Anthropic's coding agent is Claude Code and OpenAI's is Codex. Both run in a terminal, in IDEs, in a desktop app and as cloud tasks, and both sign in with a chat subscription or an API account. They differ in which plans include them, how approvals and sandboxing work, and which admin controls exist.
If you want an alternative, you can switch to Safeguard and keep what you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use. The Safeguard section below shows both, with interactive demos.
This post does not pick a winner. Every fact about Anthropic's and OpenAI's products comes from their own docs and pricing pages, fetched on 21 October 2026 and listed under Sources. Both change often, so recheck the linked pages before you buy.
The products at a glance
Both companies ship a chat app and a coding agent that share one account.
Claude Code is described in Anthropic's docs as "an agentic coding tool that reads your codebase, edits files, runs commands, and integrates with your development tools." It runs in the terminal, in VS Code and Cursor, in JetBrains IDEs, in the Claude desktop app and on the web at claude.ai/code. The docs say each surface "connects to the same underlying Claude Code engine," so CLAUDE.md files, settings and MCP servers carry across.
Codex is OpenAI's coding agent. OpenAI's docs list it as available in the ChatGPT desktop app, the ChatGPT mobile app, ChatGPT on the web, the Codex CLI, the Codex IDE extension and Codex Cloud. The Codex CLI repository describes it as "a coding agent from OpenAI that runs locally on your computer."
| Claude (Anthropic) | ChatGPT (OpenAI) | |
|---|---|---|
| Coding agent name | Claude Code | Codex |
| Chat apps | Claude on web, desktop and the Claude app for iOS and Android | ChatGPT on web, desktop and mobile |
| Terminal | claude CLI on macOS, Linux, WSL and Windows | codex CLI on macOS and Linux, with a Windows installer and a Windows sandbox |
| IDE | VS Code extension (also installs in Cursor); JetBrains plugin that needs the CLI | Codex extension for VS Code, Cursor and Windsurf; JetBrains and Xcode have their own integrations |
| Desktop app | Claude desktop app with a Code tab, on macOS, Windows and Ubuntu or Debian (beta) | ChatGPT desktop app |
| Cloud tasks | Cloud sessions at claude.ai/code, from mobile, desktop or claude --cloud | Codex Cloud, started from the web or handed off from the CLI or IDE |
| CLI source licence | Not stated on the pages we fetched | Apache-2.0, per the openai/codex repository |
| Non-interactive mode | claude -p "task" | codex exec |
Install commands, from each vendor's docs:
# Claude Code (macOS, Linux, WSL)
curl -fsSL https://claude.ai/install.sh | bash
# Codex CLI (macOS, Linux)
curl -fsSL https://chatgpt.com/codex/install.sh | sh
# or
npm install -g @openai/codex
brew install --cask codex
Sign-in, plans and where code runs
A chat subscription, an API account and a cloud provider account are three different routes, and they unlock different features.
Claude Code sign-in. Run claude and it opens a browser to log in. Anthropic lists these account types: a Claude Pro or Max subscription, Claude for Teams or Enterprise, the Claude Console (API billing), cloud providers (Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry) and a self-hosted Claude apps gateway with corporate SSO. For CI, claude setup-token prints a one-year OAuth token, which needs a Pro, Max, Team or Enterprise plan.
Codex sign-in. OpenAI offers "Sign in with ChatGPT for subscription access" or "Sign in with an API key for usage-based access." The desktop app, CLI and IDE extension support both for local work, and the CLI and extension share one cached login. Codex Cloud requires ChatGPT sign-in, and email and password accounts must set up MFA first. For headless machines the docs suggest codex login --device-auth (beta).
| Claude Code | Codex | |
|---|---|---|
| Subscription plans that include it | Pro, Max, Team, Enterprise (Free does not, per the pricing page) | Free, Go, Plus, Pro, Business, Edu, Enterprise |
| API billing route | Claude Console account or API key | OpenAI API key, billed at API pricing |
| Cloud provider route | Bedrock, Google Cloud's Agent Platform, Microsoft Foundry | Not covered on the pages we fetched |
| Cloud tasks need | A claude.ai account on Pro, Max or Team, or Enterprise premium or Chat + Claude Code seats | ChatGPT sign-in (not an API key), with MFA |
| Where local work runs | Your machine | Your machine |
| Where cloud work runs | An isolated Anthropic-managed VM, or your own self-hosted environment | A per-task cloud workspace; OpenAI's security page describes isolated OpenAI-managed containers |
| How cloud results come back | Diff view, then a pull request, or claude --teleport into your terminal | Review changed files and test results, then commit or open a pull request |
| Repository host for cloud | GitHub for cloning and PRs; other hosts can upload a bundle but can't push back | GitHub |
Anthropic says cloud sessions count toward your plan's usage limits and "there's no separate charge for the cloud VM." Cloud sessions, Code Review and Remote Control need a claude.ai account, not Console keys or cloud provider credentials alone. OpenAI says that with an API key, "some features that rely on ChatGPT workspace access or cloud services are limited or unavailable." Prices and usage limits are on the two pricing pages under Sources.
Approvals, sandboxing, MCP and admin controls
An agent needs two controls: when it must stop and ask, and what it cannot reach. Both vendors separate these.
Claude Code permission modes. Anthropic lists six modes. default (shown as Manual) runs reads only without asking. acceptEdits also allows file edits and common filesystem commands. plan reads and proposes without editing source. auto lets a second model, a classifier, review actions in place of you. dontAsk denies anything that would prompt, for locked-down CI. bypassPermissions runs everything and is meant for "isolated containers and VMs only." From v2.1.283, auto is the starting mode for interactive terminal and VS Code sessions. You switch with Shift+Tab.
Claude Code sandbox. The Bash sandbox is "off by default." Turn it on with /sandbox or sandbox.enabled. It uses Seatbelt on macOS and bubblewrap on Linux and WSL2; on native Windows, commands run unsandboxed. It covers shell commands only. File tools, MCP servers and hooks run outside it.
Codex approvals and sandbox. Codex pairs an approval policy with a sandbox mode. In a version-controlled folder the default is the Auto preset: workspace-write sandbox with on-request approvals, so it edits and runs commands in the working directory and asks before going outside it or using the network. Non-version-controlled folders start read-only. The docs state: "By default, the agent runs with network access turned off." danger-full-access removes the sandbox, and --dangerously-bypass-approvals-and-sandbox (alias --yolo) removes both, which OpenAI marks "not recommended." The sandbox uses Seatbelt on macOS, bubblewrap on Linux and WSL2, and a Windows sandbox in native PowerShell.
# Claude Code: start in plan mode, then turn on the shell sandbox
claude --permission-mode plan
/sandbox
# Codex: run with on-request approvals in the workspace sandbox
codex
/permissions
| Claude Code | Codex | |
|---|---|---|
| Ask-before-acting modes | default (Manual), acceptEdits, plan, auto, dontAsk, bypassPermissions | on-request, never, granular approval policies; Auto and read-only presets |
| Starting behaviour | auto mode (v2.1.283 and later) | Auto preset in version-controlled folders, read-only elsewhere |
| OS sandbox default | Off until you enable it | On (workspace-write) |
| Network inside sandbox | Domain allowlist you configure | Off by default |
| MCP transports | stdio, HTTP (recommended), SSE (deprecated), WebSocket | stdio, streamable HTTP |
| Add a server | claude mcp add --transport http NAME URL | codex mcp add NAME -- COMMAND |
| MCP config scope | local, project (.mcp.json), user | ~/.codex/config.toml, or .codex/config.toml in trusted projects |
| MCP OAuth | Yes | Yes, including CIMD and DCR |
| Admin policy delivery | claude.ai admin console (Teams, Enterprise), MDM plist or registry, managed-settings.json | Agent security in the Admin Console, requirements.toml |
| Login enforcement | forceLoginMethod, forceLoginOrgUUID | forced_login_method, forced_chatgpt_workspace_id |
| Lock approval modes | permissions.disableBypassPermissionsMode, permissions.defaultMode | allowed_approval_policies, permission profiles |
| MCP allowlist | allowedMcpServers, deniedMcpServers, managed-mcp.json | mcp_servers allowlist; an empty list disables all |
| Usage visibility | Analytics dashboard, OpenTelemetry export, Analytics APIs | Workspace analytics, Usage Insights, Analytics API |
| Audit | Compliance API on Enterprise | Compliance API and audit events |
On data handling, Anthropic's admin guide says that on Team, Enterprise, Claude API and cloud provider plans "Anthropic doesn't train models on your code or prompts," and Zero Data Retention is available to qualified Enterprise accounts. OpenAI's admin section links to its compliance, HIPAA and governance pages.
Which setup fits: solo developer, startup team, regulated enterprise
These are the facts each type of buyer usually needs to check, not a recommendation.
Solo developer. Your first question is which plan you already have. Codex is listed in every ChatGPT plan from Free upward. Claude Code needs Pro or above. If you want tasks to keep running with the laptop closed, both offer cloud tasks, and both connect to GitHub for that.
A first session looks like this on either tool:
cd my-project
claude # browser login on first run
# or
codex # choose Sign in with ChatGPT
Startup team. Look at seats and central settings. Claude for Teams adds SSO and server-managed settings for Claude Code. ChatGPT Business includes Codex, and admins set policies in Agent security. Decide early whether CI will use a subscription token (claude setup-token) or an API key, since OpenAI suggests API keys for "automation in shared environments like CI."
Regulated enterprise. Check four things on each side: login enforcement, a non-overridable policy file, an MCP allowlist and audit export. Both have all four, listed in the table above. Also check the cloud path separately. Anthropic notes that organizations with Zero Data Retention or the HIPAA configuration can't use cloud sessions, and that IP allowlisting breaks Anthropic-hosted cloud sessions unless exempted. OpenAI notes that ChatGPT Work Cloud "does not inherit these Agent Security requirements," so local and cloud policies need separate review.
Whatever you choose, keep a dependency check between the agent and your main branch. Our guide on checking what a coding agent changed walks through a before and after scan.
Common mistakes
Leaving an API key in the environment. Once you approve ANTHROPIC_API_KEY, Claude Code uses it ahead of your subscription login, and requests fail if the key belongs to a disabled or expired organization. Run /status to see which credential is active.
Assuming the sandbox is on. In Claude Code the Bash sandbox is off by default and does not cover file tools or MCP servers. In Codex the sandbox is on by default but danger-full-access or --yolo removes it.
Using bypass modes on a laptop. Anthropic scopes bypassPermissions to isolated containers and VMs. OpenAI marks the bypass flag not recommended.
Trusting every project MCP file. Anthropic warns that servers that fetch external content "can expose you to prompt injection risk," and prompts before loading project-scoped servers. Codex only reads project config in trusted projects.
Plugging a subscription into tools without reading the terms. Each provider sets its own rules for where a subscription can be used. Read them before you connect a plan to anything.
Merging agent changes without a dependency check. A diff shows lines changed. It does not show whether a new package version carries a known CVE.
Do the work properly with the Safeguard CLI
The Safeguard CLI scans code, container images and SBOMs on your own machine, sends only the results to the Safeguard platform, and includes an assistant that can fix what it finds. It also writes code, not only scans. That makes it the way to do the work properly: write and fix code with an assistant that also knows your vulnerabilities, scan what any agent changed before you merge, and keep source on your machine. For a longer tour, see the Safeguard CLI as a security-aware coding assistant.
Keep the plan you already pay for
Switching to Safeguard does not mean giving up Claude, ChatGPT or Codex. You keep them in two ways.
Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. Use /model to see or switch the AI model, and see the CLI docs for connecting a model.
The second way runs the other direction: connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use. This demo connects Claude to the Safeguard MCP server with OAuth and chooses which tools Claude can use.
Click through it at your own pace, or open it full screen.
This one does the same for ChatGPT: connect it to the Safeguard MCP server with OAuth and choose which tools ChatGPT can use.
Click through it at your own pace, or open it full screen.
Install
The CLI is a single static binary. You don't need Node, Python or a JVM. It runs on macOS, Linux and Windows, on x86_64 or arm64 (Windows is x86_64 only).
# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash
# Windows
irm https://cli.safeguard.sh/install.ps1 | iex
First session
Run safeguard with no arguments to open the interactive terminal. Type /login to sign in through the browser, then /scan . to scan the current folder. After that you can ask in plain language, for example "how many critical vulns do we have". Use @ to attach a file from the folder you started in, and /resume to pick up the last session in that folder.
For scripted scans, use the subcommands:
safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:tag
safeguard scan --sbom ./bom.json
safeguard validate ./bom.json
Each scan builds an SBOM and matches it against vulnerability databases. Results land as JSON files under ./output, including vuln.json and license.json. safeguard validate checks CycloneDX, SPDX and VEX documents.
Writing and fixing code on your machine
The assistant has tools for your local files and for your Safeguard data, and it picks whichever the question needs. Ask "fix the lodash CVE in this repo" and it can read the finding, edit the code and run commands to check the result, with your approval. You can also use it for ordinary tasks on your machine, such as "what's the latest file in ~/Downloads", finding and reading files, editing code or running a command. Every action that changes something asks first, under the approval mode you set.
Approvals
/permissions sets how the assistant asks:
- Ask: prompt before every action.
- Auto: approve known actions and ask for anything new. This is the default.
- Yolo: approve everything.
If you are new to agents, start with Ask. You see each file write, code edit and command before it happens.
CI with safeguard exec
safeguard exec runs one non-interactive assistant turn, which suits a pipeline step:
safeguard scan --dir .
safeguard exec "summarise the critical findings in this repository"
When the local runner runs platform scan jobs, your source code never leaves the machine; only SBOMs and findings are uploaded. Policies and gates are evaluated in the Safeguard platform, not by the CLI. On the platform you also get reachability analysis, autonomous remediation with fix PRs (off by default), and MCP Guardrail.
A practical pattern with either Claude Code or Codex: scan before the agent session, let the agent work, scan again, and ask the Safeguard assistant to fix anything new with approval set to Ask.
One platform on every surface
The download page lists the same platform on every surface, so you can start in the terminal, continue on the desktop and check findings on your phone.
- Safeguard CLI: one static binary for macOS, Linux and Windows, for the terminal and CI/CD.
- Desktop app for Windows, macOS and Linux (version 3.2.2 on the page): ask your supply chain anything in plain English in a native window.
- Mobile apps for iOS on the App Store and Android on Google Play.
- IDE extensions for VS Code, JetBrains and Open VSX editors, plus a browser extension for Chrome.
- Cloud options with nothing to install: the Cloud CLI on Safeguard's infrastructure, a cloud browser, and a cloud sandbox tenant against a seeded demo repo, free for seven days with no card.
Download the Safeguard CLI and read the CLI docs to get started.
FAQ
Is Claude Code included in the free Claude plan?
No. Anthropic's pricing page marks Claude Code as included on Pro, Max, Team and Enterprise, and not on Free. Codex, by contrast, is listed for ChatGPT Free, Go, Plus, Pro, Business, Edu and Enterprise.
Do Claude Code and Codex run my code on their servers?
Local sessions run on your machine in both cases. Cloud tasks run remotely: Claude Code cloud sessions run in an isolated Anthropic-managed VM (or your own self-hosted environment), and Codex Cloud gives each task its own cloud workspace.
Which one has a sandbox on by default?
Codex starts in the workspace-write sandbox for version-controlled folders, with network off. Claude Code's Bash sandbox is off until you run /sandbox or set sandbox.enabled, and its permission modes control prompts separately.
Do both support MCP?
Yes. Claude Code supports stdio, HTTP, SSE (deprecated) and WebSocket servers. Codex supports stdio and streamable HTTP servers, configured in config.toml and shared across its desktop app, CLI and IDE extension.
Can admins lock settings so developers can't change them?
Yes. Claude Code reads managed settings from the claude.ai admin console, MDM or a managed-settings.json file, and these take precedence over user settings. Codex reads requirements set in Agent security or requirements.toml, which OpenAI calls "admin-enforced constraints that users can't override."
Can I switch to Safeguard and keep my Claude, ChatGPT or Codex plan?
Yes. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already use.
Does the Safeguard CLI act without asking?
Not unless you choose that. Writing files, editing code and running commands ask before they act, according to the /permissions mode. Auto is the default, Ask prompts every time, and Yolo approves everything.
Try it yourself
This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.
Click through it at your own pace, or open it full screen.
Quick check
Which Codex sign-in method does Codex Cloud require?
Sign in with ChatGPT. An API key works for local Codex but not for Codex Cloud, and email and password accounts need MFA first.
Is the Claude Code Bash sandbox on by default?
No. It is off by default. Turn it on with /sandbox or the sandbox.enabled setting. It uses Seatbelt on macOS and bubblewrap on Linux and WSL2.
Sources
- Claude Code overview
- Claude Code authentication
- Claude Code permission modes
- Claude Code sandboxing
- Claude Code in the cloud
- Claude Code MCP
- Set up Claude Code for your organization
- Claude pricing
- Claude Code repository
- Codex docs home
- Codex pricing
- Codex authentication
- Codex agent approvals and security
- Codex sandboxing
- Codex CLI
- Codex IDE extension
- Codex Cloud
- Codex MCP
- Codex administration
- Codex security administration
- Codex managed configuration
- openai/codex repository
- Safeguard CLI docs
- Safeguard download page
Last reviewed: 21 October 2026.
