Agent runtimeagenticcodingdocumentedunattended capable

Operational brief

OpenAI Codex

OpenAI's coding agent CLI (and related app-server path). Tool-using, session-gated.

Choose it when

You want task-led coding in a local CLI, with explicit sandbox settings for scripts or CI.

Skip it when

You need a built-in always-on operator gateway or a guarantee that a human approves every write.

01 / Classification

Autonomy evidence

This is our classification, not a vendor badge. The record says what the product normally does. The gaps stay visible.

How we classify it

Tool use + multi-step plans, still human-gated per session.

Runs unattended

Yes — that capability is documented in this brief.

Trigger

Normally a developer starts a coding task. Optional codex exec runs can be launched by an external script, CI pipeline or scheduler without the interactive TUI; that isn't a built-in always-on operator.

State

CLI sessions can be saved and resumed by session ID; ephemeral runs omit rollout persistence. v0.163.0 restores saved-thread permissions and network approvals, subject to overrides and current managed policy.

Tools

Files, commands and MCP tools operate under the effective sandbox and approval policy. codex exec defaults read-only; edits need an explicit workspace-write grant. Actions already inside the boundary don't each require human approval.

Human control

Choose the sandbox and manual or automatic approval reviewer deliberately. Required MCP initialization failure stops exec; JSONL exposes terminal failure/error events. The pipeline owner must inspect outcomes and review patches before merge; unattended invocation isn't guaranteed recovery.

02 / Operations

Control reality

Useful agents eventually touch something real. This is the operational picture we have, not a promise hidden in a sales page.

Where it runs

CLI commands run locally; the repository links separately to editor, desktop and cloud experiences. An external runner supplies the environment for CI work.

Data boundary

Command-network restrictions don't cover model/authentication requests, hosted search or MCP connections. Local execution isn't an offline or no-retention promise; service data policy isn't established by this review.

Identity & permissions

exec reuses saved CLI authentication unless automation supplies credentials. Treat saved auth as a password; account identity and sandbox/tool authority are separate choices.

What it can write

repo files · shell · worktrees

Surfaces

CLI · ChatGPT Codex (separate cloud surface) · Editor integration · Externally triggered scripts / CI

Export / lock-in

JSONL events, final-output files and patch artifacts support inspection and handoff; saved sessions support resume. These aren't proof of a complete portable account or cloud-state export.

03 / Receipts

Evidence ledger

Here is what this brief is built on. “Documented” means we found a source. “Tested” means this desk actually ran it. Those are different things.

Evidence status

documented

Source set

7 primary sources

Evidence review

2026-10-16

Sources on file

Corrections

2026-10-16 · Corrected the proprietary-client label to Apache-2.0 for the CLI repository, separate from service access. Updated upstream release metadata to rust-v0.163.0 using published_at. Clarified optional externally triggered exec automation, read-only defaults, mutable approvals and saved-thread permission restoration; not runtime-tested.

Desk notes

What we found

Useful context, not a substitute for the source record above. This is not a desk test unless the evidence status says tested.

Pick for task-led coding and tightly scoped CI; skip if you expect an always-on gateway or a person to approve every write.

Client license

Apache-2.0; service access is separate

Automation

External scripts/CI; exec defaults read-only

Approvals

In-boundary actions can run without confirmation

Resume

v0.163.0 restores thread permissions/network grants under current policy

What the vendor says

Current exec docs retire full-auto and expose required-MCP failures plus JSONL errors. v0.163.0 adds searchable /config, immediate steering/cancellation and /daemon restart warnings. Documented, not runtime-tested.

GitHub

Inspected upstream README, complete Apache-2.0 license and stable-release metadata/body; not a repository-health or popularity assessment.

Sources fetched 2026-10-16

04 / Change log

Related coverage

The brief tells you what the product is. Payloads track the changes that may alter the decision.