Codex CLI

What it is

Codex CLI is a coding agent from OpenAI that runs locally on your computer. It reads and edits files in a project, runs commands, and reports what it did. The repository is open source under the Apache 2.0 license, and most of the code is Rust. Installation is through npm, Homebrew, install scripts, or prebuilt binaries.

It is distinct from Codex Web, OpenAI's cloud-hosted agent. This page is about the local harness, which is the part you can read, build, and run on your own terms.

Sandbox and approvals, separately

The design detail most worth studying is that Codex expresses two different controls as two different settings.

• The sandbox (sandbox_mode) limits what commands can reach on the filesystem and network: read-only, workspace-write, or danger-full-access.
• The approval policy (approval_policy) decides when the agent must stop and ask, for example on-request or never, with a granular form for finer rules.

Keeping these apart matters. A sandbox is a boundary enforced by the operating system; an approval is a checkpoint with a person in it. A setup that never asks but cannot write outside the workspace is very different from one that asks often but has full access once approved. This reference's bounded test asks for exactly this: limits enforced outside the model, stated explicitly.

AGENTS.md as the instruction file

Codex reads project instructions from AGENTS.md, and its /init command creates one. AGENTS.md is a shared convention rather than a Codex-only file, and it is one of the founding projects of the Agentic AI Foundation at the Linux Foundation. Other harnesses read it too, so instructions written once serve whichever agent a developer runs.

Models and providers

The default provider is OpenAI, signed in through a ChatGPT plan or an API key. The configuration also defines custom providers under model_providers, and an --oss mode that runs against a local provider, with ollama and lmstudio built in. That puts open-weight models within reach without changing harness, which is the replaceability this reference looks for in the models layer.

Expect differences. A harness tuned against one provider's tool-calling behavior can feel weaker on another, and that is usually a harness-and-model fit issue rather than a capability gap.

Tools and MCP

Beyond its built-in file and shell tools, Codex connects to local or remote MCP servers and shows which tools a session has available. Tool servers written for MCP are not tied to Codex; the same servers serve other harnesses.

Non-interactive runs

codex exec runs a task without an interactive session, for scripts and CI. Non-interactive use moves every approval decision into configuration written ahead of time, so the sandbox and approval settings for automated runs deserve the same review as any other deployment change.

CLI, IDE, and the cloud agent

Codex also ships as an IDE extension for VS Code and VS Code-based editors such as Cursor and Windsurf. The cloud agent at chatgpt.com/codex is a separate, hosted product. When evaluating openness, keep them apart: the CLI is open source and can run against local models; the cloud agent is a service.

Where it fits in an open stack

Codex CLI is an execution-layer harness. It consumes models from the routing layer (OpenAI by default, others by configuration), reaches tools over MCP, and reads instructions from an open file convention. Its sandbox and approval settings are a good reference design for the bounded property in any harness, coding or not.

Gotchas worth knowing

• Full access is a named mode for a reason. danger-full-access removes the sandbox; use it only inside an environment that is itself the boundary, such as a disposable container.
• Repository content is untrusted input. Text the agent reads can contain instructions aimed at it.
• Local models change the experience. The --oss path works, and quality depends heavily on which model you run.
• Config options move. Some approval values have been deprecated or marked unsupported over time; check the current reference before copying an old config.

How it scores on openness

• Replaceable. Good. OpenAI by default, with custom providers and local models through configuration.
• Inspectable. Strong. Apache 2.0 source, so the loop, tools, and sandbox implementation can be read.
• Portable. Good. Instructions live in AGENTS.md and tools in MCP servers, both shared with other harnesses.
• Bounded. Strong by design. Sandbox and approvals are explicit, separate, and enforced outside the model.
• Grounded. Strong for code, working from files, commands, and test output.
• Auditable. Good when changes land as commits; session records depend on how you run it.

What it is not

Codex CLI is not the Codex cloud agent, and it is not a model.

It is not a broker. It runs one agent loop rather than routing work across harnesses.