openqodex/openqodex

AI agents: read the agent guide. After the install, ~/.openqodex/bin/openqodex guide for-agents prints the guide for the installed version.
OpenQodex reviews your code change before you push it. Your change is the commits you have not pushed plus everything uncommitted. OpenQodex runs on your machine, from your coding agent or your terminal.
First, OpenQodex runs the scanners that fit the files you changed. A scanner is a program that checks code without a model, such as gitleaks or semgrep. A finding is one problem at one place in the code, with a severity. OpenQodex keeps the scanner findings on the lines you changed. It drops findings in test fixtures and in rules you switched off.
Then OpenQodex starts a reviewer: a separate Claude Code or Codex process on your own login. By default, the agent that wrote the code does not review it. The reviewer must raise or drop each scanner finding, with a reason. Scripts check that it answered every scanner finding. They also check that it was given every changed line. Then you choose which findings your agent fixes.
Where it runs
| Coding agent | Starts a review | Can be the reviewer | Push gate |
|---|---|---|---|
| Claude Code | yes | yes | yes |
| Codex CLI | yes | yes | yes, after you trust the hook in Codex |
| Cursor | yes | no | no, a rule asks Cursor to review |
| Cline | yes | no | no, a rule asks Cline to review |
In Cursor and Cline, the review needs Claude Code or Codex installed as the reviewer. A push gate is a hook that looks for a review before your agent runs git push.
Requirements
- Node 22 or newer, and git.
- macOS or Linux. CI runs the gate on Node 22, on macOS and on Ubuntu Linux. No test runs on Windows or WSL.
- For a full review: Claude Code or Codex, installed and logged in. OpenQodex needs no account or API key of its own.
- Some scanners need a language runtime that OpenQodex does not install. brakeman and rubocop need Ruby. golangci-lint needs Go. cargo-deny needs Cargo.
Install
For people, in your terminal:
In a terminal, init finds Claude Code, Cursor, Codex CLI and Cline on your machine. It lists the files it will write. It asks you once. It starts the scanner downloads that your repository needs. Then it reviews your current change when a reviewer can start.
After the install, say to your agent: "review my change with openqodex". In your own terminal, run ~/.openqodex/bin/openqodex review. That path is the launcher, a small script that init writes. An npx install puts no openqodex on your PATH.
For agents, the same install with no question:
is claude-code, codex, cursor or cline. In its default sandbox mode, Codex gives commands no network. From Codex, run this line in your own terminal. The quickstart has a prompt to paste into your agent.
To install only the skill, run npx skills add openqodex/openqodex -g. That installs no push gate and downloads no scanner. A later init replaces that skill with the skill that init installs.
OpenQodex itself collects no usage data. The built-in scanners, as OpenQodex runs them, send no code. The reviewer sends your change to the model service of your Claude Code or Codex login. The privacy page lists each network use of this version.
What it does today
- openqodex review reviews your change in one command.
- It writes report.html, report.md, report.json and report.sarif. SARIF is a standard JSON format for scanner results.
- At the end, it prints a receipt. The receipt holds the verdict, one line per finding and the path of report.html. Here is an example report.
- The skill tells your agent to show you the receipt. It tells the agent to ask "Fix all, or tell me which?". It tells the agent to fix only the findings you name.