codex-plugin-cc: Codex reviews for Claude Code

codex-plugin-cc, OpenAI’s official Codex plugin for Claude Code, hands the code Claude just wrote to Codex for review. In our test Codex was rarely wrong but quiet: its adversarial review found under half as many real bugs as a fresh Claude review, and fewer serious ones by a smaller margin.

Tested: commit db52e28f4d9ded852ab3942cea316258ae4ef346 (v1.0.6) on October 16 and 17, 2026, plus an install check inside Claude Code on October 28. Workflow: Claude Code built six features of a small TypeScript service; Claude and Codex reviewed each branch three times, and every bug claim was checked by a test or code trace. Result: /codex:adversarial-review found 10 of the 42 real bugs, against 23 for a fresh Claude review, and was rarely wrong; /codex:review gave an all-clear on half its reviews. Verdict: adopt with care, as a quick second check after Claude reviews its own changes, if you already use Codex.

Set up codex-plugin-cc with your coding agent

Paste this into Claude Code or another coding agent that can run commands; it follows the README and asks before installing anything.

1. Check for Node.js 18.18 or later and the Codex CLI (codex --version). If Codex is missing, show me npm install -g @openai/codex and wait for my yes; no sudo unless I agree.
2. Tell me to run codex login myself (ChatGPT plan or API key). Never ask for, read or print my credentials.
3. Tell me to type in Claude Code, one at a time: /plugin marketplace add openai/codex-plugin-cc, /plugin install codex@openai-codex, /reload-plugins, /codex:setup.
4. Leave the review gate off. For a branch I am about to merge, tell me to first ask the Claude session that wrote the code to review its own changes, then run /codex:adversarial-review --wait --base main.
5. Report what was installed and anything that failed, with at most one retry.

What codex-plugin-cc adds to Claude Code

The plugin is Apache-2.0 licensed, with seven releases between March and July 2026. It drives the Codex CLI on your machine, logged in with a ChatGPT plan or an OpenAI API key, and the README says the usage counts against your Codex limits.

/codex:review runs Codex’s built-in reviewer on your uncommitted changes or, on a clean tree, on your branch; --base main reviews the committed branch against main.
/codex:adversarial-review sends the plugin’s own long prompt, telling Codex to “break confidence in the change”.
/codex:rescue hands Codex a task and /codex:transfer moves the conversation to Codex; /codex:status, /codex:result and /codex:cancel manage background jobs.
/codex:setup checks the install and turns the optional review gate on or off. With the gate on, Codex reviews each turn before Claude can finish it.

Claude cannot call the review commands itself, but when we asked it in plain words to use the plugin, it ran the review script directly and showed Codex’s answer unchanged. We tested the two review commands and the gate, not rescue or transfer. Alternatives: Claude Code’s /code-review, or Codex’s own /review and @codex review.

/codex:review calls Codex’s own reviewer, read-only

/codex:review --base main starts Codex in a read-only sandbox and hands the branch to Codex’s built-in reviewer with no prompt of its own. These two requests, trimmed, start the review:

{"method":"thread/start","params":{"model":null,"approvalPolicy":"never","sandbox":"read-only","ephemeral":true}}
{"method":"review/start","params":{"delivery":"inline","target":{"type":"baseBranch","branch":"main"}}}

"model": null leaves the model to Codex’s own config; with none set, it used gpt-6.1-sol at low effort. Add --wait to get the review inline; with neither --wait nor --background, Claude asks which you want. In our Claude Code check, Claude showed every review word for word, as the plugin tells it to.

On our Ubuntu 24.04 test machine the review sandbox would not start until we set kernel.apparmor_restrict_unprivileged_userns to 0, which turns off a kernel safeguard for the whole machine.

How we tested the reviews

Claude Code built six features of a small invoicing service from written specs, and all six passed their hidden acceptance tests, so the bugs left were ones those tests missed. Each branch was reviewed three times by a fresh Claude session, by the session that wrote the code and by both Codex commands, plus once by Claude Code’s /code-review high.

We merged the findings into 94 distinct claims and checked each by test or code trace. A Claude checker and a Codex checker judged every claim, and a third session settled their disagreements. That left 42 real bugs, 13 of them material: worth blocking a merge over.

Codex was rarely wrong and found fewer bugs than Claude

“Held up” is the share of a reviewer’s proven-or-disproven findings that were real. Codex’s times are its review call alone; Claude’s are whole sessions. Typed in Claude Code, one adversarial review took 48 s from command to answer.

Review	Bugs per run	Material per run	Distinct bugs, all runs	Distinct material, all runs	Held up	Mean time
A fresh Claude review	17.3	5.3	23	8	70%	80 s
Claude reviewing its own work	18.7	6.0	30	7	82%	58 s
Claude Code’s `/code-review high`, 1 run	22	8	22	8	69%	103 s
`/codex:review`	3.7	2.0	6	3	100%	16 s
`/codex:adversarial-review`	7.3	4.7	10	6	88%	27 s

/codex:review at its best, on the member-invites branch (trimmed):

[P2] Use consistent password handling for acceptance and login
  When a new invitee chooses a password with leading or trailing whitespace,
  acceptance hashes it verbatim, but `/auth/login` trims passwords through
  `requireString`. For example, accepting with `" password123 "` succeeds,
  yet logging in with that same password returns 401.

That account can never log in. No Claude review found it.

But /codex:review was often silent: 9 of its 18 reviews found nothing. On the payment-reminders branch, which held three material bugs, all three runs gave an all-clear. Run 1:

The reminder scheduling, delivery, deduplication, and invoice presentation changes follow the specified behavior. All 51 tests pass, and no actionable regressions were identified.

/codex:adversarial-review found two of those three bugs in every run. Typed in Claude Code, its review of that branch came back like this (trimmed):

Codex Adversarial Review
Target: branch diff against main
Verdict: needs-attention

Do not ship: delivery failures can duplicate accepted reminders, and interrupted jobs permanently block future reminders.

Findings:
- [high] Make delivery idempotent across post-send database failures (src/jobs/reminders.ts:97-111)
- [high] Recover abandoned running jobs before deduplicating reminders (src/jobs/reminders.ts:55-62)

No Codex review found the third: one workspace with a bad time zone, which only internal tooling can set, stops the hourly reminder job for every workspace. All three self-reviews caught it.

At high reasoning effort (one run per branch), both Codex commands found about the same and took more than twice as long.

Claude wrote the specs, the code and the checking tests, which could favour Claude. So we recounted using only the bugs the Codex checker also accepted, and only the bugs either checker rated material. Every Claude review still found more than either Codex command:

Distinct bugs, all runs	Fresh Claude	Self-review	`/code-review high`	`/codex:review`	Adversarial
The 30 the Codex checker accepted	17	21	14	5	8
The 22 either checker rated material	13	14	12	4	7

On an earlier version of the service with 18 planted bugs, /codex:review and a fresh Claude review each found 17. Our reading: Codex’s reviewer reports the few clearest problems, which suits planted mistakes better than the edge cases left in code that passes its tests.

After Claude’s self-review, /codex:adversarial-review and a second Claude review came out level

To test the pitch that Claude writes and Codex reviews, we combined the self-review’s findings with a second review’s from the same run. Before any review ran, we set the rule (the adversarial pairing was added after the first results): a pairing wins only if it finds at least three more distinct bugs across all runs and has a higher average per run.

Self-review plus	Distinct bugs, all runs	Distinct material, all runs	Bugs per run	Material per run
`/codex:adversarial-review`	34	11	21.3	8.7
A fresh Claude review	35	9	25.0	7.7
`/codex:review`	32	9	20.7	7.7

By that rule the adversarial review and a second Claude review came out level: the Claude pairing found more bugs per run, the adversarial pairing slightly more material ones. The /codex:review pairing found fewer. The adversarial review also caught three material bugs that the fresh Claude review and the self-review both missed, including a reminder sent twice when a database write fails after the email goes out.

Asking Claude to check /codex:review’s findings kept every real bug Codex had named and added three, far fewer than Claude’s own review. Ask Claude for its own review, not just a check of Codex’s list.

Codex’s gate check blocked a bad edit, and the gate blocks when Codex fails

Given an edit that broke a boundary check, Codex’s gate check answered BLOCK both times:

BLOCK: The updated check rejects valid credits that exactly reach the invoice total.

For the correct edit it answered ALLOW both times; each check took 8 to 13 s.

The gate also blocks when Codex errors out or returns nothing usable, so while Codex is failing, every attempt by Claude to finish is sent back. One user reports that loop after a ChatGPT usage limit ran out, and issue 548 traces it in the code. Claude Code itself stops a turn after nine blocks in a row:

A hook blocked the turn from ending 9 consecutive times ...
Set CLAUDE_CODE_STOP_HOOK_BLOCK_CAP to raise this limit.

So a failing Codex could cost nine failed Codex calls and eight extra Claude replies per turn. We saw the cap with a stand-in hook, not the plugin’s gate. The gate is off by default.

Run it after Claude’s own review if you already use Codex

If you already use Codex, adopt codex-plugin-cc with care and run /codex:adversarial-review --wait --base main as a quick second check after Claude’s self-review.

First ask the session that wrote the code to review its own changes, then run the adversarial review.
Prefer the adversarial review to /codex:review, leave Codex’s effort at its default, and read Codex’s all-clear as no news.
Keep the review gate off unless you are watching (/codex:setup --disable-review-gate); if you turn it on, do not raise CLAUDE_CODE_STOP_HOOK_BLOCK_CAP.
Without Codex, skip it: a second Claude review after the self-review did as well.

If a later release stops the gate blocking when Codex fails, it becomes safer to leave on.

Suggested reviews

pr-lens: AI draws the diagram, you review the code
pr-lens is a pull request visualization tool for developers reviewing agent-written code. The diagrams offer a starting point; checking the changed files and relationships remains your job.
cc-safety-net blocks destructive commands before your coding agent runs them
cc-safety-net is a Claude Code hook that refuses the git discards, deletes and secret reads before a coding agent runs them. It refused nearly all of those; database commands need rules you write.
headroom compresses coding agents' tool output and keeps the originals
headroom is a local proxy that shrinks bulky command and tool output, like test logs and JSON, before a coding agent sends it to its model, and keeps the originals so the model can fetch any detail that was cut.
grill-me from Matt Pocock's skills repo makes your coding agent question the plan first
grill-me is a skill that makes a coding agent interview you in numbered rounds of questions, each with a suggested answer, before it writes code. A prompt asking for follow-ups gets the same result; grill-me saves you writing it.