OpenQodex reviews agent-written code before Git push

What this is about

OpenQodex is an open-source tool that reviews code changes before they are pushed to a Git repository. It is aimed especially at teams using Claude Code, Codex, Cursor or Cline that want another control layer between a coding agent and Git push.

The tool runs on the user's machine. Conventional scanners run first, followed by a separately started Claude Code or Codex process that assesses the change and scanner findings. OpenQodex uses the Apache 2.0 license and, according to the project, is still on its way to version 1.0.

What OpenQodex actually does

OpenQodex examines unpushed commits and uncommitted changes. Based on affected files, it starts scanners for secrets, known vulnerabilities, dependencies, lint rules, GitHub Actions, Docker, Terraform, Kubernetes, CloudFormation and databases. The project lists 22 built-in scanners.

It then launches a separate reviewer through an existing Claude Code or Codex login. The reviewer must accept or reject every scanner finding with a reason. OpenQodex checks that every finding and every changed line was considered. Results are written as HTML, Markdown, JSON and SARIF. A Git hook can warn before push, while a configurable severity threshold can block it.

Why it matters

Coding agents can create changes quickly, but the same agent may repeat the same mistaken assumptions during self-review. OpenQodex separates creation and review when a second process is available. Deterministic scanners also provide traceable signals that do not depend only on a language model.

For small teams, it matters that reports are produced locally and scanner findings are narrowed to changed lines. The model reviewer still sends the change to the service behind the existing Claude Code or Codex account. “Local” therefore does not automatically mean all code stays on the device.

In plain language

OpenQodex works like checking a suitcase before a trip. A checklist first flags missing documents, medicine and prohibited items. A second person then examines the suitcase and judges those alerts. Even this double check cannot guarantee that nothing was missed.

A practical example

An agent changes 14 files in a web service and adds a database migration. Before pushing, a developer runs openqodex review. A secrets scanner flags a test key, a dependency scanner finds a known vulnerability, and the separate reviewer also spots a missing permission check.

OpenQodex creates a report with location, severity and reasoning. The developer fixes two problems and dismisses the test-key finding as an intentional dummy after review. A new run must pass before the push proceeds. The report is an auditable receipt, not a security certificate.

Scope and limits

• A full review requires Claude Code or Codex to be installed and logged in. Cursor and Cline cannot act as the separate reviewer themselves.
• According to project documentation, a second Codex process cannot start inside the Codex sandbox. The intended separation is then limited.
• Windows and WSL are not covered by project CI; macOS and Linux are the stated platforms.
• Some scanners require network access or extra runtimes. Offline mode skips several checks, while the model reviewer still contacts its model service.
• No scanner or language model finds every defect. Git options can also bypass hooks, so tests and organizational controls remain necessary.

The sensible first step is the bundled demo repository with planted bugs. A team should then review a non-critical pull request, document runtime, false positives, data flows and blocking rules, and only then consider mandatory push protection.

SEO & GEO keywords

OpenQodex, code review, coding agents, Codex CLI, Claude Code, local scanners, SARIF, Git push, DevSecOps, open source