Documentation 2026-10-04 23:01 UTC to 2026-10-05 23:57 UTC

7repositories you own or have permission to assess, review findings over time,7repositories you own or have permission to assess, review findings over time,

8and check changes before they land.8and check changes before they land.

9 9 

10The `@openai/codex-security` package is public. Running scans requires Codex10The `@openai/codex-security` package is public. Scans using OpenAI inference

11 Security access. For an interactive scan in Codex, start with the [Codex11 require Codex Security access. For an interactive scan in Codex, start with

12 Security plugin quickstart](https://learn.chatgpt.com/docs/security/plugin). For connected GitHub12 the [Codex Security plugin quickstart](https://learn.chatgpt.com/docs/security/plugin). For connected

13 repositories, see [Codex Security cloud setup](https://learn.chatgpt.com/docs/security/setup).13 GitHub repositories, see [Codex Security cloud setup](https://learn.chatgpt.com/docs/security/setup).

14 14 

15## Check the prerequisites15## Check the prerequisites

16 16 

46 46 

47## Sign in47## Sign in

48 48 

49For local use, sign in with your ChatGPT account:49Sign in with your ChatGPT account:

50 50 

51```bash51```bash

52npx @openai/codex-security login52npx @openai/codex-security login

64export OPENAI_API_KEY="<your-api-key>"64export OPENAI_API_KEY="<your-api-key>"

65```65```

66 66 

67For AWS credentials, see [Amazon Bedrock67For Amazon Bedrock, follow the [Amazon Bedrock

68setup](https://learn.chatgpt.com/docs/security/cli/reference#use-amazon-bedrock). For [OpenRouter or68setup](https://learn.chatgpt.com/docs/security/cli/reference#use-amazon-bedrock) instead of signing in

69with ChatGPT or setting an OpenAI API key. Check [Bedrock release

70status](https://learn.chatgpt.com/docs/security/cli/reference#bedrock-release-status) to see what your

71installed version supports.

72 

73For [OpenRouter or

69Fireworks](https://learn.chatgpt.com/docs/security/cli/reference#use-openrouter-or-fireworks), set the74Fireworks](https://learn.chatgpt.com/docs/security/cli/reference#use-openrouter-or-fireworks), set the

70provider's API key and select a model with `--provider` and `--model`.75provider's API key and select a model with `--provider` and `--model`.

71 76 

6output formats, and exit behavior. For a guided first scan, start with the6output formats, and exit behavior. For a guided first scan, start with the

7[CLI quickstart](https://learn.chatgpt.com/docs/security/cli).7[CLI quickstart](https://learn.chatgpt.com/docs/security/cli).

8 8 

9The `@openai/codex-security` package is public. Running scans requires Codex9The `@openai/codex-security` package is public. Scans using OpenAI inference

10 Security access. Scans use your local permissions and don't pause for10 require Codex Security access. Scans use your local permissions and don't

11 approval. Before you start, review [Local scan11 pause for approval. Before you start, review [Local scan

12 permissions](#local-scan-permissions).12 permissions](#local-scan-permissions).

13 13 

14Run the CLI with `npx @openai/codex-security`.14Run the CLI with `npx @openai/codex-security`.

179 179 

180### Use Amazon Bedrock180### Use Amazon Bedrock

181 181 

182Select Amazon Bedrock with `--provider amazon-bedrock` and specify an explicit182Use `--provider amazon-bedrock` and a Bedrock model ID with `scan` or

183Bedrock model with `--model`:183`bulk-scan`. After AWS provisions model access, scans use AWS credentials

184without `--auth`, an OpenAI login, or an OpenAI API key.

185 

186#### Daybreak Blue and Daybreak Red

187 

188Daybreak Blue and Daybreak Red require Trusted Access for Cyber approval.

189To request access, submit the [enterprise access application](https://openai.com/form/enterprise-trusted-access-for-cyber/) or contact your OpenAI account team.

190After approval, work with your AWS account team to provision model access

191on Amazon Bedrock.

192 

193Daybreak Red approval does not include GPT-5.6-Cyber access. GPT-5.6-Cyber

194requires separate U.S. government (USG) approval. Ask your OpenAI account

195team to request this additional approval before provisioning GPT-5.6-Cyber

196on Amazon Bedrock. See the [Daybreak access requirements](https://help.openai.com/en/articles/20001258-openai-daybreak-trusted-access-for-cyber-overview).

197 

198| Access | Bedrock model ID | AWS region |

199| ------------- | ---------------------------------- | ----------- |

200| Daybreak Blue | `openai.gpt-daybreak-blue-5.6-sol` | `us-east-2` |

201| Daybreak Red | `openai.gpt-5.6-cyber` | `us-east-2` |

202 

203For availability, check the AWS model cards for [Daybreak Blue](https://docs.aws.amazon.com/en_en/bedrock/latest/userguide/model-card-openai-gpt-daybreak-blue-56-sol.html) and [Daybreak Red](https://docs.aws.amazon.com/en_en/bedrock/latest/userguide/model-card-openai-gpt-56-cyber.html).

204 

205To scan with Daybreak Blue, replace `<aws-profile-name>` with an AWS profile

206that has access to the Daybreak Blue model:

207 

208```bash

209export AWS_PROFILE="<aws-profile-name>"

210export AWS_REGION="us-east-2"

211npx @openai/codex-security scan . \

212 --provider amazon-bedrock \

213 --model openai.gpt-daybreak-blue-5.6-sol --effort high

214```

215 

216To scan with Daybreak Red, choose an AWS profile with GPT-5.6-Cyber access.

217This may differ from the profile you use for Daybreak Blue:

184 218 

185```bash219```bash

220export AWS_PROFILE="<aws-profile-name>"

221export AWS_REGION="us-east-2"

186npx @openai/codex-security scan . \222npx @openai/codex-security scan . \

187 --provider amazon-bedrock \223 --provider amazon-bedrock \

188 --model openai.gpt-5.6-terra224 --model openai.gpt-5.6-cyber --effort high

225```

226 

227You can also authenticate with `AWS_BEARER_TOKEN_BEDROCK` or the standard

228AWS credential chain. Temporary access keys require `AWS_SESSION_TOKEN`.

229Set credentials and `AWS_REGION` in the same shell or CI job as the scan.

230 

231#### Local results and access checks

232 

233Saved local reports, `scans show`, and `export` work without cloud credentials.

234Uploading findings to Codex Security Cloud requires a separate ChatGPT

235sign-in and access to the destination.

236 

237`info` and `scan --dry-run` don't test AWS credentials or model access. Run a

238scan to check access. For AWS authentication or access-denied errors, check

239your credentials, region, and model permissions.

240 

241#### Bedrock release status

242 

243`@openai/codex-security@0.1.31` supports Amazon Bedrock scans. This version

244doesn't provide cost estimates or support `--max-cost` for the Daybreak Blue

245and Daybreak Red model IDs above.

246 

247Check your installed package and bundled Codex versions:

248 

249```bash

250npx @openai/codex-security --version

251npx @openai/codex-security info --json

189```252```

190 253 

191Set `AWS_REGION` and authenticate with `AWS_BEARER_TOKEN_BEDROCK`, standard AWS254Use `npx @openai/codex-security scan --help` to check the options available

192access keys, an AWS profile, web identity, container credentials, or the255in your installed version.

193default AWS credential chain. Bedrock scans use AWS credentials instead of

194`--auth`, ChatGPT sign-in, or an OpenAI API key. Both `scan` and `bulk-scan`

195support `--provider`.

196 256 

197### Select the scan target257### Select the scan target

198 258 

21 - Planning a first ChatGPT app around a user outcome21 - Planning a first ChatGPT app around a user outcome

22 - Scaffolding an MCP server, tool metadata, and an optional widget without22 - Scaffolding an MCP server, tool metadata, and an optional widget without

23 overbuilding23 overbuilding

24 - Running a tight loop from local HTTPS testing to ChatGPT developer-mode24 - Running a tight loop from local HTTPS testing to custom MCP server

25 verification25 verification in ChatGPT

26starterPrompt:26starterPrompt:

27 title: Plan the App Before You Scaffold It27 title: Plan the App Before You Scaffold It

28 body: >-28 body: >-

111 111 

1121. Start with one narrow plugin outcome and ask Codex to propose three to five tools with clear names, descriptions, inputs, and outputs.1121. Start with one narrow plugin outcome and ask Codex to propose three to five tools with clear names, descriptions, inputs, and outputs.

1132. Decide whether v1 can stay data-only or needs a widget, then scaffold the MCP server and optional widget using existing repository patterns before adding dependencies.1132. Decide whether v1 can stay data-only or needs a widget, then scaffold the MCP server and optional widget using existing repository patterns before adding dependencies.

1143. Run the MCP server locally behind HTTPS, connect it in ChatGPT developer mode, and test it with a small direct, indirect, and negative prompt set.1143. Run the MCP server locally behind HTTPS, connect it in ChatGPT with [Add custom MCP server](https://developers.openai.com/api/docs/guides/custom-mcp-server), and test it with a small direct, indirect, and negative prompt set.

1154. Iterate on metadata, state handling, `structuredContent`, and `_meta` payloads until the core read flow behaves reliably inside ChatGPT.1154. Iterate on metadata, state handling, `structuredContent`, and `_meta` payloads until the core read flow behaves reliably inside ChatGPT.

1165. Add OAuth 2.1 only when user-specific data or write actions require it, without complicating anonymous or read-only flows.1165. Add OAuth 2.1 only when user-specific data or write actions require it, without complicating anonymous or read-only flows.

1176. Prepare a hosted preview with a stable `/mcp` endpoint, verify streaming and UI asset hosting, and review the launch checklist before sharing or submitting the plugin.1176. Prepare a hosted preview with a stable `/mcp` endpoint, verify streaming and UI asset hosting, and review the launch checklist before sharing or submitting the plugin.

180Verification:180Verification:

181 181 

182- Start the local server182- Start the local server

183- Explain how to connect the MCP server in ChatGPT developer mode183- Explain how to connect the MCP server in ChatGPT using Add custom MCP server

184- List the exact prompts to test184- List the exact prompts to test

185```185```

186 186 

198- Keep read-only tools anonymous if possible.198- Keep read-only tools anonymous if possible.

199- Add OAuth 2.1 only for user-specific data or write actions.199- Add OAuth 2.1 only for user-specific data or write actions.

200- Use an existing identity provider such as Auth0 or Stytch.200- Use an existing identity provider such as Auth0 or Stytch.

201- Document scopes, token checks, and the developer-mode test flow.201- Document scopes, token checks, and the custom MCP server test flow in ChatGPT.

202 202 

203Output:203Output:

204 204 

238- The tool set stays small and has explicit metadata, inputs, and outputs.238- The tool set stays small and has explicit metadata, inputs, and outputs.

239- The MCP server works end to end and returns concise `structuredContent`, reserving widget-only data for `_meta`.239- The MCP server works end to end and returns concise `structuredContent`, reserving widget-only data for `_meta`.

240- The widget, if needed, renders correctly inside ChatGPT.240- The widget, if needed, renders correctly inside ChatGPT.

241- A local HTTPS testing loop works through ChatGPT developer mode.241- A local HTTPS testing loop works with the custom MCP server connected in ChatGPT.

242- A small direct, indirect, and negative prompt set passes with the expected conversation flow and tool payloads.242- A small direct, indirect, and negative prompt set passes with the expected conversation flow and tool payloads.

243- Auth is added only where user-specific data or write actions require it.243- Auth is added only where user-specific data or write actions require it.

244- A deployment plan and launch-readiness review cover metadata, tool hints, privacy, and test prompts before the plugin is shared or submitted.244- A deployment plan and launch-readiness review cover metadata, tool hints, privacy, and test prompts before the plugin is shared or submitted.

252- Treating metadata as an afterthought. Better move: write tool descriptions and parameter docs early, then replay a prompt set against them.252- Treating metadata as an afterthought. Better move: write tool descriptions and parameter docs early, then replay a prompt set against them.

253- Adding auth before proving the anonymous or read-only path. Better move: get the core tool flow working first, then add OAuth for the tools that actually need it.253- Adding auth before proving the anonymous or read-only path. Better move: get the core tool flow working first, then add OAuth for the tools that actually need it.

254- Declaring the plugin done before testing inside ChatGPT. Better move: connect254- Declaring the plugin done before testing inside ChatGPT. Better move: connect

255 the MCP server in developer mode, inspect tool payloads, and verify the real255 the custom MCP server in ChatGPT, inspect tool payloads, and verify the real

256 conversation flow.256 conversation flow.