Codex Security

What you can ask

• Run a Codex Security scan on this repository.Copy

  Example path search_installed_repositories_streaming→fetch_commit_workflow_runs · Deep Security Scan skill

• Run a Codex Security diff scan on this PR, commit, branch diff, or working-tree patch.
• Triage existing security findings against this repository.

MCP connector

Server URL

https://mcp.linear.app/mcpCopy

Login

OAuth

Tools

Skills

15 in the ChatGPT listing

• Assess Patch RiskAssess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility.
• Attack Path AnalysisUse when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity.
• Deep Security ScanUse when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan.
• Define Security PolicyDefine, review, or update SECURITY.md guidance for a repository or component.
• Finding DiscoveryUse when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change.
• Fix Security FindingUse only when the user explicitly asks to fix and verify a validated or plausible security vulnerability.
• Propose Security HardeningDevelop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan.
• Security Diff ScanReview a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.
• Security ScanUse for a standard, single-pass security audit of an entire repository or a scoped path, package, folder, or submodule with no diff to review.
• Threat ModelUse when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model.
• Track FindingsTrack validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories.
• Triage FindingTriage supplied or imported security findings against a repository using its security policy and static code evidence.
• ValidationUse when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid.
• Verify FixUse only when the user explicitly requests verification that a security fix remediates a reported vulnerability.
• Vulnerability WriteupTurn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports.