OpenQodex

What it is

OpenQodex is an open source code review tool that runs before you push code. It executes 22 built-in scanners that detect secrets, security issues, vulnerable dependencies and lint errors across multiple languages and frameworks. The tool then starts a separate reviewer process using your own Claude Code or Codex login to examine findings and changed lines. Scripts validate that every scanner finding is addressed and every changed line was reviewed. It works locally with no API keys, accounts or data sent to servers, and integrates directly into coding agents and terminal workflows.

Questions from the bench

How is this different from asking my agent to review its own change?

OpenQodex starts a separate Claude Code or Codex process that reads a frozen copy of the change with no settings, plugins, hooks or memory of the original session. The scanners run first and the reviewer must raise or drop every scanner finding with a reason.

Does it need an API key or an account?

It needs Claude Code or Codex installed and logged in, and no other key, account or server. A review runs on your own Claude Code or Codex login. The GitHub Action is the exception and needs your Anthropic API key set as a repository secret.

Which model does the AI code review use?

The model your Claude Code or Codex login uses. OpenQodex starts Claude Code or Codex as the reviewer and adds no other model. By default it picks the agent you run the command from, then Claude Code, then Codex, and --reviewer picks one.

Where does my code go?

OpenQodex itself collects no usage data. The built-in scanners send no code. Four scanners use the network: semgrep fetches rule packs, osv-scanner sends dependency names and versions to osv.dev, kubeconform downloads Kubernetes schemas and cargo-deny downloads the RustSec database. The reviewer sends your change to your Claude Code or Codex login's model service.

Is this just a wrapper around a prompt?

No. The scanners run first with no model, and only findings on the lines you changed are kept. The reviewer is a separate process that reads a frozen copy of the change. Scripts then check its answer: every scanner finding must be raised or dropped with a reason, and every changed line must have been put in front of the reviewer. A review that falls short prints "Review incomplete" with what is missing.