"Codex review" covers two features. Locally, /review (or the codex review command for scripts) starts a dedicated reviewer that reads your Git diff and reports prioritized findings without touching your files. In the cloud, commenting @codex review on a GitHub pull request, or turning on automatic reviews, makes Codex post a normal GitHub review focused on serious issues.
This guide covers both, plus GitLab, custom review rules in AGENTS.md, and fixes when a review never shows up. Everything comes from OpenAI's Code review page, the GitHub integration guide and the command reference, read on 26 October 2026, when the latest Codex CLI release on GitHub was 0.164.0.
Which Codex review should you use?
| Option | Where | Reviews | Posts comments? |
|---|---|---|---|
/review |
CLI, IDE extension, desktop app | Your local Git changes | No, findings stay in the chat |
codex review |
Terminal, scripts, CI | Local changes, a branch diff or a commit | No, prints the review |
@codex review |
GitHub pull request comment | The pull request diff | Yes, a standard GitHub review |
| Automatic review | GitHub, GitLab (beta) | Every qualifying pull or merge request | Yes |
| Code Review plugin | Desktop app, ChatGPT web | A pull request you open | Only what you choose to submit |
Use local review before you push, to catch problems while they are cheap. Use cloud review as a second pass on pull requests your team is about to merge. Many teams run both.
How do you use /review in the Codex CLI?
Type /review in the terminal UI to open the review presets. The code review page says Codex "starts a dedicated reviewer that reads the selected diff and reports prioritized, actionable findings without changing your working tree." You get four scopes:
- Review against a base branch finds the merge base and reviews your branch diff.
- Review uncommitted changes includes staged, unstaged and untracked files.
- Review a commit reviews the exact change set of one commit.
- Custom review instructions focuses the review on criteria you write.
The review appears as a turn in the transcript. Follow up with /diff to see the exact file changes, then ask Codex to fix specific findings if you agree with them. Fixes go through your normal sandbox and approval settings.
By default the review uses the current session model. To use a different one, set it in config.toml:
review_model = "gpt-6.1-sol" # replace with a model your account can use
In the IDE extension, /review offers two scopes, base branch and uncommitted changes, and appears only when the open project is inside a Git repository. Set chatgpt.reviewDelivery to detached if you want reviews in a separate chat. In the desktop app, /review offers the same two choices and shows findings as inline comments in the review pane.
How does the codex review command work?
codex review is the non-interactive version, for scripts, Git hooks and CI. The command reference describes it as: "Run a code review non-interactively. Choose exactly one review target, or pass custom review instructions as a prompt."
| Option | Value | What it does |
|---|---|---|
--uncommitted |
flag | Review staged, unstaged and untracked changes |
--base |
branch | Review changes against that base branch |
--commit |
SHA | Review the changes introduced by one commit |
--title |
string | Commit title shown in the summary; requires --commit |
PROMPT |
text or - |
Custom review instructions; - reads them from stdin |
--strict-config |
flag | Error on unknown fields in config.toml |
--uncommitted, --base, --commit and a custom prompt conflict with one another, so pick one per run.
codex review --uncommitted
codex review --base main
codex review --commit 1a2b3c4 --title "Add retry to webhook sender"
codex review "Focus on SQL injection and missing input validation"
cat review-checklist.md | codex review -
For automation, CODEX_API_KEY works with codex review as well as codex exec. Set it only on the command that needs it, not job-wide, because other steps in the same job could read it:
CODEX_API_KEY=<api-key> codex review --base main
For more on unattended runs, such as auth, sandbox choices and CI, the codex exec guide is useful background.
How do you use @codex review on GitHub?
Cloud review needs a GitHub repository connected to Codex and access to Codex code review settings. To set it up:
- Connect your GitHub repository to Codex.
- Open Codex settings at chatgpt.com/settings/code-review.
- Choose the repository and turn on Automatic review under Review code.
Configuring automatic reviews needs GitHub push or admin permission on the repository. Then, in any pull request comment, write:
@codex review
Codex reacts with an eyes emoji and posts a review, "just like a teammate would." The GitHub guide states: "In GitHub, Codex flags only P0 and P1 issues so review comments stay focused on high-priority risks." Expect a few pointed comments, not a long list of style nits.
For a one-off focus, add it after the trigger:
@codex review for issues in the database migration
To skip the comment entirely, turn on Automatic review under Personal preferences in the same settings page and choose when reviews run with Review trigger. Per the code review page, cloud review "doesn't require you to create or manage a cloud environment."
What happens after Codex posts a review?
You can ask Codex to act on its own findings in the same pull request:
@codex fix the P1 issue
That starts a legacy cloud chat with the pull request as context, and Codex can push a fix back to the branch when it has permission. Any other @codex mention that is not review, such as @codex fix the CI failures, also starts a cloud chat using the pull request as context. The Codex cloud guide covers how those tasks run.
There is also Security Review, in research preview, which goes deeper on security risks using the diff, repository context and any configured threat models. Trigger it with @codex security review, or turn on Auto security review in settings and set Trigger to Whenever code review runs. The full report appears under the Security Report tab of the associated Codex task.
How do you customize what Codex reviews?
Codex searches your repository for AGENTS.md files and follows any code review rules in them. Add a ## Code Review Rules section to the file closest to the code it governs, using ### headings to group checks:
## Code Review Rules
### Payments
- Flag any change that retries a charge without an idempotency key.
Safe path: retries reuse the key from the original request.
Put repository-wide rules in the root AGENTS.md and service rules in a nested file such as services/payments/AGENTS.md. Codex "applies the root and more-specific guidance that covers each changed file," so unrelated changes do not carry service-specific context.
OpenAI's advice for good rules, summarized:
- Start with two or three rules that encode checks reviewers often explain by hand.
- Describe the consequence and why it matters, not just a function name.
- State the safe path or exception so Codex can tell a real issue from expected behavior.
- Leave formatting and lint checks to CI.
The docs also note that rules "don't replace tests, branch protections, or required approvals." The AGENTS.md guide covers the file format in general.
Does Codex review work with GitLab?
Yes, in beta. The GitLab guide says "GitLab support is in beta and is available on all ChatGPT plans" and that the integration runs in Codex cloud. Separately, the code review page says "GitLab merge request support in Code Review is in preview," which refers to the Code Review plugin in the desktop app and ChatGPT web. You connect a GitLab account (GitLab.com, or self-managed and Dedicated instances through a workspace-admin template), enable GitLab activity through a project or group webhook, then comment @codex review on a merge request. On GitLab.com, a project environment is also required to enable reviews.
Two differences from GitHub: by default, manually requested GitLab reviews can include P0, P1 and P2 findings, while automatic reviews focus on P0 and P1; and automatic reviews offer triggers On MR open, On every push and Smart Trigger (Experimental).
Can you build your own review workflow?
If you want full control over the prompt and where comments go, OpenAI's openai/codex-action README includes an example workflow that runs Codex on each new pull request and posts its output as a comment. It notes that Codex cloud already offers a code review tool, and presents the action as the route "if you want to have more control over the experience." The Codex GitHub Action guide walks through setup and the safety strategies.
Why didn't Codex post a review?
From OpenAI's troubleshooting list:
- Code review is not turned on for the repository in Codex settings.
- The pull request is in a repository that is not connected to Codex.
- The comment does not use the exact trigger
@codex review. - For automatic reviews, Automatic review is off in repository settings or Personal preferences, or the pull request event does not match your trigger.
Locally, if /review is missing in the IDE extension, the open folder is probably not inside a Git repository.
Keep your review checklists reusable
The custom instructions you type into /review or codex review "..." are worth saving. Kipt keeps prompts and Agent Skills as Markdown in a private GitHub repo you own, with {{name}} blanks for things like the branch or focus area, so a review checklist is one search away. For ready-made wording, see the code review prompts, and to compare tools, the Claude Code review and Copilot code review guides.