OpenQodex

OpenQodex reviews your code change before you push it. A change is the commits you have not pushed plus everything uncommitted. It runs on your machine, from Claude Code, Codex CLI, Cursor or Cline, or from your terminal.

First it runs the built-in scanners that fit the files you changed, such as gitleaks, semgrep, osv-scanner, ruff, oxlint, shellcheck, hadolint and trivy, each pinned to one version. It keeps only the findings on the lines you changed.

Then it starts a reviewer: a separate Claude Code or Codex process on your own login, so by default the agent that wrote the code does not review it. The reviewer must raise or drop every scanner finding with a reason, and scripts check that it answered every finding and was given every changed line. If not, the review is marked incomplete.

Each review writes HTML, Markdown, JSON and SARIF reports. Before a push, a push gate in your agent and a git pre-push hook check for a passing review of your current work. They warn by default and block only when you set a severity to block on. A GitHub Action and a pre-commit hook are also included.

OpenQodex needs no account or API key of its own and collects no usage data. It runs on macOS and Linux with Node 22 or newer. It is free and open source under the Apache 2.0 licence, made by Qodex. Try it with npx openqodex demo, or install it with npx openqodex init.