Codex code review: setup, pricing and how it compares

Codex code review is OpenAI's AI reviewer for GitHub pull requests, plus a /review command in the Codex CLI, IDE extension and app, and a GitHub Action for your own workflows. PR reviews come with ChatGPT Plus, Pro, Business, Enterprise and Edu plans, not with Free, Go or an API key, and on GitHub they post only the most serious findings, marked P0 and P1.

Our verdict: if your team already pays for ChatGPT, turn it on. It costs nothing extra up to your plan's limit, it's quiet by design, and AGENTS.md makes it easy to steer. But if you're serious about code review and building production applications, it isn't enough on its own. OpenAI itself calls it an additional reviewer, not a replacement for tests, branch protection or required approvals. It reports only P0 and P1 findings, has no documented way to approve or block a pull request, and draws on an allowance whose size OpenAI doesn't publish. On Martian's Code Review Bench (last-month view, checked October 10, 2026), it ranks #13 of 15 by F1.

This blog belongs to cubic (cubic.dev), an AI code review tool that competes with Codex code review, so weigh our opinions accordingly. The Codex facts here come from OpenAI's docs, help center, changelog, blog posts and GitHub repositories, and from the Codex bot's comments on OpenAI's own repository, read on October 10, 2026.

Which Codex code review should you use?

Codex code review means three different things:

Each option runs in a different place and bills differently. The table below adds who can use it and how to start it.

Use /review on your own branch before you push, and the GitHub reviewer as a second check on every pull request. Reach for the Action only if you want your own prompt, your own model choice, or API billing instead of a ChatGPT plan.

How Codex reviews pull requests on GitHub

Codex PR reviews on GitHub come from the ChatGPT Codex Connector app, which OpenAI's code review docs call generally available. Codex reads the pull request's diff, follows the review rules in your AGENTS.md files and posts a regular GitHub review. By design, it reports only P0 and P1 findings on GitHub.

How to turn on Codex code review

OpenAI's GitHub setup guide has the details. You need a ChatGPT plan that includes Codex cloud and push or admin permission on the repository.

1. Sign in to Codex with your ChatGPT account and connect the GitHub repository. Codex cloud doesn't work with API-key sign-in.

2. Open Codex's code review settings at chatgpt.com/settings/code-review and choose the repository.

3. Turn on Automatic review under Review code. Each person can also turn on Automatic review under Personal preferences and pick a Review trigger.

4. Open a pull request, or comment @codex review on an existing one. Codex reacts with 👀 while it works, then posts its review.

OpenAI's docs don't list when automatic reviews run. On OpenAI's own repository, the bot's help text says it reviews when a pull request is opened for review, when a draft is marked ready, and when someone comments @codex review. Reviews on every push aren't documented for GitHub.

What a Codex review looks like

On OpenAI's own repository, a review opens with a short "Codex Review" note, then adds inline comments with a P0 or P1 badge, a bold title and an explanation. When a rule from AGENTS.md applies, the comment links to it.

A P1 finding on OpenAI's own repository (openai/codex#51186), with the "Useful?" prompt that closes its comments.

No OpenAI page says Codex approves, requests changes or blocks a merge, and the reviews we sampled on OpenAI's repository were plain comments. The GitHub app also has read-only access to checks and statuses, so it can't post a check or commit status that branch protection could require. OpenAI recommends it as an additional reviewer, not a replacement for tests, branch protection or required approvals.

Comment commands

Review rules in AGENTS.md

Codex follows the review rules in the AGENTS.md files that cover the changed code: the root file plus any nested file closer to the change. Put them under a ## Code Review Rules heading, grouped with ### headings. Rules for the whole repository go in the root file, and rules for one service go in a nested file such as services/payments/AGENTS.md.

OpenAI suggests starting with two or three short rules about behavior that matters in your repository, leaving formatting and lint to CI, and pruning any rule that creates noise on a test pull request. Until July 2026, its docs called this section ## Review guidelines; today's docs use ## Code Review Rules.

OpenAI says rules make a large difference: in its primary evaluation suite, rule-guided reviews found 98% of the required custom findings, against 58.3% for the baseline control.

The /review command in the Codex CLI

/review runs a dedicated reviewer on your local changes. It reads the diff, reports prioritized findings and doesn't touch your working tree. In the CLI it offers four presets: Review against a base branch, Review uncommitted changes, Review a commit and Custom review instructions. The IDE extension and the desktop app offer the first two.

For scripts and pre-push hooks, codex review runs the same review without the interactive menu:

codex review --base main        # review your branch against main
codex review --uncommitted      # staged, unstaged and untracked changes
codex review --commit 1a2b3c4   # one commit
codex review "Focus on auth and input validation"

codex review --base main        # review your branch against main
codex review --uncommitted      # staged, unstaged and untracked changes
codex review --commit 1a2b3c4   # one commit
codex review "Focus on auth and input validation"

codex review --base main        # review your branch against main
codex review --uncommitted      # staged, unstaged and untracked changes
codex review --commit 1a2b3c4   # one commit
codex review "Focus on auth and input validation"

The local reviewer's prompt is open source in the openai/codex repository; the GitHub reviewer's isn't published. The local prompt tags each finding P0 to P3, flags only bugs the change introduced, skips trivial style, and ends with a verdict that the patch is correct or incorrect, with a confidence score. /review uses your session's model unless you set review_model in config.toml.

Local reviews count against your plan's general Codex usage, not the separate Code Review usage that GitHub reviews draw on. With an API key, you pay API token prices.

Codex code review in GitHub Actions

The Codex GitHub Action (openai/codex-action@v1, version 1.13 as of October 5, 2026) installs the Codex CLI and runs codex exec with a prompt you write. OpenAI's sample workflow runs when a pull request is opened, updated or reopened, and a second job posts Codex's final message as a PR comment.

The Action needs an OpenAI or Azure OpenAI API key stored as a GitHub secret, so you pay API prices rather than using your ChatGPT plan. As of October 2026, GPT-6.1 Sol costs $2.00 per million input tokens and $10.00 per million output tokens on OpenAI's API, at the Standard tier for prompts up to 272,000 input tokens.

OpenAI's security notes are worth following: by default only users with write access can trigger the Action, and you should treat PR titles and descriptions as untrusted input that could carry a prompt injection.

Codex security review

Security Review is a deeper pass that looks only for security risks, using the diff, the repository's context and a threat model. It's a research preview on Pro, Business, Edu and Enterprise plans, not Plus. You start it with @codex security review, or turn on Auto security review for a repository and choose whether it runs when a PR opens, on every push, or whenever code review runs.

By default, automatic security reviews post High and Critical findings, and manual ones add Medium. Findings inherit the pull request's visibility, so on a public repository anyone can read them.

Codex Security, formerly Aardvark, is a separate product that scans repositories and can also review a branch's or pull request's changes for security regressions.

What Codex code review costs

GitHub reviews are included in these plans, as listed on OpenAI's pricing page and help center on October 10, 2026:

GitHub reviews, started automatically or with @codex review, draw from a separate allowance OpenAI calls Code Review usage. OpenAI doesn't publish its size today. In April 2026, its pricing page listed 20 to 50 code reviews per 5 hours on Plus; that table is gone.

Past the allowance, Plus and Pro users can buy credits, and Business, Enterprise and Edu workspaces on flexible pricing can buy workspace credits. Credits are charged by tokens, and OpenAI no longer lists a price per review.

When a repository runs out, the Codex bot says so on the pull request. On OpenAI's own repository in October 2026, it commented that "Codex usage limits have been reached for code reviews" and that "Credits must be used to enable repository wide code reviews." If you turn on automatic reviews for every pull request in a busy repository, budget for credits.

A rough example, with our arithmetic: a 10-person team on ChatGPT Business pays $2,400 a year billed yearly, and Codex code review comes with those seats, up to a limit OpenAI doesn't publish. Our AI code review pricing comparison lists what other tools charge.

Is Codex code review any good?

It catches less than the leading reviewers. On Martian's Code Review Bench (last-month view, checked October 10, 2026), the ChatGPT Codex Connector, the app that posts Codex's GitHub reviews, ranks #13 of 15 by F1, at 55.6%.

Martian, which describes itself as a research lab that doesn't sell coding tools, scores review bots on real open-source pull requests. It ranks them by F1, which combines how often developers act on a reviewer's comments with how many of the real bugs it catches. The top five, and Codex:

OpenAI says this is partly by design. In a December 2025 post, its alignment team wrote that the reviewer deliberately flags fewer issues so that more of its comments are right. Across OpenAI's own pull requests, authors changed code in response to 52.7% of the reviewer's comments. It's also one of the most used reviewers on the board: Martian's last-month view counts 498,173 of its pull requests, second only to GitHub Copilot.

The board moves daily: in a July 30, 2026 post, Greptile listed the Codex Connector second on the tracker at 59.4% F1.

Where Codex code review falls short

• Only the top two priorities. On GitHub it reports only P0 and P1 findings, so smaller problems never reach the pull request.

• No documented way to gate a merge. No OpenAI page says it approves or requests changes, and the app can't post a check or commit status that branch protection could require.

• The allowance size isn't published. OpenAI doesn't say how many GitHub reviews a plan includes, so you can't size a rollout before you try it.

• Narrow host support. GitHub is the generally available host. OpenAI's docs have listed GitLab merge request reviews as a beta since August 2026, but one of its help articles says GitLab cloud reviews aren't available. Bitbucket and Azure DevOps aren't documented.

• No choice of model. OpenAI doesn't say which model runs GitHub reviews today, and Codex cloud's default model can't be changed.

• No hosted option on API billing. Teams that buy OpenAI through the API, not ChatGPT, can't use the GitHub reviewer.

Codex code review vs cubic

This is where our bias matters most, so we'll stick to what each product documents. Prices are as of October 2026, from OpenAI's pricing pages and cubic's pricing page.

In practice, the choice comes down to three things:

• What you already pay for. Codex comes with ChatGPT seats your team may already have. cubic is a separate subscription.

• How much a review should catch. On Martian's Code Review Bench (last-month view, checked October 10, 2026), cubic ranks #1 by F1 at 64.0% and the Codex Connector #13 at 55.6%. Test both on your own pull requests.

• Whether the reviewer can approve. cubic can auto-approve pull requests that meet a policy you set, after a shadow-mode trial. OpenAI documents no approvals for Codex.

Using Codex and cubic together

They don't exclude each other. One way to split the work is Codex's /review on your branch before you push, and cubic on the pull request. The cubic CLI can also run local reviews on Codex models through a ChatGPT Plus or Pro plan: run cubic auth connect codex, sign in through the browser, then pick a Codex model in the CLI.

Codex auto-review, skills and Claude Code

A few search terms point at features that sound like code review:

• Auto-review isn't code review. Codex's Auto-review is a sandbox feature: a separate reviewer agent decides on approval requests, such as escalated commands or blocked network requests, instead of you. With ChatGPT sign-in, codex-auto-review is the default model behind it. It doesn't review pull requests.

• No general-purpose review skill. OpenAI's skills repository has no code review skill, and /review is built in. Its Codex Security plugin does include security-diff-scan, which reviews uncommitted changes, a commit, or a branch or pull request for security regressions, and OpenAI's plugin catalog also carries CodeRabbit's plugin, which has a review skill.

• You can run Codex reviews from Claude Code. OpenAI's codex-plugin-cc adds /codex:review and /codex:adversarial-review, a read-only review that challenges design choices, tradeoffs and assumptions. It needs a ChatGPT subscription or an OpenAI API key, and its reviews count toward your Codex limits.

Who should use Codex code review

Turn Codex code review on if:

• Your team already has ChatGPT Plus, Pro, Business or Enterprise seats and works on GitHub. It's included up to your plan's Code Review usage limit, so it adds a check to your pull requests without a separate bill until you reach that limit.

• You want a quiet reviewer that only speaks up about serious bugs.

• You already keep instructions in AGENTS.md and want reviews to follow them.

If you're serious about code review and building production applications, don't stop there. Codex keeps everything below P1 off the pull request, has no documented way to gate a merge, and draws on an allowance whose size OpenAI doesn't publish, so pair it with a dedicated reviewer. If you're comparing first-party reviewers, our Claude Code review and GitHub Copilot code review guides cover the other two.

Run any reviewer on a week of your own pull requests before you trust a ranking, ours included.

If you're on GitHub, try cubic's AI code reviewer next to Codex on the same PRs. The trial lasts 7 days and needs no card.