HarnessMatch
Menu

Coding agent

Codex

Agentic coding across app, terminal, IDE, cloud, and automation.

Status
Active
License
Apache-2.0 client
Evidence
Documented + code-verifiable + independently measured configuration, 46 sources
Product record checked
2026-07-27
Compare harnessesInspect sources

At a glance

OpenAI's coding agent across desktop, terminal, IDE, cloud, SDK, and CI, with default local sandboxing, managed permission policy, MCP, hooks, subagents, persistent memories, worktrees, browser tools, and optional local or custom model providers.

Good choice if

  • ChatGPT subscribers who want one agent across app, IDE, and terminal
  • Headless repository tasks and CI-style workflows
  • Users who value sandbox boundaries and parallel delegation

Check before choosing

  • The standard local workspace sandbox limits writes and disables network access, but legacy modes can still read beyond the project; least-privilege permission profiles are beta and do not compose with legacy sandbox settings
  • Auto-review can replace a human at eligible sandbox-boundary prompts, but it only reviews requested escalations, can make mistakes, and is not a deterministic security guarantee
  • Worktrees isolate Git checkouts rather than processes and are a desktop-app workflow; local chats can still operate directly in the user's checkout
See 6 more considerations
  • There is no product-level file checkpoint: review-pane Git revert and session resume do not reverse arbitrary shell, browser, MCP, or remote-system side effects
  • Browser and Computer Use can act outside the repository; the browser uses a separate profile, while Computer Use requires OS-level screen and accessibility access plus attended approval
  • Remote connections inherit the connected host's projects, files, credentials, permissions, plugins, browser setup, and local tools rather than creating a separate isolation boundary
  • Hosted access remains centered on OpenAI models; custom, Bedrock, Ollama, and LM Studio paths add flexibility but model quality and compatibility are separate from the harness
  • Codex Security is an optional plugin or cloud vulnerability workflow, not evidence that the base harness or selected model will find every vulnerability
  • The Apache-2.0 repository exposes the CLI, SDK, app server, sandbox, tests, and rollout tooling, but not the proprietary IDE extension or Codex cloud service

Why it qualifies as a coding harness

This confirms category fit, not product quality. Every required criterion links back to first-party evidence.

Qualifies4 of 4 required criteria evidenced

  • Adaptive agent loop

    Documented

    The system repeatedly observes results and chooses the next action instead of following a fixed one-pass graph.

    EvidenceCodex CLI

  • Repository tool execution

    Documented

    The system can use tools to inspect and change a repository or its execution environment.

    EvidenceDeveloper command reference

  • Task-aware context management

    Documented

    The runtime assembles, updates, compacts, retrieves, or persists task-relevant context while work proceeds.

    EvidenceAGENTS.md instructions

  • Model-independent runtime control

    Documented

    Permissions, budgets, interruption, policy, or stop controls operate outside the model's own text generation.

    EvidenceApprovals and security

Membership establishes category fit only. It does not score quality, safety, autonomy, model capability, or benchmark performance. · Read the membership rule.

How it works under the hood

Seven mechanisms mapped from first-party records. These labels describe what the harness provides, not how intelligent its model is.

7/7layers documented
  • Execution & isolationSandbox availableDocumented mechanism, not a performance score.
  • Tooling & integrationsExtensible + browserDocumented mechanism, not a performance score.
  • Context & statePersistent stateDocumented mechanism, not a performance score.
  • Lifecycle & recoverySession resumeDocumented mechanism, not a performance score.
  • ObservabilityStructured tracesDocumented mechanism, not a performance score.
  • VerificationTool-assistedDocumented mechanism, not a performance score.
  • Governance & permissionsPolicy controlsDocumented mechanism, not a performance score.

Public code audit

4/5public artifacts present
Security policy
Present at inspected commit
CI workflow
Present at inspected commit
Automated tests
Present at inspected commit
Evaluation assets
Not found
Contributor documentation
Present at inspected commit

The stable 0.145.0 tree exposes the CLI, SDK, app server, OS sandboxes, rollout trace implementation, 620 test-like files, and 26 workflows. It does not expose the proprietary IDE extension or Codex cloud service, and no product benchmark suite was found.

Inspect commit 25af12f7e61572b0bc18ddb1008be543b91519b0, checked 2026-07-27

Capability support

Documented first-class product support, checked against the sources below.

External tools (MCP)
DocumentedProduct-supported MCP integrationSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Local models
DocumentedLocal or self-hosted model pathSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Agent parallelism
DocumentedDelegated or parallel agent workflowSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Runs without an open UI
DocumentedNon-interactive or automation surfaceSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Browser control
DocumentedBuilt-in or product-supported browser controlSource · checked 2026-07-27The source establishes the mechanism, not its quality or availability in every mode.
Isolated execution
Available by defaultSandbox-first local CLI and managed cloud executionSource · checked 2026-07-27The effective boundary still depends on the selected sandbox and approval policy.
Undo file changes
Not documentedNo first-class support established by the current recordAbsence of current documentation is not proof that the capability is impossible.

Primary evidence

Each capability claim is tied to a first-party record and a verification date.

Product record checked 2026-07-27
Codex CLIInteractive terminal client, installation, authentication, sessions, and supported workflowsOfficial docsDeveloper command referenceCLI, exec mode, approvals, sandbox flags, and local providersOfficial docsApprovals and securityDefault local sandbox, approval policies, cloud isolation, network controls, and threat boundariesOfficial docsSandboxingNative command isolation across desktop, CLI, and IDE, filesystem and network boundaries, and approval escalationOfficial docsAuto-reviewReviewer-agent handling of eligible sandbox escalations, unchanged boundaries, circuit breakers, overrides, and non-deterministic limitsOfficial docsPermission profilesBeta least-privilege filesystem and network profiles plus legacy-mode incompatibilityOfficial docsPermission modesApproval-oriented, automatic, full-access, and custom local action modes across desktop, CLI, and IDE surfacesOfficial docsCommand rulesExperimental prefix rules for allow, prompt, or forbid decisions when commands request execution outside the sandboxOfficial docs
View 38 additional sources
Product and interfaces6 sources
Codex cloudDelegated cloud tasks, isolated environments, repository workflows, and review surfaceOfficial docsBrowserShared browser surface, separate profile, site interaction, downloads, and safety guidanceOfficial docsComputer UseDesktop GUI control, plugin setup, OS permissions, attended review, and external side effectsOfficial docsRemote connectionsMobile and desktop steering of connected hosts, inherited credentials and permissions, SSH projects, approvals, and reviewOfficial docsIDE extensionVS Code-compatible, Xcode, and JetBrains integrationsOfficial docsChatGPT desktop appDesktop project, file, long-running work, parallel chat, worktree, browser, plugin, and scheduled-task surfaceOfficial docs
Execution and control2 sources
Windows sandboxNative Windows filesystem and network isolation, PowerShell operation, setup, protected paths, and troubleshootingOfficial docsCloud internet accessDefault offline agent phase, domain allowlists, methods, secrets, and exfiltration risksOfficial docs
Agents, state and recovery7 sources
SubagentsDefault parallel delegation, custom agent roles, tools, models, and token overheadOfficial docsCodex memoriesLocal persistent memory store, controls, scopes, and distinction from required project rulesOfficial docsAGENTS.md instructionsGlobal and project instruction discovery, nested overrides, precedence, size limits, and code-review guidanceOfficial docsExecution environmentsLocal, Git-worktree, and cloud execution modes in the desktop appOfficial docsGit worktreesParallel checkout isolation, scheduled-task worktrees, handoff, and Git-only constraintsOfficial docsLocal environmentsDesktop worktree setup scripts, shared project actions, generated configuration, and execution timingOfficial docsCloud environmentsContainer creation, dependency setup, default-off agent internet, AGENTS.md use, validation loop, and diff handoffOfficial docs
Automation and extensions12 sources
Non-interactive modecodex exec scripting, CI operation, structured output, sandbox, and approval settingsOfficial docsLifecycle hooksPre and post tool gates, validation, logging, subagent events, trust, and side-effect limitsOfficial docsModel Context ProtocolLocal and remote MCP server supportOfficial docsSkills and pluginsReusable instruction packages, installable bundles, connector-backed MCP tools, resources, and supported surfacesOfficial docsPluginsPlugin discovery, installation, supported ChatGPT and Codex surfaces, connected tools, and availability controlsOfficial docsCodex GitHub ActionCI installation, codex exec, patch and review workflows, secrets, and safety strategyOfficial docsCode reviewRead-only review of local or branch changes, prioritized findings, review pane, and user-controlled staging or revertOfficial docsGitHub code reviewPull-request review setup, manual and automatic triggers, AGENTS.md rules, permissions, and posted GitHub findingsOfficial docsCodex SecurityOptional security plugin and cloud workflows for repository scans, code-change review, finding triage, fixes, and reportsOfficial docsCodex SDKProgrammatic threads, structured events, CI integration, and server-side constraintsOfficial docsCodex App ServerEmbeddable protocol, persistent JSONL threads, streaming events, and deprecated context rollbackOfficial docsScheduled tasksRecurring background tasks, local projects, dedicated worktrees, status, and run historyOfficial docs
Enterprise and operations5 sources
AuthenticationChatGPT, API-key, and enterprise access-token authentication, surface availability, credential storage, and managed restrictionsOfficial docsManaged configurationAdmin-enforced requirements for permissions, sandbox, hooks, MCP, plugins, and precedenceOfficial docsAdmin rollout guideEnterprise rollout boundaries for workspace access, local runtime policy, cloud, APIs, plugins, connectors, and source systemsOfficial docsAdvanced configurationCustom and local providers, OpenTelemetry, profiles, network proxy, and configuration scopeOfficial docsAmazon Bedrock providerOpenAI models through Bedrock, AWS-native authentication, compatible local surfaces, request path, and policy boundariesOfficial docs
Releases and public code audit6 sources
Feature maturityOfficial under-development, experimental, beta, and stable labels with change and production-use expectationsOfficial docsWhat's newWeekly dated digest of ChatGPT and Codex surface changes with links to current product documentationOfficial docsOpen-source component mapPublic CLI, SDK, app server, universal cloud image, and proprietary surface boundariesOfficial docsCodex CLI 0.145.0 releaseCurrent stable CLI distribution release used for product-version verificationOfficial announcementCodex repositoryPinned 0.145.0 CLI, SDK, app-server, sandbox, tests, workflows, and Apache-2.0 licenseOfficial repositoryRollout trace implementationPinned implementation of local rollout inspection used as code-verifiable trace evidence rather than a benchmark resultOfficial repository