01
Upstream-first
Track OpenAI Codex Security improvements through a repeatable merge workflow—not a drifting rewrite.
Open source · Apache 2.0
Open-source AI security scanning for your codebase.
Find, validate, and fix code vulnerabilities with Codex, Claude Code, GLM, Kimi, or Muse—while Bex preserves the evidence and scan contract.
One click on GitHub · No signup
security workflow / active
Built for an open stackCodexClaude CodeGLM 5.3Kimi CodeMuse CodeACP v1
Why Bex Security
One security contract. Your choice of agent.
Bex Security keeps orchestration, permissions, validation, and final artifacts stable while the agent layer evolves.
02
Agent-open
Use ACP as a clean runtime boundary for Codex, Claude Code, and future compatible agents.
03
Evidence-driven
Carry findings from discovery through validation, remediation, comparison, and publication.
Portable by design
The workflow stays. The agent can change.
Bex owns the security contract end to end. Compatible agents execute inside that boundary and drafts become results only after validation.
01
Your repository
Scoped source access, treated as inert data.
02
Bex workflow
Orchestration, permissions, schemas, and policy.
03
Agent runtime
Codex or Claude today; more as they prove compatibility.
04
Validated artifacts
Evidence is checked and sealed before publication.
Choose your agent
Security scans for Claude, GLM, Kimi, and Muse users.
Use the setup that matches your coding agent while Bex Security keeps scope, validation, and artifacts consistent.
- Claude FableClaude Code supplies the Fable model and your login. Bex Security supplies the scan: repository scope, a sandbox that cannot write to your source, validation, and artifacts you can hand to another engineer.
- GLMRoute GLM through Claude Code while Bex Security keeps scan scope, workflow policy, evidence validation, and final artifacts under one consistent contract.
- Kimi CodeUse Kimi Code's native ACP agent—or Kimi behind Claude Code—while Bex Security validates findings and preserves reviewable scan artifacts.
- Muse CodeRoute Muse Spark through Bex's bundled community ACP adapter while Bex manages repository scope, host review coverage, validation, and artifacts.
Try it locally
Install once. Scan any trusted repository.
Install the published npm package, sign in to the default Codex agent, and start a report-only security scan.
Requires Node.js 22.13+ in the 22.x line, Node.js 24 or 26, and Python 3.10+. Scan only repositories you own or are authorized to assess.
bex-security / quick start
npm install --global @bex-co/bex-security
bex-security login
bex-security scan /path/to/repositoryFrequently asked questions
What is Bex Security?
Bex Security is an Apache-2.0, upstream-first fork of OpenAI Codex Security that runs evidence-driven repository scans with multiple coding agents and models.
Which coding agents can run Bex Security scans?
Codex is the default. Alpha ACP integrations support Claude Code, native Kimi Code, and Muse Code; Claude Code can also route scans to GLM or Kimi models.
Does a Bex Security scan change repository files?
Ordinary scans are report-only. Repository files change only when you explicitly request patching, and draft pull requests require an additional create-PR option.
Project status
Early, useful, and honest about both.
The stable core is available now. The open agent layer is alpha. The roadmap is public and contributions are welcome.
Published CLI + TypeScript SDK
Install @bex-co/bex-security from npm and use the Bex or compatible Codex command.
Codex + Claude over ACP v1
The first vertical slices work and are being hardened with full-scan fixtures.
Native Kimi + Muse Code agents
Kimi uses its native ACP server; Muse runs through Bex's bundled community ACP adapter.
Additional ACP agents
New agents join when they pass the same capability and artifact contracts.
Vote for an open agent layer
Help make security workflows portable.
A GitHub star tells us—and future contributors—that agent choice in code security is worth building for.
Open source · Upstream-first · Built in public