OpenAI Codex is a coding agent you reach through an open-source CLI, an IDE extension, a desktop app and Codex Cloud, signed in with a ChatGPT plan or an API key. If you want something else, seven open-source alternatives are Gemini CLI, OpenCode, Aider, Cline, Goose, OpenHands and Qwen Code. Claude Code is a proprietary option.
There is one more alternative, and switching to it does not mean giving up what you already pay for. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already work in.
This guide covers what Codex is from OpenAI's own docs, compares the alternatives on facts from their repositories, lines up their sandbox and approval modes, and walks through a move with real commands.
What OpenAI Codex is today
Codex is not one tool. OpenAI's docs list several surfaces that share one account.
Codex CLI. The README calls it "a coding agent from OpenAI that runs locally on your computer". The repository is licensed under Apache 2.0. You install it with a shell script, npm or Homebrew, run codex in a project folder, and choose "Sign in with ChatGPT" or set up an API key. The docs describe an exec mode for pipelines, a resume command, MCP server support, and an /init command that writes an AGENTS.md file.
IDE extension and desktop app. The extension works in VS Code and compatible editors, with Cursor and Windsurf listed as install options; the docs say Xcode and JetBrains provide their own integrations. You can bring open files into a prompt, review edits in place and hand longer work to the cloud. The README says codex app opens the desktop app.
Codex Cloud. You connect GitHub, pick repositories and publish an environment that installs your project's tools. Each task gets its own workspace and can keep running while your computer sleeps. You review the changes and test results, then commit or open a pull request. Internet access is a per-environment setting.
Plans and sign-in. OpenAI's pricing page says Codex is included in the ChatGPT Free, Go, Plus, Pro, Business, Edu and Enterprise plans, with fewer features on Free and Go, and local and cloud work share one allowance. The CLI, IDE extension and desktop app accept a ChatGPT sign-in or an API key for local work. Codex Cloud requires a ChatGPT sign-in, and API key usage is billed at API rates. Credentials are cached in ~/.codex/auth.json or your OS credential store, and the docs say to treat that file like a password.
Sandbox and approvals. The sandbox mode sets what Codex can technically do: read-only, workspace-write, or danger-full-access with no sandbox. The approval policy sets when it must ask: on-request, never, or a granular table. The Auto preset pairs workspace-write with on-request. In that mode network access is off unless you enable it, and .git, .agents, .codex and .aws stay read-only inside the writable folder. Enforcement is at the OS level: Seatbelt on macOS, bwrap with seccomp on Linux.
Codex alternatives compared
Every open-source tool below has a licence we confirmed on its repository page, listed alphabetically after Codex. "Where the agent runs" means where the tool executes; prompts and the files the agent reads still go to the model provider you configure, unless you use a local model.
| Tool | Interface | Licence | Models | Where the agent runs | Approval default we found |
|---|---|---|---|---|---|
| Codex (reference) | CLI, IDE extension, desktop app, Codex Cloud | Apache 2.0 (CLI) | OpenAI, via ChatGPT plan or API key | Your machine in an OS sandbox; Cloud on OpenAI's side | Auto preset: workspace writes, asks to leave the sandbox |
| Aider | Terminal | Apache 2.0 | Most hosted LLMs and local models | Your machine | Commits each edit to git automatically |
| Cline | VS Code, JetBrains, CLI, desktop app, SDK | Apache 2.0 (JetBrains plugin not open source) | Anthropic, OpenAI, Google, OpenRouter, Bedrock, Vertex, local, OpenAI-compatible APIs | Your machine | Extension asks per edit and command; CLI auto-approves by default |
| Gemini CLI | Terminal | Apache 2.0 | Gemini via Google sign-in, API key or Vertex AI | Your machine; sandbox is opt-in | Prompts for approval |
| Goose | Desktop app, CLI, API | Apache 2.0 | 15+ providers, including Anthropic, OpenAI, Google, Ollama, Bedrock | Your machine | Autonomous mode |
| OpenCode | Terminal UI, beta desktop app | MIT | 75+ providers and local models | Your machine | Most actions allowed without a prompt |
| OpenHands | Self-hosted web UI, SDKs, optional cloud | MIT | Any LLM through its settings | Your machine, Docker, VMs or OpenHands Cloud | Not stated on the pages we read |
| Qwen Code | Terminal, plus editor, desktop and web surfaces | Apache 2.0 | OpenAI, Anthropic, Gemini, Qwen APIs, local via Ollama or vLLM | Your machine | Docs name Auto, with a classifier |
Aider
Aider is "AI pair programming in your terminal", a Python tool licensed under Apache 2.0. You start it in a project folder with a model and a key, and it can connect to almost any LLM, including local models. Know before adopting: its git docs say it commits every edit with a generated message and skips pre-commit hooks by default. A flag turns hook checks back on.
Cline
Cline is an Apache 2.0 agent that ships as a VS Code extension, a JetBrains plugin, a desktop app for macOS and Windows, an SDK and a CLI. Its README says every file edit and terminal command needs your approval unless you toggle auto-approve. Know before adopting: the CLI docs list tool auto-approval as on by default, and the README says the JetBrains plugin is not open source.
Gemini CLI
Gemini CLI is Google's Apache 2.0 terminal agent, installed from npm, Homebrew or MacPorts. You sign in with a Google account, a Gemini API key or Vertex AI. Its default approval mode prompts, and full auto-approval can only be switched on from the command line. Know before adopting: the README says that for unpaid tier and Google One users it was replaced by Antigravity CLI on 18 June 2026, and that it is not optimised for the latest Gemini models.
Goose
Goose is a general-purpose Apache 2.0 agent with a desktop app for macOS, Linux and Windows, a CLI and an API. It is part of the Agentic AI Foundation at the Linux Foundation and works with more than 15 providers. Know before adopting: its docs say Autonomous mode is applied by default, which lets it change and delete files without asking. Manual, Smart and Chat Only modes are available.
OpenCode
OpenCode is an MIT-licensed coding agent with a terminal UI and a beta desktop app. Its provider docs list more than 75 providers, local models, and a ChatGPT Plus or Pro sign-in for OpenAI models. Know before adopting: its permission docs say most permissions default to allow. We cover it in open-source OpenCode alternatives.
OpenHands
The OpenHands repository is MIT licensed and presents a self-hosted control centre that runs the OpenHands agent by default and can run other agents too. You can run agents on your machine, in Docker containers, on VMs or on OpenHands Cloud. Know before adopting: the README warns that without a sandbox "the agent will have full access to your filesystem", and it labels the project beta.
Qwen Code
Qwen Code is an Apache 2.0 terminal agent from the Qwen team. It began from Gemini CLI v0.8.2 and has been developed independently since its own v0.1. It supports OpenAI, Anthropic, Gemini and Qwen APIs plus local models, and you can switch provider mid-session. Know before adopting: the npm package needs Node.js 22 or later, and its approval docs name Auto, where an LLM classifier approves or blocks actions, as the default.
If open source is not a requirement: Claude Code
Claude Code is Anthropic's agentic coding tool, with a terminal CLI, VS Code and JetBrains extensions, a desktop app and a web version. Most surfaces need a Claude subscription or an Anthropic Console account, and the CLI also supports third-party providers. Its licence file says "All rights reserved" under Anthropic's Commercial Terms, so it is not open source. Its docs say that from v2.1.283, auto mode, where a classifier reviews actions, is the built-in starting mode for terminal and VS Code sessions, and that an optional OS-level sandbox covers shell commands.
Sandbox and approval modes side by side
A sandbox limits what a command can touch even if the agent is tricked. An approval prompt decides when you get asked. This table uses each tool's own names.
| Tool | Modes you can pick | Default we found | Sandbox |
|---|---|---|---|
| Codex | read-only, workspace-write, danger-full-access; approvals on-request, never, granular | Auto preset (workspace-write with on-request) | OS-level, network off in workspace-write |
| Claude Code | Manual, acceptEdits, plan, auto, dontAsk, bypassPermissions | auto from v2.1.283 | Optional OS-level sandbox for shell commands |
| Gemini CLI | default, auto_edit, plan, and yolo from the command line | default | Opt-in: Seatbelt, Docker, Podman, gVisor and others |
| Qwen Code | Plan, Ask Permissions, Auto-Edit, Auto, YOLO | Auto | Listed as a feature |
| Goose | Autonomous, Manual, Smart, Chat Only | Autonomous | Not described on the pages we read |
| Cline CLI | Plan or Act, auto-approve on or off | Act, auto-approve on | Not described on the pages we read |
| OpenCode | allow, ask or deny per permission | Mostly allow | Not described on the pages we read |
| Aider | Auto-commits on or off | Auto-commit, hooks skipped | None; git history is the undo |
Two Codex habits are worth keeping wherever you go: the .git folder stays read-only even when writes are allowed, and network stays off until you ask for it. If your new tool does not do that by default, set it up where the tool allows it.
Which alternative fits: decision guide and migration
Decision guide
- You want to keep your ChatGPT, Claude or Codex plan. The Safeguard CLI lets you use it, as covered below. OpenCode's docs also offer a ChatGPT Plus or Pro sign-in.
- You need many providers or local models. Aider, Cline, Goose, OpenCode and Qwen Code list local models and several hosted providers.
- Your team is on Google Cloud. Gemini CLI signs in with a Google account or Vertex AI. Check the Antigravity note if you are on an unpaid tier.
- You want an editor-first workflow. Cline has VS Code and JetBrains extensions, and Codex, Claude Code and Safeguard have editor integrations too.
- You want agents on your own servers. OpenHands is built to be self-hosted.
- You want the agent to know your vulnerabilities. That is the Safeguard CLI, alone or after any tool above.
Migration steps
Step 1: Carry over your instructions. If you used /init in Codex, you have an AGENTS.md file. Claude Code's docs say it can read AGENTS.md in place of CLAUDE.md. For other tools, check which file they read.
Step 2: Move MCP servers. Check what you added with codex mcp and add the same servers to the new tool.
Step 3: Install the new agent and set approvals first.
# Gemini CLI with the sandbox on
npm install -g @google/gemini-cli
gemini -s
# Cline CLI with auto-approval off
npm i -g cline
cline --auto-approve false "add input validation to the signup handler"
# Aider, running your pre-commit hooks
python -m pip install aider-install
aider-install
aider --git-commit-verify
Step 4: Work on a branch and take a baseline.
git switch -c agent/signup-validation
curl -fsSL https://cli.safeguard.sh/install | bash
safeguard scan --dir .
The scan builds an SBOM and matches it against vulnerability databases. Results land as JSON files under ./output, including vuln.json and license.json.
Step 5: Replace codex exec in CI. Each alternative has a headless form, and a dependency check should sit beside it:
# What Codex's docs suggest for read-only, non-interactive runs
codex exec --sandbox read-only --ask-for-approval never "review this diff"
# Claude Code
git diff main --name-only | claude -p "review these changed files for security issues"
# Cline CLI reads piped input headless
git diff origin/main...HEAD | cline "review these changes"
# A check that does not depend on the agent
safeguard scan --dir .
safeguard exec "summarise the critical findings in this repository"
Step 6: Clean up credentials. If you stop using Codex on a machine, remove the cached login in ~/.codex/auth.json or your OS credential store, and revoke API keys you no longer need.
Common mistakes
Assuming the new tool keeps Codex's defaults. Goose starts autonomous, the Cline CLI auto-approves, and OpenCode allows most actions. Set modes before the first run.
Leaving network open in CI. Not every tool here documents a network control. Run agents in a container you already isolate.
Forgetting hooks. Aider skips pre-commit hooks by default. Turn them on if they run your checks.
Letting the agent work on main. Use a branch so a bad run is one command to throw away.
Treating approval as review. An approved command can still pull in a package with a known CVE. Scan the result, as our guide to checking coding agent changes explains.
Switch to Safeguard and keep your plan
Every agent above can write code. The Safeguard CLI writes code too, and it starts from your Safeguard data: the vulnerabilities in your dependencies and your scan results. It scans code, container images and SBOMs on your own machine, sends only the results to the platform, and includes an assistant that can fix what it finds. You can switch to it outright or run it after another agent.
Keep the Claude, ChatGPT or Codex plan you pay for
Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. To connect a model, see the CLI docs or run /model in a session.
The other route runs the opposite way. Connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from the chat you already have open. This demo connects Claude with OAuth and chooses which Safeguard tools Claude can use:
Click through it at your own pace, or open it full screen.
Install and first session
The CLI is a single static binary with no Node, Python or JVM needed. It runs on macOS, Linux and Windows, on x86_64 or arm64, with Windows on x86_64 only.
# macOS and Linux
curl -fsSL https://cli.safeguard.sh/install | bash
# Windows (PowerShell)
irm https://cli.safeguard.sh/install.ps1 | iex
Run safeguard with no arguments to open the interactive terminal. Type /login to sign in through your browser, then /scan . to scan the folder you are in. @ attaches a file from the folder you started in, /resume picks up the last session in that folder, and /model shows or switches the AI model.
Writing and fixing code on your machine
The assistant has tools for local files and for your Safeguard data and picks whichever the question needs. Ask it to "fix the lodash CVE in this repo" and it works from your actual findings, then writes files, edits code and runs commands, with your approval. The same tools make it a general terminal assistant: the docs give "what's the latest file in ~/Downloads" as an example. You can find and read files, edit code and run commands, then ask about your vulnerabilities in the same conversation.
This demo attaches a computer running the Safeguard CLI and a folder, asks for a fix, reviews the diff and approves the command before it runs. The demo notes that computer work from Search is available and expanding:
Click through it at your own pace, or open it full screen.
Approvals
Tools that change things ask before they act. /permissions sets how often: Ask prompts before every action, Auto approves known actions and asks for anything new (the default), and Yolo approves everything. For shared or sensitive repositories, Ask is the cautious choice.
Scans and CI with safeguard exec
The scan command takes a folder, a repository URL, a container image or an SBOM file. safeguard validate checks CycloneDX, SPDX and VEX documents, and safeguard exec runs one non-interactive assistant turn for pipelines:
safeguard scan --dir .
safeguard scan --repo https://github.com/your-org/your-repo
safeguard scan --image your-image:tag
safeguard scan --sbom bom.json
safeguard exec "summarise the critical findings in this repository"
Policies and gates are evaluated in the Safeguard platform, not by the CLI. When the local runner handles platform scan jobs, your source code never leaves your machine; only SBOMs and findings are uploaded. The platform adds reachability analysis and autonomous remediation with fix pull requests, which is off by default. For more, read the Safeguard CLI as a security-aware coding assistant.
One platform on every surface
Codex spans a CLI, an editor and the cloud. Safeguard does the same, and the download page lists each surface. Start in the terminal with the CLI, which also runs in CI/CD. Continue in the desktop app for Windows, macOS and Linux, the whole platform in its own window. Check findings on your phone with the iOS and Android apps. In your editor, use the VS Code, JetBrains or Open VSX extension, and in Chrome, the browser extension.
If you would rather install nothing, the Cloud CLI runs the CLI on Safeguard's infrastructure, the cloud browser streams a Safeguard session to your tab, and the cloud sandbox gives you an isolated tenant against a seeded demo repo, free for seven days with no card.
FAQ
Is OpenAI Codex open source?
The Codex CLI repository is licensed under Apache 2.0. Codex Cloud is a hosted service that runs tasks on OpenAI's side, so the CLI's licence does not describe it.
Which ChatGPT plans include Codex?
OpenAI's pricing page lists Free, Go, Plus, Pro, Business, Edu and Enterprise, with fewer features on Free and Go. Local and cloud work share your plan's allowance.
Can I use Codex with an API key instead of a ChatGPT plan?
Yes, for local work in the CLI, IDE extension and desktop app, billed at API rates. Codex Cloud needs a ChatGPT sign-in.
If I switch to Safeguard, do I lose my Claude, ChatGPT or Codex plan?
No. Bring the Claude, ChatGPT or Codex plan you already pay for and use it inside the Safeguard CLI. Safeguard adds no extra charge for that usage; your plan's own usage limits and terms still apply. You can also connect Claude or ChatGPT to the Safeguard MCP server and use Safeguard from that chat.
Does the Safeguard CLI replace Codex?
It is not a feature-for-feature replacement for Codex or any tool here. It writes and fixes code with an assistant that knows your findings, and it scans what any agent changed. You can switch to it, or keep your agent and add it before merge.
Which approval mode should I use in CI?
The narrowest one that works. Codex's docs suggest a read-only sandbox with approvals set to never for review jobs. For Safeguard, safeguard exec runs a single non-interactive turn.
Does my source code leave my machine?
With any coding agent, prompts and the files it reads go to the model provider you configure. With Safeguard scans, results go to the platform, and when the local runner handles platform scan jobs only SBOMs and findings are uploaded.
Can I use the Safeguard CLI for work that is not security?
Yes, within what its tools cover. It can find and read local files, edit code and run commands, with your approval, alongside questions about your Safeguard data.
Try it yourself
This walkthrough sets up the runner on your own machine: pick the platform, start it, approve it with its device code, then use the same CLI to scan from the terminal.
Click through it at your own pace, or open it full screen.
Switch without giving anything up. Download Safeguard, connect the Claude, ChatGPT or Codex plan you already have, and read the CLI docs before your next merge. Weighing desktop agents too? See our T3 Code alternatives.
Quick check
In Codex's workspace-write mode, can the agent change your .git folder?
No. Codex's docs say .git, .agents, .codex and .aws stay read-only even inside the writable folder, and network access is off unless you enable it.
Does approving an agent's command mean the change is safe to merge?
No. Approval tells you what the agent wants to run, not whether the code or dependencies it added carry known vulnerabilities. Scan the change, for example with the Safeguard CLI, before you merge.
Sources
- OpenAI Codex repository
- Codex docs overview
- Codex docs: CLI
- Codex docs: IDE extension
- Codex docs: Cloud
- Codex docs: Pricing and plans
- Codex docs: Authentication
- Codex docs: Agent approvals and security
- Claude Code docs: Overview
- Claude Code docs: Permissions
- Claude Code docs: Permission modes
- Claude Code licence
- Aider repository
- Aider docs: Git integration
- Cline repository
- Cline CLI docs
- Gemini CLI repository
- Gemini CLI docs: Sandbox
- Gemini CLI docs: Configuration
- Goose repository
- Goose docs: Permission modes
- OpenCode repository
- OpenCode docs: Providers
- OpenCode docs: Permissions
- OpenHands repository
- Qwen Code repository
- Qwen Code docs: Approval modes
- Safeguard download page
- Safeguard CLI docs
- Safeguard CLI docs: Interactive terminal
Last reviewed: 21 October 2026.
