copy the content into AGENTS.md, or run /init and paste in what is missing.
2. Re-add MCP servers with codex mcp.
3. Check /permissions before the first real task, since the defaults differ from other agents.
4. Run the same small task in both agents and compare the diffs.

Alternatives and duos

The full field is on AI coding agents.

Repository health

Because the CLI is open source, you can check how alive it is before depending on it. On 31 October 2026 the GitHub repository showed about 131,900 stars and a last push on 30 October. The README links a contributing guide, build instructions and an open source fund page. Stars say little about quality, but a push the day before you look says the project is moving.

The README also gives two other things worth noting. Releases are published on GitHub as plain archives for four platform builds, so you can pin an exact version in CI instead of following the latest installer. And the installer's fallback to GitHub Releases means a problem on one download host does not have to block a build.

Questions people ask before installing

Do I need a ChatGPT subscription? No. An API key works, with extra setup, and is billed at API rates. A subscription is simply the route the README recommends.

Can I run it in a script? Yes. codex exec runs a prompt without the interactive screen, which is the building block for CI and cron jobs.

Can it look at screenshots? The CLI page lists codex --image for attaching images.

Can it browse the web? codex --search is listed. Whether you want that on is a privacy choice, since search queries leave your machine.

Where do cloud tasks run? codex cloud works with the cloud-based agent, Codex Web, at chatgpt.com/codex. Your code is then handled by OpenAI's infrastructure instead of your laptop.

What if I switch editors? The IDE extension covers VS Code, Cursor and Windsurf, so the same agent follows you between those editors.

Our take

This is built from the README, the CLI page and the pricing page. We did not run a test for this page.

The strongest point is the combination of open source and plan bundling. Few vendors let a subscriber use a permissively licensed agent at no extra charge. That makes it the natural first step for anyone already inside ChatGPT, and an easy second agent for someone who mainly uses another tool.

The weak spot is clarity. OpenAI's product names overlap (CLI, app, Web, IDE extension), the model list moves quickly, and the CLI page leaves the sandbox modes and config path to other pages. Budget a little time to read the sandbox docs before you let it run commands unattended.

If you pay for ChatGPT, install it and try one task. If you do not, the cost question is whether a ChatGPT plan is worth buying for this alone; compare with the Claude pricing ladder first.

Checklist

• Sign in with ChatGPT or set up an API key, knowing which one bills you
• Run /permissions and read the sandbox settings
• Run /init and edit the generated AGENTS.md
• Add one MCP server with codex mcp
• Choose a model with /model and note the message estimate for it
• Re-check the plan prices on the live pricing page