113 113
114```text114```text
115usage: codex-security scan [-h] [--auth {auto,chatgpt,api-key}]115usage: codex-security scan [-h] [--auth {auto,chatgpt,api-key}]
116 [--provider {openai,openrouter,fireworks,amazon-bedrock}]
116 [--path PATH | --diff BASE | --working-tree]117 [--path PATH | --diff BASE | --working-tree]
117 [--head HEAD] [--base BASE]118 [--head HEAD] [--base BASE]
118 [--knowledge-base PATH]119 [--knowledge-base PATH]
122 [--archive-existing]123 [--archive-existing]
123 [--plugin-path PATH] [--python PATH]124 [--plugin-path PATH] [--python PATH]
124 [--codex KEY=VALUE] [--fail-on-severity LEVEL]125 [--codex KEY=VALUE] [--fail-on-severity LEVEL]
125 [--max-cost USD] [--dry-run]126 [--max-cost USD] [--dry-run] [--verbose]
126 [--json] [--format {toon,json,yaml,jsonl}]127 [--json] [--format {toon,json,yaml,jsonl}]
127 [--full-output] [repository]128 [--full-output] [repository]
128```129```
152To make stored credentials the automatic default, run153To make stored credentials the automatic default, run
153`unset OPENAI_API_KEY CODEX_API_KEY`.154`unset OPENAI_API_KEY CODEX_API_KEY`.
154 155
156### Use Amazon Bedrock
157
158Select Amazon Bedrock with `--provider amazon-bedrock` and specify an explicit
159Bedrock model with `--model`:
160
161```bash
162npx @openai/codex-security scan . \
163 --provider amazon-bedrock \
164 --model openai.gpt-5.6-sol
165```
166
167Set `AWS_REGION` and authenticate with `AWS_BEARER_TOKEN_BEDROCK`, standard AWS
168access keys, an AWS profile, web identity, container credentials, or the
169default AWS credential chain. Bedrock scans use AWS credentials instead of
170`--auth`, ChatGPT sign-in, or an OpenAI API key. Both `scan` and `bulk-scan`
171support `--provider`.
172
155### Select the scan target173### Select the scan target
156 174
157Choose one target type for each scan.175Choose one target type for each scan.
230| `--fail-on-severity LEVEL` | Return exit `1` when a completed scan reports a finding at or above `critical`, `high`, `medium`, or `low`. |248| `--fail-on-severity LEVEL` | Return exit `1` when a completed scan reports a finding at or above `critical`, `high`, `medium`, or `low`. |
231| `--max-cost USD` | Stop a scan when its estimated model cost exceeds the specified USD amount. |249| `--max-cost USD` | Stop a scan when its estimated model cost exceeds the specified USD amount. |
232| `--dry-run` | Check the repository, target, output directory, and Codex configuration without starting a scan. |250| `--dry-run` | Check the repository, target, output directory, and Codex configuration without starting a scan. |
251| `--verbose` | Print redacted lifecycle, authentication, progress, and cost diagnostics to stderr. |
233| `--json` | Print manifest, findings, coverage, paths, and turn metadata as one JSON document. |252| `--json` | Print manifest, findings, coverage, paths, and turn metadata as one JSON document. |
234| `--format FORMAT` | Print the complete scan result as `toon`, `json`, `yaml`, or `jsonl`. |253| `--format FORMAT` | Print the complete scan result as `toon`, `json`, `yaml`, or `jsonl`. |
235| `--full-output` | Print the complete result using the default structured output format. |254| `--full-output` | Print the complete result using the default structured output format. |
287Codex configuration value.306Codex configuration value.
288 307
289| Argument | Description |308| Argument | Description |
290| ------------------------------------------ | -------------------------------------------------------------------------------------------------------- |309| --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
291| `--auth {auto,chatgpt,api-key}` | Select the scan credentials. The default is `auto`. |310| `--auth {auto,chatgpt,api-key}` | Select the scan credentials. The default is `auto`. |
292| `--model MODEL` | Select the OpenAI model. The default is `gpt-5.6-sol`. |311| `--provider {openai,openrouter,fireworks,amazon-bedrock}` | Select the inference provider. The default is `openai`. |
312| `--model MODEL` | Select the model. The default is `gpt-5.6-sol`. Required with `--provider amazon-bedrock`. |
293| `--effort {minimal,low,medium,high,xhigh}` | Select the model's reasoning effort. The default is `xhigh`. |313| `--effort {minimal,low,medium,high,xhigh}` | Select the model's reasoning effort. The default is `xhigh`. |
294| `--plugin-path PATH` | Use a Codex Security plugin directory or ZIP to override the bundled plugin. |314| `--plugin-path PATH` | Use a Codex Security plugin directory or ZIP to override the bundled plugin. |
295| `--python PATH` | Select the Python interpreter for the plugin runtime. |315| `--python PATH` | Select the Python interpreter for the plugin runtime. |
337```text357```text
338usage: codex-security bulk-scan [input] [--output-dir DIR]358usage: codex-security bulk-scan [input] [--output-dir DIR]
339 [--workers N] [--mode {standard,deep}]359 [--workers N] [--mode {standard,deep}]
360 [--provider {openai,openrouter,fireworks,amazon-bedrock}]
340 [--model MODEL]361 [--model MODEL]
341 [--effort {minimal,low,medium,high,xhigh}]362 [--effort {minimal,low,medium,high,xhigh}]
342 [--max-attempts N] [--plugin-path PATH]363 [--max-attempts N] [--plugin-path PATH]
618without writing the complete scan result to stdout. Request `--json`,639without writing the complete scan result to stdout. Request `--json`,
619`--format`, or `--full-output` to send structured scan results to stdout.640`--format`, or `--full-output` to send structured scan results to stdout.
620 641
642### Verbose diagnostics
643
644Add `--verbose` to print redacted lifecycle, authentication, progress, and cost
645diagnostics to stderr:
646
647```bash
648npx @openai/codex-security scan . --verbose
649```
650
651Set `CODEX_SECURITY_LOG_LEVEL=debug` to enable the same diagnostics without the
652flag. `LOG_LEVEL=debug` also enables diagnostics when
653`CODEX_SECURITY_LOG_LEVEL` is unset.
654
655These logging controls apply only to the CLI. Credentials and provider
656identifiers remain redacted, and structured scan results remain on stdout.
657
621### Completion summary658### Completion summary
622 659
623A completed scan writes its finding count, severity breakdown, coverage,660A completed scan writes its finding count, severity breakdown, coverage,
721 758
722Set `OPENAI_API_KEY` or `CODEX_API_KEY`, sign in with759Set `OPENAI_API_KEY` or `CODEX_API_KEY`, sign in with
723`npx @openai/codex-security login`, or use an existing file-backed Codex760`npx @openai/codex-security login`, or use an existing file-backed Codex
724sign-in.761sign-in. For Amazon Bedrock, use a Bedrock API key or the standard AWS
762credential chain instead.
725 763
726For credential selection, see [Select scan764For credential selection, see [Select scan
727authentication](#select-scan-authentication).765authentication](#select-scan-authentication).
