Source-led tool profile

Codex

OpenAI's software-development agent for inspecting repositories, editing code, running commands and tests, reviewing changes, and scheduling bounded background work.

Editor's pickNot hands-on tested
Our standard: this is an editorial profile based on official product information, not a laboratory test or paid ranking. Pricing and terms were last checked on 2026-11-05.

Who is Codex for?

Best for: Developers, technical creators and small teams that want an agent to carry a scoped software task from repository inspection through verified changes.

Probably not for: Unsupervised production changes, broad access to secrets or customer data, or tasks with no measurable finish line and no human review.

Three practical uses

  • Inspect an unfamiliar repository and explain its architecture before editing
  • Implement, test and review a scoped feature or bug fix
  • Schedule bounded maintenance, research or triage work for later review

What stands out

  • Works across local and cloud development surfaces
  • Can inspect files, edit code, run commands and verify results
  • Supports reusable AGENTS.md instructions, skills, Goals and scheduled Automations

Limits to check before you pay

  • Agent output and code still require human review before merge or deployment
  • Network, filesystem, connector and credential access should be restricted to the minimum required scope
  • Usage depends on the selected model, task complexity, plan limits and optional purchased credits

Always verify export rights, commercial-use rules, privacy handling and regional availability for your exact plan. When the official source does not make a point clear, AI RankLab labels it as not verified rather than guessing.

What changed or was verified

  • OpenAI describes Codex as a software-development agent available across desktop, CLI, IDE, cloud, web and mobile surfaces for writing, reviewing and debugging code. Official Codex overview ↗
  • Codex App Automations combine saved instructions with optional skills, run on a schedule and place completed work in a review queue. Official app announcement ↗
  • OpenAI's Goals guide recommends defining an outcome, verification evidence, constraints, boundaries, an iteration policy and a blocked stop condition. Official Goals guide ↗
  • OpenAI's security guidance says agent workloads should be isolated, network access restricted and long-lived credentials kept outside the agent environment where possible. Official security guide ↗

Evidence note: these are source-verified product facts, not hands-on performance findings. Product access and pricing can change after the review date.

Complete usage guide

Codex works best when you give it a concrete outcome, a bounded workspace, evidence that proves completion, commands to run, actions that require approval, and a stop condition. Start with one repository and one verifiable task. Review the diff and test evidence before merging or deploying.

Guide reviewed 2026-11-04. Includes 24 original, adaptable prompt templates.

How to get started

  1. Choose the right surfaceUse the desktop app for parallel threads and scheduled work, the CLI for terminal-first repository work, the IDE extension for editor-attached changes, or cloud tasks when work should continue away from the local machine.
  2. Open the smallest safe scopeStart Codex in the repository or folder it needs. Do not expose unrelated folders, personal files, production credentials or customer data.
  3. Add durable repository rulesPut project conventions, required commands, protected files and release boundaries in AGENTS.md. Keep a one-off requirement in the task prompt instead.
  4. Begin with inspectionFor an unfamiliar repository, ask Codex to map the architecture, locate relevant files and report risks before it edits anything.
  5. Define proof of completionName the exact tests, build, benchmark, screenshot, generated file or source evidence that must pass before the task is considered complete.
  6. Review before external actionInspect the diff, logs and test results. Keep merging, deployment, purchases, account changes and destructive operations behind explicit approval.

Choose the right surface

SurfaceBest forImportant caution
Codex desktop appMultiple work threads, worktrees, review queues, skills and scheduled Automations.Background work still needs bounded permissions and a review step.
Codex CLILocal, terminal-first repository work with direct access to project commands.Run it from the intended folder and inspect every requested permission expansion.
IDE extensionEditor-attached questions, targeted edits and fast iteration around open files.Open-file context is not a substitute for repository-wide tests.
Cloud, web and mobileOffloading longer tasks and reviewing progress away from the local machine.Confirm which repository, branch, environment and credentials are connected.
GoalsA difficult task that should continue until measurable evidence says it is complete or blocked.Use only with a clear finish line, verification surface and stop condition.
AutomationsRepeatable triage, maintenance, research and reporting on a schedule.Default to reporting or draft changes; require approval for merges, deploys and external writes.

A reliable prompt formula

  • Outcome: state what must be true when the task is finished.
  • Scope: name the repository, folders, files, services and sources Codex may use.
  • Evidence: list the tests, build, benchmark, screenshots or citations that prove the result.
  • Constraints: state behavior, APIs, content, security rules and user changes that must be preserved.
  • Authority: separate actions Codex may take from actions that require approval.
  • Output: request a concise change summary, evidence, residual risks and any manual follow-up.
  • Stop condition: say when to stop and report a blocker instead of guessing or expanding scope.

Prompt library

Open a template, replace every bracketed field and remove instructions that do not apply. These are AI RankLab editorial templates, not official vendor prompts.

Understand a repository

Use these before editing an unfamiliar codebase or accepting a large change request.

Repository orientationYou need a trustworthy map before making changes.
Inspect this repository without changing files.
Explain the runtime, frameworks, entry points, data flow, authentication, persistence, deployment path and test strategy.
Identify the files most relevant to [task]. Separate confirmed findings from assumptions.
Return: architecture map, relevant file list, commands to verify the project and the five highest-risk unknowns.
Review before accepting the result
  • No files should change.
  • Every claim should point to a file or command.
  • Unknowns should remain labeled.
Change-impact mapA request may affect several routes, packages or services.
Analyze the impact of this proposed change: [change]. Do not edit yet.
Trace affected UI, API, database, configuration, tests, analytics, documentation and deployment surfaces.
List backward-compatibility, security, accessibility and migration risks.
Finish with the smallest coherent implementation scope and the exact verification plan.
Review before accepting the result
  • Downstream consumers are included.
  • The plan names tests.
  • Scope is not larger than necessary.
Implementation plan from an issueAn issue is vague or mixes symptoms with solutions.
Turn this issue into an implementation-ready plan: [paste issue].
First verify the current behavior in the repository. Distinguish the user problem, suspected cause and proposed solution.
Name affected files, acceptance criteria, edge cases, tests and rollback considerations.
Do not implement. Ask only for missing information that would materially change the solution.
Review before accepting the result
  • The plan checks current behavior.
  • Acceptance criteria are observable.
  • Open decisions are explicit.

Build features

Prompts for complete, scoped implementation rather than isolated code snippets.

Implement a feature end to endThe desired behavior and acceptance criteria are known.
Implement [feature] in this repository.
Preserve [public behavior or API]. Follow existing architecture and styling; reuse existing helpers before adding new abstractions.
Cover UI, server, data, validation, error states, accessibility and documentation where relevant.
Run [commands]. Do not merge or deploy. Return changed files, test evidence, tradeoffs and remaining risks.
Review before accepting the result
  • All required surfaces are wired.
  • Validation and failure states exist.
  • Tests cover the acceptance criteria.
Build a responsive interfaceYou have a design brief, screenshot or component requirement.
Build the responsive interface described in [brief or image].
Preserve the existing design system, typography and component patterns. Match hierarchy, spacing and interaction states rather than inventing a new visual language.
Implement keyboard access, focus states, semantic HTML, reduced-motion behavior and mobile layouts.
Run the app and relevant tests. Report any visual detail that could not be verified.
Review before accepting the result
  • Mobile and desktop are checked.
  • Keyboard and focus behavior work.
  • No unrelated redesign was introduced.
Add a safe API endpointA new server route or handler is required.
Add an API endpoint for [purpose] using the repository's existing patterns.
Define input and output types, authentication, authorization, validation, rate limits, idempotency and error behavior before coding.
Never log secrets or sensitive request bodies. Add tests for success, invalid input, unauthorized access and dependency failure.
Run [commands] and provide example requests that contain no real credentials.
Review before accepting the result
  • Authorization is separate from authentication.
  • Errors do not leak sensitive data.
  • Negative tests are included.

Fix bugs and failures

Require reproduction and evidence so Codex fixes a cause rather than hiding a symptom.

Reproduce and fix a bugYou have a bug report but the cause is unknown.
Investigate this bug: [symptoms and reproduction notes].
Reproduce it first. Record expected behavior, actual behavior and the smallest failing case.
Identify the root cause, implement the narrowest robust fix and add a regression test that fails before the fix.
Run [commands]. Do not weaken validation or silence errors. Return evidence and residual uncertainty.
Review before accepting the result
  • A reproduction exists.
  • The test proves the regression.
  • The fix addresses the root cause.
Diagnose a flaky testA test passes and fails intermittently.
Investigate flaky test [name or path].
Run it repeatedly and inspect timing, shared state, ordering, random data, network, clock and concurrency dependencies.
Do not solve the problem by increasing timeouts or adding retries unless evidence shows that is correct.
Implement a deterministic fix, stress-run the test and report reproduction rate before and after.
Review before accepting the result
  • The failure mechanism is explained.
  • The fix removes nondeterminism.
  • Repeated runs support the conclusion.
Repair a CI failureA local branch or pull request fails in CI.
Diagnose this CI failure using the supplied logs: [logs or run link].
Map the failure to the workflow, environment and exact command. Check whether it reproduces locally without changing CI first.
Fix the underlying repository or workflow issue with the smallest safe change.
Do not disable checks. Return the failing evidence, cause, patch, local verification and any CI-only uncertainty.
Review before accepting the result
  • Checks remain enabled.
  • Environment differences are considered.
  • The proposed fix is locally verified where possible.

Review quality and security

Use Codex as an additional reviewer, not a replacement for accountable human approval.

Risk-first code reviewYou want findings rather than a change summary.
Review the current diff for defects, regressions, security risks and missing tests.
Prioritize concrete, actionable findings by severity. For each finding, cite the file and line, explain the failure scenario and suggest the smallest fix.
Ignore formatting preferences unless they cause a real problem.
If no finding is confirmed, say so and list only residual test gaps or assumptions.
Review before accepting the result
  • Findings are evidence-based.
  • Severity matches impact.
  • No invented issue is included to fill space.
Security boundary reviewA change touches auth, secrets, uploads, network calls or user data.
Perform a scoped security review of [feature or diff].
Trace trust boundaries, authentication, authorization, input validation, secrets, logging, storage, outbound requests and destructive actions.
Identify realistic abuse paths and affected assets. Do not claim exploitability without evidence.
Return findings by severity, proof, recommended fix, tests and unresolved assumptions. Do not deploy changes.
Review before accepting the result
  • Trust boundaries are explicit.
  • Claims include a plausible path.
  • Secrets and logs are checked.
Accessibility review and fixA UI needs keyboard, screen-reader and visual checks.
Audit [page or component] for practical accessibility issues, then fix confirmed problems.
Check semantic structure, labels, keyboard navigation, focus order, focus visibility, contrast, motion, errors and dynamic announcements.
Preserve the design unless a change is required for access.
Run available automated checks and list the manual checks that still require a browser or assistive technology.
Review before accepting the result
  • Keyboard flow is verified.
  • Automated checks are not presented as complete coverage.
  • Manual checks are identified.

Test, refactor and migrate

Make internal improvements without accidentally changing public behavior.

Add a focused test suiteBehavior exists but important paths are untested.
Add tests for [behavior] using the repository's existing test framework.
Cover the main success path, boundary inputs, invalid input and the highest-risk regression. Prefer observable behavior over implementation details.
Do not change production behavior merely to make testing easier unless you explain and justify the design improvement.
Run the smallest relevant suite, then the broader required suite. Report coverage gaps.
Review before accepting the result
  • Tests fail for meaningful regressions.
  • Fixtures contain no sensitive data.
  • The suite remains deterministic.
Behavior-preserving refactorCode needs simplification without feature changes.
Refactor [scope] to improve [clarity, duplication or maintainability] without changing public behavior.
Establish a baseline with existing tests and observable outputs. Keep the diff focused and preserve APIs, data formats and error semantics.
Add characterization tests where behavior is not already protected.
Run [commands] and explain why the before-and-after behavior is equivalent.
Review before accepting the result
  • A behavioral baseline exists.
  • Public contracts remain unchanged.
  • The diff does not mix new features.
Dependency upgradeA library or framework must be upgraded safely.
Upgrade [dependency] from [current] to [target].
Read the official migration and release notes supplied here: [sources]. Identify breaking changes that apply to this repository.
Update only directly related code and configuration. Do not perform unrelated modernization.
Run install, type-check, tests and build. Report lockfile changes, deprecations, unresolved warnings and rollback steps.
Review before accepting the result
  • The target version is explicit.
  • Official migration notes are used.
  • Unrelated packages are not silently upgraded.

Performance and operations

Ask for measured improvements, deployment evidence and reversible operational changes.

Profile before optimizingA page, endpoint or job is slow.
Improve [performance target] for [scope], verified by [benchmark or metric].
Measure a baseline first. Identify the dominant bottleneck with profiling evidence rather than guessing.
Make one coherent optimization at a time and preserve correctness, accessibility and resource limits.
Rerun the benchmark and tests. Report before-and-after numbers, methodology and variance.
Review before accepting the result
  • Baseline and final measurements are comparable.
  • Correctness remains green.
  • Numbers are not invented.
Deployment readiness reviewA release candidate is ready for final checks.
Assess whether the current branch is ready to deploy. Do not deploy.
Check the diff, tests, build, migrations, environment variables, feature flags, monitoring, rollback path and release documentation.
Separate blocking issues, acceptable risks and manual checks.
Return a go or no-go recommendation with evidence. Never infer production configuration that is not visible.
Review before accepting the result
  • No deployment occurs.
  • Rollback is specific.
  • Unknown production state remains unknown.
Incident investigationA production symptom needs a factual timeline and next action.
Investigate incident [description] using only the supplied logs, metrics, deploy history and repository.
Build a timestamped timeline. Separate confirmed facts, hypotheses and missing evidence.
Identify containment options first, then likely root causes and safe verification steps.
Do not change production. Return immediate actions, evidence requests, rollback considerations and a draft post-incident outline.
Review before accepting the result
  • Facts and hypotheses are separated.
  • Containment precedes optimization.
  • Sensitive log data is not repeated unnecessarily.

Documentation, research and SEO

Codex can work beyond source code when the repository includes documentation and content workflows.

Write source-led documentationA feature needs accurate user or developer documentation.
Write or update documentation for [feature].
Verify every command, option and behavior against the current repository and supplied official sources. Do not fill gaps from memory.
Include prerequisites, a minimal example, expected output, common failures and rollback or removal steps where relevant.
Run documentation checks and flag anything that was not executable in this environment.
Review before accepting the result
  • Commands match current behavior.
  • Unknowns are labeled.
  • Examples contain no secrets.
Source-led product researchYou need a publishable brief without copied marketing language.
Research [product or topic] using first-party sources from [date range].
Separate verified facts, vendor claims, reasonable inference and unknown information. Record a URL and publication or review date for every material claim.
Explain user impact, limits, cost signals and the next action a reader can take.
Do not copy source wording or invent hands-on experience, ratings, traffic, revenue or market leadership.
Review before accepting the result
  • Material claims have first-party sources.
  • Marketing claims are labeled.
  • The result is original synthesis.
Update an SEO page safelyAn existing page needs current facts and stronger search usefulness.
Improve [page] for the search intent [query] without creating a thin rewrite.
Inspect the current page, internal links, competing site pages and supplied first-party sources. Preserve useful existing work.
Update dated facts, add limitations, alternatives, practical steps, source links, reviewed date, metadata and structured data where appropriate.
Run content checks, lint, tests and build. Do not publish or deploy without explicit authorization.
Review before accepting the result
  • The page has one clear intent.
  • No unsupported claim was added.
  • Internal linking and metadata are checked.

Goals, skills and Automations

Use durable instructions only when the task truly needs persistence or repetition.

Evidence-based GoalA difficult task should continue until it succeeds or reaches a real blocker.
/goal Achieve [measurable outcome], verified by [tests, benchmark or artifact], while preserving [constraints].
Use only [allowed repositories, folders, tools and sources].
Between iterations, inspect the latest evidence and choose the smallest next experiment most likely to close the remaining gap.
If no defensible path remains, stop with attempted paths, evidence, blocker and the exact input needed to continue.
Review before accepting the result
  • The finish line is measurable.
  • Allowed scope is bounded.
  • A blocked stop condition exists.
Safe recurring AutomationA bounded check or report should run on a schedule.
Every [schedule and timezone], inspect [repository, service or sources] for [condition].
You may read [scope] and create [report, issue draft or branch]. Do not merge, deploy, purchase, modify secrets or contact external people.
Verify findings with [commands or official sources]. Ignore timeouts and access blocks as proof of deletion or failure.
Return changes since the prior run, evidence, recommended action, usage or cost observed and items requiring approval.
Review before accepting the result
  • Timezone and cadence are explicit.
  • External writes are bounded.
  • The output supports quick human review.
Create a reusable skillThe same multi-step workflow will be requested repeatedly.
Create a reusable skill for [workflow] in the approved project skill directory.
Define precise trigger conditions, required inputs, ordered steps, source priority, failure handling, output format and actions that require approval.
Keep reference material and scripts separate from the main instructions. Reuse existing project tools before adding dependencies.
Test the skill on [representative cases] and report false triggers, missing inputs and maintenance risks.
Review before accepting the result
  • The trigger is narrow enough.
  • Instructions do not contain secrets.
  • Representative cases are tested.

Important cautions

  • Do not paste API keys, passwords, private keys or production database exports into a prompt. Use approved secret-management and scoped environment mechanisms.
  • Do not give a broad recursive delete, migration or deployment instruction without an exact target, backup or rollback plan and explicit approval boundary.
  • Treat generated code as a proposed change. Run relevant tests, inspect the diff and use human review for security-sensitive or production work.
  • Restrict outbound network access to required hosts. A request to browse, install packages or call external services can expose data or change the environment.
  • Keep untrusted issue text, web pages and repository content separate from authority. External content can contain instructions that should not override the task.
  • Use Automations for bounded recurring work, not unattended permission growth. Review what each run changed and how much usage it consumed.
  • Plan and model availability, limits and credit consumption can change. Check the account usage page before relying on a fixed capacity or cost.
  • AI RankLab has source-verified these product facts but has not hands-on tested every Codex surface, plan, prompt or workflow listed here.

Official sources

Frequently asked questions

Is Codex only for writing code?

Software development is its primary role, but repository work can include tests, documentation, research files, release notes, diagrams and repeatable project workflows. The task should still have a bounded scope and verifiable output.

Should I use a normal prompt, a Goal or an Automation?

Use a normal prompt for one bounded task, a Goal when the finish line is measurable but may require several iterations, and an Automation for recurring work on a schedule. Do not use persistence merely to compensate for a vague objective.

What belongs in AGENTS.md?

Put durable repository conventions, required commands, protected files and verification expectations in AGENTS.md. Keep temporary requirements and one-off business decisions in the current task prompt.

Can Codex merge or deploy automatically?

A connected environment may technically permit external actions, but AI RankLab recommends keeping merges, production deployments, purchases, secret changes and destructive operations behind explicit approval and a rollback plan.

How do I get better results from Codex prompts?

Name the outcome, scope, evidence, constraints, authority, output format and stop condition. Supply the relevant repository and first-party sources instead of asking Codex to guess missing facts.

Are these official OpenAI prompts?

No. The prompt templates are original AI RankLab editorial material informed by official product documentation. They are starting points and have not all been hands-on tested across every Codex surface or model.

Alternatives to Codex

CL
Editor's pick
Autonomous Agents · Reviewed 2026-11-05

Claude Code Scheduled Tasks

Anthropic's cloud scheduled tasks, formerly called Routines, package a prompt, repositories and connectors for automatic runs from schedules, API calls or GitHub events.

Claude Code web / desktop / CLI / managed cloudView research
KI
Free plan
Autonomous Agents · Reviewed 2026-11-05

Kiro Workflows

Reusable multi-step plans that run separate Kiro agents in background sessions, pass artifacts between steps and pause when human input is required.

Kiro IDE / CLI / web cloud sessionsView research
RE
Autonomous Agents · Reviewed 2026-11-05

Replit Monitoring Agent

An autonomous on-call agent for published Replit apps that can investigate monitoring alerts, prepare and validate fixes, and optionally republish them.

Replit web / Replit CloudView research

Sources and update log

Primary facts come from the official product or pricing page. Added 2026-11-04; last editorial review 2026-11-05. Corrections can be sent through our correction process.