Security review for the pull requests Codex CLI work becomes.
Codex's review command reads your diff and reports findings without touching your working tree, and you still decide when to commit or open the pull request. Aevral, the AI security reviewer for GitHub pull requests, reviews that pull request within your plan's allowance and gives you a copy-paste fix prompt with each finding.
In plain words
Picture a colleague who works at the terminal beside you and never leaves it: Codex CLI inspects your code, edits files, and runs your tools without leaving your terminal, and its review command reads a diff and reports findings without touching your working tree. Nothing reaches GitHub until you commit or open the pull request yourself. This page is about that pull request, and who reads it for security before it merges.
How Codex CLI work reaches a pull request
From OpenAI's own documentation. Each line is in our words, with the quote it rests on underneath.
Codex CLI inspects code, makes changes, runs commands, and automates repeatable work without leaving your terminal.
“Inspect code, make changes, run commands, and automate repeatable work without leaving your terminal.”
Codex CLI docs, inspect, edit, and run code from your terminal, read
It works against your local repository: Codex inspects files, makes edits, and runs the tools already installed on your machine.
“Let Codex inspect files, make edits, and run the tools already installed on your machine.”
A built-in review command starts a dedicated reviewer that reads the selected diff and reports prioritized, actionable findings without changing your working tree.
“Codex starts a dedicated reviewer that reads the selected diff and reports prioritized, actionable findings without changing your working tree.”
That review runs before you commit or open a pull request: Codex reports its findings without modifying your working tree, so the choice to commit or open the pull request stays yours.
“Codex reports prioritized findings without modifying your working tree, so you can address risks before you commit or open a pull request.”
When you come back to the work, codex resume reopens a recent chat from the current repository or searches across local chats, so the same terminal loop can pick the task back up before anything reaches GitHub.
“Reopen a recent chat from the current repository, or search across local chats when you need to return to older work.”
Codex CLI docs, build a terminal workflow (return to a saved chat), read
Codex also reaches pull requests through the GitHub action and Codex Cloud
The GitHub action runs separately from the terminal: it can run Codex in CI/CD jobs, write changes directly, or post reviews from a GitHub Actions workflow.
“run Codex in CI/CD jobs, apply patches, or post reviews from a GitHub Actions workflow.”
Teams use it to automate pull-request feedback: a sample workflow reviews new pull requests, captures Codex's response, and posts it back on the PR.
“The sample workflow below reviews new pull requests, captures Codex's response, and posts it back on the PR.”
Codex has broad access on GitHub-hosted runners unless the workflow restricts it, which is a reason to know whether a repository runs it at all.
“Codex has broad access on GitHub-hosted runners unless you restrict it.”
The same terminal can also hand a task to Codex Cloud: codex cloud browses active and completed chats, submits work to a configured environment, and brings the result back to your local repository.
“Browse active and completed chats, submit work to a configured environment, and apply the result to your local repository from the terminal.”
Codex CLI docs, build a terminal workflow (move work to Codex cloud), read
Why it matters: the terminal review is not a merged pull request
Most Codex CLI work never becomes an agent-opened pull request: the terminal loop runs locally, the review command reports its findings without changing your working tree, and you decide when to commit or open the pull request.
GitHub sees a pull request from your own account, with nothing marking the code as agent-written. A policy that only reviews pull requests an agent opened has nothing to review here.
Aevral reads the diff the same way regardless: it reviews a pull request when it is opened or reopened and when new commits are pushed, within your plan's review allowance, looking for access control, business logic and injection problems among its classes.
The GitHub action adds a second surface a repository can run without a human at the terminal: wired into a workflow, it can act on a pull request, writing changes directly or posting a review from a GitHub Actions job.
Codex has broad access on GitHub-hosted runners unless the workflow restricts it, which is a reason to know whether a repository runs it at all.
Either path still ends at the same pull request, and Aevral reviews it there: when it is opened or reopened and when new commits are pushed, within your plan's review allowance.
What the vendor's docs say
Codex has broad access on GitHub-hosted runners unless the workflow restricts it.
“Codex has broad access on GitHub-hosted runners unless you restrict it.”
Where Aevral fits: a copy-paste handoff
Aevral reviews a Codex CLI pull request like any other pull request on a repository where the Aevral GitHub App is installed: when it is opened or reopened and when new commits are pushed, within your plan's review allowance.
A finding is an inline comment on the added line, next to an advisory Check that never blocks the pull request.
Each finding carries a Fix with your agent prompt.
A human copies the prompt back into the terminal, into codex resume to reopen the task's chat, or into the GitHub action's prompt file if that is how the repository runs Codex.
Whatever Codex pushes in response is reviewed again when it reaches the pull request, and your repository's own review and merge rules decide what ships.
How the prompt is built and how to use it well: handing a finding to your coding agent.
Setup, the two human clicks
Two clicks, both yours: install the GitHub App, then log in to the console with GitHub. An agent cannot install the App or finish the login for you; it can read this page and the agent-setup prompt instead.
- Install the GitHub App: https://github.com/apps/aevral
- Log in to the console: https://app.aevral.com/login
- Official agent-setup prompt: https://docs.aevral.com/agent-setup/prompt.md
What this page does not claim
- Aevral is not affiliated with, endorsed by, or a partner of the company behind Codex. There is no integration between the two products: Aevral does not call Codex, and Codex does not call Aevral.
- Aevral never commits, pushes, applies or merges a change. The Fix with your agent prompt is text a human copies; what the agent does with it goes through your repository's own review and merge rules.
- PR review looks for a list of classes on the diff and leaves at most five findings per review. A finding is a lead with evidence, not a verdict, and a quiet review is not proof that the code is safe.
- The boxed statements about Codex come from the vendor's own documentation, each with the quote it rests on and the date it was read. The paragraphs around them are Aevral's reading of what those facts mean for a security review. Vendor products change; the vendor's docs win over this page.
- This page does not say Codex CLI opens the pull request by itself: the review command reports its findings without touching your working tree, and a human still commits or opens the pull request.
- Aevral does not start Codex CLI sessions, run the Codex GitHub action, or read the terminal transcript.
Sources
Read next