Code review with Codex: /review, @codex review and your rules

What Codex does for code review

• Reviews each pull request for bugs, missing tests and risky changes, and comments inline on GitHub.
• Follows your written review rules, so comments stay off what the linter already checks.
• Reviews its own changes, and other agents', before they reach a person.
• Tracks follow-ups: a comment that needs work becomes an issue instead of getting lost.

Codex features for code review

How to set up Codex for code review

1. Connect the tools

   /review needs only a Git repository. For reviews on GitHub, connect the repository to Codex and turn on code review for it in Codex settings.

   # On GitHub, in a pull request comment
   @codex review
   @codex review for issues in the database migration

2. Write the rules in AGENTS.md

   Codex reads AGENTS.md before any work: ~/.codex/AGENTS.md, then the files from the repository root down to the folder it's working in. Put the job's rules there, or in a skill under .agents/skills/ if they're long. See the AGENTS.md guide.

   ## Code Review Rules
   - Flag missing tests for new branches in billing/ and auth/.
   - Any SQL migration needs a rollback; say so if it doesn't have one.
   - Don't comment on formatting; the linter handles it.
   - Comment only: never approve, request changes or merge.

3. Run it without the interactive interface

   codex exec runs one task and exits. Progress goes to stderr and the final message to stdout; -o also writes it to a file and --json streams events. The sandbox is read-only unless you pass --sandbox workspace-write.

   # Review this branch against main from a script or CI
   codex review --base main
   
   # Or the changes that aren't committed yet
   codex review --uncommitted

4. Put it on a schedule

   Create a scheduled task in the ChatGPT desktop app or on the web (the CLI doesn't manage them), or run codex exec from cron. See how to make Codex proactive.

Source: Codex documentation

Limits and safety

• It comments; it doesn't own the change. Keep approvals and merges with people.
• Reviews use your plan's usage. Review on request or when a pull request is ready, not on every push.
• It reviews the diff and the repository. It can't test against production data.
• Codex sandboxes commands by default: writes stay in the workspace and the network is off. Keep danger-full-access for an isolated runner or container.

Claude Code or Codex for code review?

The rules carry over. Write them once in AGENTS.md and put @AGENTS.md in CLAUDE.md, and both agents read the same file.

Step by step for the other agent: code review with Claude Code.

Make code review someone's job

Commands run when someone remembers to run them. Crewmark turns your own Codex into an AI employee with a role, a goal in numbers, working hours and a heartbeat, so the work happens on schedule and shows up on a board.

1. Start from the role

   The AI software engineer, with these rules in its brief.

2. Put the work on its board

   Add the job as a recurring issue. The employee wakes on its heartbeat, does it and reports in a comment.

3. Related

   AI code review on every PR compares every option, and security review covers vulnerabilities.

FAQ