Claude Code vs Codex CLI: A Facts-Only Side by Side

Claude Code is Anthropic's agentic coding tool and Codex CLI is OpenAI's local coding agent. Both install with one command, run in your terminal, sign in with a subscription or an API key, and ask before risky actions. They differ in licence, default approval mode, sandbox design and how cloud tasks run. Here are the facts from each tool's docs.

You do not have to give up either one to use Safeguard. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already work in.

This is a side by side, not a ranking. Each section quotes or paraphrases the vendor's own documentation, and the sources are listed at the end.

Claude Code and Codex CLI at a glance

Install and sign-in

Claude Code

The overview page gives a native installer as the recommended route:

# macOS, Linux, WSL
curl -fsSL https://claude.ai/install.sh | bash

# Windows PowerShell
irm https://claude.ai/install.ps1 | iex

# Homebrew or WinGet
brew install --cask claude-code
winget install Anthropic.ClaudeCode

The docs add apt, dnf and apk for Debian, Fedora, RHEL and Alpine. Native installs update themselves in the background, while Homebrew and WinGet installs do not. The repository README marks npm installation as deprecated. On native Windows, the docs recommend Git for Windows so Claude Code can use its Bash tool; without it, Claude Code uses PowerShell.

Run claude in a project folder and it opens a browser to log in. The authentication page lists the account types: a Claude Pro or Max subscription, Claude for Teams or Enterprise, a Claude Console account, or a cloud provider such as Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry. If ANTHROPIC_API_KEY is set and you approve it, Claude Code skips the login prompt.

Credentials sit in the macOS Keychain, or in ~/.claude/.credentials.json with file mode 0600 on Linux, and in the .claude folder of your user profile on Windows. For CI, claude setup-token prints a one-year OAuth token that you set as CLAUDE_CODE_OAUTH_TOKEN. That token needs a Pro, Max, Team or Enterprise plan.

Codex CLI

The Codex README lists four routes:

# macOS and Linux
curl -fsSL https://chatgpt.com/codex/install.sh | sh

# Windows
powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"

# npm or Homebrew
npm install -g @openai/codex
brew install --cask codex

Release binaries cover macOS on Apple Silicon and x86_64, and Linux on x86_64 and arm64. Run codex in a project folder and choose "Sign in with ChatGPT", which the README recommends for Plus, Pro, Business, Edu and Enterprise plans, or set up an API key.

OpenAI's authentication docs say the CLI, the IDE extension and the ChatGPT desktop app accept both sign-in methods for local work, while Codex cloud requires a ChatGPT sign-in, with multi-factor authentication. Login details are cached "in a plaintext file at ~/.codex/auth.json or in your OS-specific credential store." For headless machines, the docs suggest device code login, in beta, with codex login --device-auth.

Plans and usage

Anthropic's docs say most Claude Code surfaces need a Claude subscription or a Console account, and the desktop app needs a paid subscription. Claude Code cloud sessions are available on Pro, Max and Team plans, and for Enterprise users with premium or Chat plus Claude Code seats, and they count toward your plan's usage limits with no separate charge for the cloud VM.

OpenAI's pricing page says Codex is included in the ChatGPT Free, Go, Plus, Pro, Business, Edu and Enterprise plans, that local messages and cloud chats share your plan's allowance, and that cloud tasks may use more of it. API key use is billed at API rates and does not include cloud features such as GitHub code review.

Approvals and sandbox

Claude Code permission modes

Claude Code has six modes. The permission modes page lists what each one runs without asking:

• Manual (config value default): reads only.
• acceptEdits: reads, file edits and common filesystem commands such as mkdir and mv.
• plan: reads, plus classifier-approved commands when auto mode is available.
• auto: everything, with a second model, the classifier, reviewing actions in the background.
• dontAsk: reads in your working directories and pre-approved tools; anything that would prompt is denied.
• bypassPermissions: everything, meant for isolated containers and VMs only.

From v2.1.283, auto is the built-in starting mode for interactive terminal and VS Code sessions. Shift+Tab cycles modes during a session, and --permission-mode sets one at start. Writes to protected paths are not auto-approved except in bypass mode and a narrow plan-mode case, deny rules block in every mode, and rm on a critical path is never auto-approved.

The Bash sandbox is separate and off by default. You turn it on with /sandbox or sandbox.enabled in settings. It uses Seatbelt on macOS and bubblewrap with socat on Linux and WSL2; on native Windows, commands run unsandboxed. While it is on, shell commands can write to the working directory and a temp directory, and network traffic goes through a proxy that checks each host against an allowed list that starts empty. The docs say the sandbox covers shell commands only: built-in file tools, MCP servers and hooks run outside it.

Codex CLI sandbox and approvals

Codex splits the same question into two settings. The sandbox mode sets what Codex can technically do: read-only, workspace-write or danger-full-access. The approval policy sets when it must ask: on-request, never or a granular table. The older untrusted policy is retired.

The default Auto preset equals --sandbox workspace-write --ask-for-approval on-request. Codex can edit and run commands in the working folder, and asks before it edits outside it or uses the network. Network is off in workspace-write until you set network_access = true. Inside writable folders, .git, .agents, .codex and .aws stay read-only. Enforcement is at the OS level: Seatbelt on macOS, bwrap with seccomp on Linux and WSL2, and MXC on Windows.

Two defaults depend on the folder. A version-controlled folder starts in Auto, while a folder that is not under version control starts read-only, and Codex may stay read-only until you trust the directory. /permissions switches modes mid-session, and --yolo is the alias for bypassing approvals and the sandbox.

Same goal, each tool's setting

Where your code runs

Locally, both run on your machine. Claude Code and Codex CLI edit files and run commands in your working folder. Prompts and the files the agent reads go to the model provider: Anthropic or your configured cloud provider for Claude Code, OpenAI for Codex. Claude Code's README says Anthropic collects feedback, including usage data such as code acceptance or rejections, and points to its data usage policies.

Claude Code cloud sessions run "on cloud infrastructure instead of on your machine": by default an isolated, Anthropic-managed VM, or your organization's self-hosted environment. You start one from claude.ai/code, the Claude mobile app, the desktop app or claude --cloud "task", which clones your GitHub remote at your current branch. Network access is limited by default, git credentials stay outside the VM, and claude --teleport pulls a finished session and its branch into your terminal.

Codex cloud runs coding tasks where "each task has its own workspace." You connect GitHub, pick repositories and publish an environment with an install script. Each environment has an internet access setting. A task "can keep working while your computer is asleep", and you review the changes, then commit or open a pull request.

Scripting, CI, MCP and switching between them

Headless runs

# Claude Code: pipe in, print out
git diff main --name-only | claude -p "review these changed files for security issues"

# Claude Code: exact allowlist for CI
claude -p "run the test suite" --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read"

# Codex: read-only sandbox by default in exec
codex exec "review the change for race conditions"

# Codex: JSON Lines events, final message to a file
codex exec --json "summarize the repo structure" | jq
codex exec "Extract project metadata" --output-schema ./schema.json -o ./project-metadata.json

For CI keys, Codex's docs show CODEX_API_KEY set inline for a single run and warn against a job-level variable in workflows that run repository-controlled code. For GitHub Actions they point to the Codex GitHub Action. Claude Code's docs offer GitHub Actions and GitLab CI/CD integrations, and in -p mode an ANTHROPIC_API_KEY is always used when present.

MCP servers

# Claude Code: remote HTTP server, then sign in with /mcp
claude mcp add --transport http notion https://mcp.notion.com/mcp

# Codex: stdio server, or a remote one with --url, then codex mcp login
codex mcp add context7 -- npx -y @upstash/context7-mcp

Claude Code stores servers at local, project (.mcp.json) or user scope. Connectors you add in claude.ai show up in Claude Code automatically when you are signed in with a claude.ai subscription. Codex stores servers in ~/.codex/config.toml or a trusted project's .codex/config.toml, and /mcp lists them.

Moving between the two

1. Instructions. Codex's /init writes AGENTS.md. Claude Code's docs say it can read AGENTS.md in place of CLAUDE.md, so one file can serve both.
2. MCP servers. Re-add each server with the other tool's command. Config formats differ.
3. Modes. Pick the starting mode on purpose, using the table above. Neither tool inherits the other's settings.
4. Credentials. Run /logout in Claude Code, or remove ~/.codex/auth.json and revoke unused API keys, on machines you retire.

Common mistakes

An API key quietly overriding a subscription. Claude Code uses an approved ANTHROPIC_API_KEY ahead of your subscription login, and /status shows which is active. Codex bills API key use at API rates, not against your plan.

Assuming the Claude Code sandbox is on. It is off until you run /sandbox, and on native Windows it is not available.

Expecting Codex to write in a plain folder. Outside version control it starts read-only. Run git init first, or change the mode.

Running bypass modes on your laptop. Both tools' docs reserve them for containers, VMs or isolated runners.

Treating approval as review. An approved install can still pull in a package with a known vulnerability. Scan the result before you merge.

Keep either plan and do the work with Safeguard

You do not have to pick between these tools and Safeguard. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. To connect a model, see the CLI docs or run /model in a session.

The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. It writes code too, starting from your Safeguard data: the vulnerabilities in your dependencies and your scan results.

Connect Claude to Safeguard over MCP

The second route runs the other way: keep working in Claude or ChatGPT and bring Safeguard in. Safeguard's Claude guide lists the Safeguard entry in Claude's connector directory, or a custom connector at https://mcp.safeguard.sh/mcp/anthropic, signed in with OAuth. Once it is added to your claude.ai account, Claude Code's docs say claude.ai connectors appear in Claude Code too when you sign in with a claude.ai subscription. This demo connects Claude with OAuth and chooses which Safeguard tools Claude can use:

Click through it at your own pace, or open it full screen.

Connect ChatGPT to Safeguard over MCP

Safeguard's OpenAI guide adds a custom MCP server in ChatGPT at https://mcp.safeguard.sh/mcp with OAuth, then you sign in to Safeguard and authorize access. A new workspace starts with a small set of read-only tools, and an administrator enables the rest one at a time. This demo walks through the same steps for ChatGPT:

Click through it at your own pace, or open it full screen.

Codex CLI users can follow Codex's own MCP pattern. Safeguard's docs do not have a Codex page yet, so treat this as the general Codex form pointed at Safeguard's hosted URL:

codex mcp add safeguard --url https://mcp.safeguard.sh/mcp
codex mcp login safeguard

Install and first session

The CLI is a single static binary with no Node, Python or JVM needed, for macOS, Linux and Windows on x86_64 or arm64, with Windows on x86_64 only.

# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash

# Windows (PowerShell)
irm https://cli.safeguard.sh/install.ps1 | iex

Run safeguard to open the interactive terminal, /login to sign in through your browser, and /scan . to scan the current folder. @ attaches a file from the folder you started in, and /resume picks up the last session there.

Writing and fixing code

The assistant has tools for your local files and for your Safeguard data and picks whichever the question needs. Ask it to "fix the lodash CVE in this repo" and it works from your findings, writing files, editing code and running commands with your approval. The docs also give "what's the latest file in ~/Downloads" and "how many critical vulns do we have" as examples, so it doubles as a general terminal assistant for files, code and commands. More in the Safeguard CLI as an AI assistant on your machine.

Approvals

/permissions sets the mode. Ask prompts before every action, close to Claude Code's Manual mode. Auto approves known actions and asks for anything new, and it is the default. Yolo approves everything.

CI with safeguard exec

safeguard scan --dir .
safeguard scan --image your-image:tag
safeguard exec "summarise the critical findings in this repository"

Scans build an SBOM, match it against vulnerability databases and write JSON files such as vuln.json and license.json under ./output. safeguard exec runs one non-interactive assistant turn, the same slot as claude -p or codex exec. Policies and gates are evaluated in the platform, not by the CLI. When the local runner runs platform scan jobs, your source never leaves the machine; only SBOMs and findings are uploaded.

One platform on every surface

Claude Code and Codex both span terminal, editor, desktop and cloud. The download page lists the same reach for Safeguard: the CLI for terminal and CI/CD, a desktop app for Windows, macOS and Linux where you ask your supply chain anything in plain English, iOS and Android apps for checking findings on your phone, VS Code, JetBrains, Open VSX and Chrome extensions, and a Cloud CLI and cloud sandbox with nothing to install. The sandbox is free for seven days with no card.

FAQ

Is Claude Code or Codex CLI open source?

The Codex CLI repository is licensed under Apache 2.0. Claude Code's licence file reads "All rights reserved", with use subject to Anthropic's Commercial Terms. Claude Code's docs say its sandbox is built on the open source sandbox-runtime package.

Can I use either with an API key instead of a subscription?

Yes. Claude Code accepts a Claude Console account or ANTHROPIC_API_KEY, and cloud providers. Codex accepts an API key for local work, billed at API rates; Codex cloud needs a ChatGPT sign-in.

What does each do by default before running a command?

Claude Code starts in auto mode from v2.1.283, where a classifier model reviews actions instead of prompting you. Codex starts in its Auto preset in a git folder, running commands inside the sandbox and asking before it steps outside it.

Do they run on Windows?

Both list Windows installers. Claude Code's Bash sandbox is not available on native Windows; it works inside WSL2. Codex's docs name MXC as its Windows sandbox.

Can one repository work with both?

Yes. Keep instructions in AGENTS.md, which Codex writes with /init and Claude Code can read. Add MCP servers to each tool separately.

If I switch to Safeguard, do I lose my Claude, ChatGPT or Codex plan?

No. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.

Does the Safeguard CLI replace Claude Code or Codex?

It is not a feature-for-feature replacement. It writes and fixes code with an assistant that knows your findings, and scans what any agent changed. Use it on its own or alongside either tool.

Try it yourself

This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.

Click through it at your own pace, or open it full screen.

Keep the tool and the plan you like. Download Safeguard, connect your Claude, ChatGPT or Codex plan, and read the CLI docs. For a wider view of the two assistants, see Claude vs ChatGPT for coding.

Quick check

Sources

• Claude Code repository
• Claude Code licence
• Claude Code docs: Overview
• Claude Code docs: Authentication
• Claude Code docs: Permission modes
• Claude Code docs: Sandboxing
• Claude Code docs: Cloud sessions
• Claude Code docs: MCP
• OpenAI Codex repository
• Codex docs: CLI
• Codex docs: Authentication
• Codex docs: Agent approvals and security
• Codex docs: Pricing and plans
• Codex docs: Cloud
• Codex docs: Non-interactive mode
• Codex docs: MCP
• Safeguard download page
• Safeguard CLI docs
• Safeguard CLI docs: Interactive terminal
• Safeguard docs: MCP server
• Safeguard docs: Connect Claude
• Safeguard docs: Connect ChatGPT

Last reviewed: 21 October 2026.