> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/quickstart-guides/codex-cli-guide.md).

# Codex guide

Access Snyk Studio in Codex (UI or CLI) to ensure generated code is secure at inception (SAI). Snyk Studio supports a default hooks-based approach to SAI for Codex.

## Install Snyk Studio with hooks support

For installation instructions, visit [Getting started with Snyk Studio](/agent-security/agentic-security-with-snyk-studio/getting-started-with-snyk-studio.md#install-snyk-studio-for-ades-with-hooks-support).

## Install Snyk Studio (legacy rules-based approach)

### Prerequisites

* [Install Codex](#install-codex-cli)
* [Install the Snyk CLI](/developer-tools/snyk-cli/install-the-snyk-cli.md)
* [Install the Snyk MCP](#install-the-snyk-mcp-server-in-codex-cli-using-npx)

### Install Codex

For Codex CLI, Consult the official OpenAI Codex CLI documentation on GitHub for [Codex CLI installation instructions](https://github.com/openai/codex).

For Codex UI, Download from <https://chatgpt.com/codex/>

### Install the Snyk MCP Server in Codex using npx

This installation instruction assumes you have a Node.js local development environment setup with the `npx` executable.

To install the Snyk MCP Server using Codex's own `.codex/config.toml` file, proceed with the following instructions:

* Create or edit the `.codex/config.toml` file
* Insert the following `mcp_servers` configuration block to the file:\\

  ```
  [mcp_servers.snyk-security]
  command = "npx"
  args = ["-y", "snyk@latest", "mcp", "-t", "stdio"]
  ```
* Restart Codex

### Install the Snyk MCP Server in Codex using Snyk CLI

This installation instruction assumes you have installed the Snyk CLI and the `snyk` executable is available in your system's path.

To install the Snyk MCP Server using the `.codex/config.toml` Codex file, follow these instructions:

* Create or edit the `.codex/config.toml` file
* Insert the following `mcpServers` configuration block to the file:\\

  ```
  [mcp_servers.snyk-security]
  command = "/absolute/path/to/snyk"
  args = ["mcp", "-t", "stdio"]
  ```

{% hint style="info" %}
If you installed `snyk` using npm as a global module and you are using fnm to manage your versions, then you must specify the full path to the `snyk` executable. The path may look like this: `/Users/username/.local/state/fnm_multishells/8831_1753881185071/bin/snyk`.
{% endhint %}

* Restart Codex

## Set up the Snyk MCP Server

As a one-time setup, you may need to authenticate and trust the current Project directory. If required, the agentic workflow will likely manage this automatically.

These workflows are mostly automatically executed by the underlying model and the agentic code assistant, and you will need to approve them using a browser confirmation dialog. The process should look similar to this:

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2FStm3NoyCMSz2LS2GrN7W%2Fimage.png?alt=media&amp;token=9be18d8b-903e-4614-ae47-8b2bc7e5bf46" alt="Snyk MCP server running a workflow in Codex CLI"><figcaption></figcaption></figure>

You can explicitly prompt to authenticate your account as follows:

```
Authenticate my Snyk account
```

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2FsqHkupBZfw60ua0lYiYq%2Fimage.png?alt=media&amp;token=a04f784f-c0c3-41af-859b-6fbc8c8bcc8a" alt="Prompting Codex CLI to authenticate the Snyk account"><figcaption></figcaption></figure>

If you are not authenticated, this prompt opens a browser for you to authenticate to the Snyk Web UI, and then you can continue with the agent.

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2F30hph000Rxu2wufNaIcW%2Fimage.png?alt=media&amp;token=5dcb41d2-5f19-469f-ae83-fc1db7143a9a" alt="Browser opened to authenticate to the Snyk Web UI" width="375"><figcaption></figcaption></figure>

## Examples

### Scanning for security vulnerabilities

In the chat, you can tag specific files or functions and ask the agent to scan your code and third-party dependencies of the Project.

{% code title="prompt" overflow="wrap" %}

```
Scan this directory for code security & dependency vulnerabilities and security issues
```

{% endcode %}

Codex will invoke Snyk scanning, provide output and insights based on the results that Snyk returned:

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2FYXmbmowOEGG03pat45gS%2Fimage.png?alt=media&amp;token=f9d2e2ec-88a8-476e-90b8-e625cf544db8" alt="Codex CLI reporting the results of a Snyk scan"><figcaption></figcaption></figure>

### Secure at inception rules

To practice [Secure at Inception](https://docs.snyk.io/glossary#secure-at-inception-directive), Snyk recommends adopting rules that align the LLM for secure code generation and workflows.

The following is a suggested instruction for [Codex's AGENTS.md context file](https://github.com/openai/codex?tab=readme-ov-file#memory--project-docs). Add the following contents to the `AGENTS.md` file in your root directory of your Project:

{% code title="AGENTS.md" overflow="wrap" %}

```
# Project security best practices

- Always run **snyk_code_scan** tool for new first party code that is generated in a Snyk-supported language.
- If any security issues are found based on newly introduced or modified code or dependencies, attempt to fix the issues using the results context from **Snyk**.
- Rescan the code after fixing the issues to ensure that the issues were fixed and that there are no newly introduced issues.
- Repeat this process until no new issues are found.
```

{% endcode %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/quickstart-guides/codex-cli-guide.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.