From zero to AI hero
Superpowers PackGet superpowers
From zero to AI hero

Must-haves for…

Start in 10 minutes

Plain-word guides and superpowers for Claude Code, Codex and Gemini.

PluginInstalls cleanly

Review your changes before you push

OpenQodex

Runs free code scanners plus a separate Claude Code or Codex reviewer on your unpushed changes and gives you a plain report before the code goes live.

Works with
Claude Code, Codex CLI
Good for
Security testing, Build an app

What it does

When an AI assistant writes code for you, nobody checks it twice. OpenQodex adds that second check before you push (upload) your work to GitHub or a server.

First it runs free scanner programs, such as gitleaks for leaked passwords, on the files you changed. Then it starts a separate Claude Code or Codex session as a reviewer, so the assistant that wrote the code is not the one grading it. The reviewer must accept or reject every scanner finding with a reason.

You get a short receipt in the chat and a full report as an HTML page. Your assistant then asks which findings to fix. A push gate can warn you, or block the push, when no review was done.

Example prompts

  • "review my change with openqodex"
  • "Fix finding 2 and 3 from the openqodex report, leave the rest"
  • "Explain the openqodex report in plain words"
  • "Run openqodex on the whole project, not only my last change"

How to install

npx openqodex init

How to use it

Say to your assistant: review my change with openqodex. Then answer which findings it should fix.

Check it works

npx openqodex init lists the files it will write and asks once. Afterwards run ~/.openqodex/bin/openqodex review in your terminal; it ends with a receipt and the path of report.html (from the README).

Common problems

  • No reviewer available — 'Full review unavailable' — install and log in to Claude Code or Codex; scanner results are saved unchecked meanwhile — https://github.com/openqodex/openqodex
  • A stage did not run — 'Review incomplete' — the report names the missing stage; fix it (often a missing language runtime) and run the review again — same README

What to watch out for

  • Sends your code change to the model service of your Claude Code or Codex login
  • Downloads scanner programs on first use; some scanners use the network
  • Adds a git pre-push hook and agent hooks to your setup
  • Made for macOS and Linux; on Windows use WSL (npm page), which the README says is untested

Licence and author

Licence
Apache-2.0
Author
openqodex
Source code
github.com/openqodex/openqodex

How we tested it

We installed it on an empty test computer on 13 Oct 2026. Installed and started in a clean test system. Not yet used in a real AI session.

Test level

Not yet used on real work.

Technical details of the test
Date
13 Oct 2026
Method
Intake sandbox run on 2026-10-13 in a clean container with no account: cloned the repository and checked its skill, agent and plugin files, ran "npx -y openqodex --help".

Checked again on 13 Oct 2026

Alternatives

  • Security Guidance — Anthropic's plugin that reviews inside Claude Code as you work
  • Gitleaks — the secrets scanner alone, without an AI reviewer

FAQ

  • Q: Does it need its own API key? A: No, it uses your existing Claude Code or Codex login.
  • Q: Will it block my pushes? A: Only if you set review.block_on_severity in .openqodex/config.yaml; by default it warns.
  • Q: Does it work on Windows? A: Not directly. The npm page says to use WSL on Windows; the GitHub README says no test runs on Windows or WSL.

Sources