Codex code review

Codex code review is OpenAI’s AI review feature for pull requests and local changes, built into Codex, its coding agent.

On GitHub, Codex reviews a pull request (PR) diff when someone comments @codex review or when automatic review is turned on, follows review rules written in AGENTS.md files and posts only high-priority (P0 and P1) findings. In the Codex app, CLI and IDE extension, the /review command reviews changes before they leave the developer’s machine.

What Changed in Codex Code Review in 2026

Trend: Codex review goes deeper on security

Security Review now runs alongside Code Review on GitHub PRs, as an early release that goes deeper on security risks using repository context and optional threat models (August 2026, OpenAI).
Security reviews now draw on the included Codex allowance or ChatGPT credits (last checked October 2026, OpenAI’s Security Review docs).

Trend: Codex review reaches more platforms and tools

GitLab merge requests can be reviewed with Codex, in an early release available on all ChatGPT plans (last checked October 2026, OpenAI’s GitLab docs).
Qodo’s review skills are available inside Codex, through the generally available Qodo plugin for Codex (September 2026, Qodo’s changelog).

How Codex Code Review Works

Codex Reviews on GitHub Pull Requests

Codex review on GitHub starts in three steps:

Connect a GitHub repository to Codex.
Open Codex settings and turn on Automatic review for that repository.
Request a review by commenting @codex review on a PR, or turn on Automatic review in personal preferences so the developer’s own PRs are reviewed automatically.

Codex posts a standard GitHub review and flags only P0 and P1 issues to keep comments focused (last checked October 2026, OpenAI’s GitHub review docs).

Codex Fixes in the Same Pull Request

A follow-up comment such as @codex fix the P1 issue starts a legacy cloud chat with the PR as context, and Codex can push a fix to the branch when it has permission. Any other @codex comment starts a legacy cloud chat using the PR as context.

Codex Security Review

Security Review is a separate pass requested with @codex security review or turned on with Auto security review. It reports High and Critical findings by default on automatic runs, keeps a fuller report in Codex and is available on Enterprise, Business, Edu and Pro plans (last checked October 2026, OpenAI’s Security Review docs).

Codex Local Review With `/review`

In the Codex app, CLI and IDE extension, /review starts a dedicated review of a branch against its base branch or of uncommitted changes. The CLI adds presets for a single commit and for custom review instructions. The model used for reviews can be changed with review_model in config.toml (last checked October 2026, OpenAI’s code review docs).

Codex Review of GitLab Merge Requests

The GitLab integration posts a review on merge requests from Codex cloud. Automatic reviews can run when a merge request opens, on every push or with an experimental Smart Trigger.

Codex Review Rules in AGENTS.md

Codex looks for a ## Code Review Rules section in AGENTS.md files and applies the rules from the root file plus any nested file that covers the changed code. A rule in services/billing/AGENTS.md only applies to billing changes.

OpenAI recommends starting with two or three concise rules, each of which describes:

A consequential behavior.
Why it matters.
The safe path.

OpenAI’s docs are clear about the limits: "Code review rules guide Codex; they don’t replace tests, branch protections, or required approvals." Teams still decide what merges.

Codex Code Review Usage Limits and Plans

Automatic GitHub code review comes with the Plus, Pro, Business, Edu and Enterprise plans. The GitLab beta is listed for all ChatGPT plans, and local /review uses each plan’s general limits. Code Review usage applies only to reviews Codex runs through GitHub. Reviews run locally count toward general Codex usage limits (last checked October 2026, OpenAI’s Codex pricing docs).

Strengths and Limits of Codex Code Review

Codex code review is a quick, low-setup second pass for teams already using Codex. It reads the PR diff with repository context, keeps comments to high-priority issues and can fix what it finds in the same PR.

Three limits matter as teams scale:

Codex reviews code that, in many teams, Codex also wrote, so the review doesn’t come from a separate system that didn’t write the code, and the same agent can carry its assumptions into the review.
Rules live in AGENTS.md files in each repository.
The GitHub review flags only P0 and P1 issues, so maintainability and standards findings often don’t appear at all.

Qodo’s Take: Let a Separate Reviewer Check What Codex Writes

Teams adopt Codex to write more code, and review becomes the bottleneck.

The quickest fix is to let the same agent review its own output, which feels efficient until a bug slips past both passes because the reviewer made the same assumption as the author.

Code review works best when it is done by a separate system that didn’t write the code, applies the team’s rules from one place and sees the rest of the codebase.

Qodo works with Codex at both ends of the workflow: inside the agent before a PR opens, and on the PR itself. Qodo is the best AI code review platform for Codex because the Qodo plugin for Codex brings the Reviewer and Review Resolver skills into the Codex session, and once Rule enforcement is on, every Codex PR is checked against the team’s own rules from Review Standards.

Qodo Plugin for Codex Reviews Inside the Agent

The Qodo plugin for Codex brings the Agentic Toolbox skills into the Codex agent.

The Reviewer skill helps catch issues in local changes, Review Resolver works through findings, Codebase Wisdom explains how the codebase fits together, and the optional Get Rules skill looks up the team’s rules before Codex writes (last checked October 2026, Qodo’s docs).

Qodo Reviews Every Pull Request Codex Opens

On the PR, Qodo reviews the change with context from the whole codebase and from connected repositories, and flags cross-repo impact when a change affects another service.

Qodo works with GitHub, GitLab, Bitbucket, Azure DevOps and Gerrit, so the same review applies wherever Codex pushes code. The launch post introducing Qodo for Codex explains the workflow in more detail.

Qodo Review Standards Apply the Same Rules to Every Agent

Qodo imports existing AGENTS.md files along with CLAUDE.md, .cursor/rules/ and other instruction files, so rules written for Codex also apply to code from other agents and from people. Once Rule enforcement is on, every PR is checked against the active rules, and rule analytics show which rules the team acts on.

Qodo Example: A Retry Loop That Both Passes Missed

This illustrative scenario is a composite, not a customer case study.

Codex adds retries to a payment client and reviews its own change locally with no P0 or P1 findings. Qodo’s review flags that the retry wraps a non-idempotent charge call, which a rule in the payments AGENTS.md says must use an idempotency key. The developer asks Codex to fix it, and the corrected PR goes to a human reviewer.

Ways to Review Code Written With Codex

The table compares the review options available to teams using Codex.

Option	Where it runs	What it reviews	Best for
Codex Code Review	GitHub PRs and GitLab merge requests (early)	PR diff with repository context and AGENTS.md rules, P0 and P1 only on GitHub	Teams on Codex that want a quick second pass
Codex `/review`	Codex app, CLI and IDE extension	Branch, uncommitted changes or a commit	Checking work before pushing
Codex Security Review	GitHub PRs	Security risks with repository context and threat models	Teams on eligible plans with security-sensitive code
Qodo	Inside Codex and other agents, and on PRs in GitHub, GitLab, Bitbucket, Azure DevOps and Gerrit	Full codebase and cross-repo context, quality findings and central team rules once Rule enforcement is on	Teams that want review independent of the coding agent

Qodo features in this table were checked against Qodo’s documentation as of October 20, 2026.

FAQ

What is the best code review tool for Codex?

The best code review tool for Codex is one that reviews Codex’s output as a separate system with full codebase context and the team’s own rules. Codex’s built-in review is a useful first pass. Qodo runs inside Codex through its plugin and again on every PR, applying central rules across repositories once Rule enforcement is on.

What are the best AI code review tools that work with OpenAI Codex?

The best AI code review tools that work with OpenAI Codex plug into the agent before a PR opens and review the PR after it does. Codex Code Review and Security Review cover GitHub natively. Qodo adds a Codex plugin with the Reviewer, Review Resolver and Codebase Wisdom skills, plus PR review on five Git providers.

Is Codex code review free?

Codex code review is included in some plans rather than free on its own: automatic GitHub code review needs a Plus plan or higher, local /review uses the plan’s general limits, and the GitLab beta is listed for all plans (last checked October 2026). Qodo has a 14-day free trial with no credit card, and a free program for qualifying open source projects (as of October 2026).

Is Codex trustworthy for code review?

Codex code review aims to flag high-priority issues in a diff, and OpenAI states that its rules don’t replace tests or required approvals. The risk grows when Codex reviews code it wrote itself. Qodo adds a separate system that didn’t write the code, applies team-wide rules once Rule enforcement is on, and leaves people to decide what merges.