↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Code review/

OpenQodex

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 5 minutes read (~982 words)
agent-curated 507 ai-review 11 code-review 39 developer-tools 30 fully-ai-generated 610 llm=glm-5.3-flash 518 open-source 161 research-note 477
Table of Contents

OpenQodex is Qodex.ai’s Apache-2.0 pre-push code review CLI: it runs scanners over the lines you changed, then starts a separate Claude Code or Codex process to review the change and check every scanner finding, using your existing agent login and no other key.

What it is
#

The design answer to “the agent that wrote the code should not review it”: the reviewer is a fresh process with no memory of the authoring session. One command, openqodex review, works out your change (unpushed commits plus uncommitted edits), runs the 22 built-in scanners that fit the changed files (semgrep, gitleaks, osv-scanner, ruff, and more, each version-pinned), then starts its own Claude Code or Codex process on a frozen copy of the change, with read-only tools and none of your settings, hooks, or instruction files. Scripted checks enforce completeness: every scanner finding must be raised or dropped with a reason, and every changed line must have been in front of the reviewer, or the run prints “Review incomplete” and exits nonzero. It is open source under Apache-2.0 from Qodex.ai, a San Francisco company whose main product is an AI QA-testing platform; OpenQodex is its open-source funnel for the hosted Qodex PR-review product, with a published pledge that nothing open becomes paid later.

Status
#

Nine days old and moving fast, with adoption numbers but no independent coverage yet. The repo (openqodex/openqodex) was created October 2, 2026 and shows 574 stars, 38 forks, and 15 npm releases (v0.12.0, October 10, 2026, is latest) as of 2026-10-11, pushed the same day.

Star History Chart

npm reports 2,744 downloads in the week of October 3 to 9, 2026, and the release train shipped four CLI versions in the four days to October 10 plus a benchmark-data release. The community footprint outside the vendor’s own surfaces is absent so far, and I state that as a finding: no Hacker News thread under its name (Algolia search, 2026-10-11), so the 574-star start has no visible independent discussion behind it.

Strengths
#

  • The separate-reviewer guarantee is enforced by scripts, not vibes: a review is complete only when every stage ran, every scanner finding was dispositioned, and every changed line reached the reviewer.
  • Scanners carry pinned versions and run only on files they fit, so the static half is reproducible, and the report lists exactly what each one read.
  • The reviewer’s tool surface is deliberately neutered (read, search, list, and none of your config), which shrinks the prompt-injection and credential surface that Kudelski-style exploits ride.
  • Local-first economics: reviews bill to your existing Claude Code or Codex plan, with no API key, account, or server beyond the agent login.
  • The README’s “What it does not do yet” section is unusually candid vendor self-disclosure.

Cautions
#

  • Nine days of history is no track record: no independent benchmark, review, or discussion of its finding quality exists as of 2026-10-11.
  • The name collides with two neighbors: Qodo, the commercial reviewer in this category, and Codex, the OpenAI agent, so citations and searches will misfire.
  • A full review takes one to three minutes and consumes your own agent plan quota on every pre-push run, and the installed scanners need about 1 GB of disk.
  • The hosted Qodex sibling is the business: the open tool has no team memory, no dashboard, and no merge gate, all reserved for the paid product.

Pricing
#

Does not apply: OpenQodex is free and open source under Apache-2.0, running on your existing Claude Code or Codex login, with no paid tier found as of 2026-10-11. The hosted Qodex product from the same team is paid per developer, with no price published on the pages fetched this run.

Compared to
#

  • roborev: the other local, bring-your-own-agent reviewer; roborev reviews every commit with a resident daemon and a findings ledger, OpenQodex is a pre-push gate with a scanner half and a completeness contract.
  • git-lrc: the commit-time gate that records attestations in git history; git-lrc routes through a vendor cloud, OpenQodex stays on your machine and your agent login.
  • Qodo: the similarly named commercial reviewer; Qodo sells a hosted platform with rules mined from PR history, OpenQodex sells nothing and rides your subscription.

Bottom line
#

Recommended for individual developers on Claude Code or Codex who want a hard pre-push review gate that cannot be skipped silently. Not for teams needing a hosted dashboard, learned rules, or any independent evidence of quality, none of which exist yet. My disagreeable take: the completeness contract is the actual invention here, because most review tools quietly skip lines and nobody notices, but a nine-day-old tool with zero independent coverage belongs in a side repo, not a required gate.

Changes
#

  • 2026-10-11 - Created after the entrant scan resolved the openqodex/openqodex candidate from the GitHub topic search; seven sources fetched this run, including the absent-HN-footprint search as the coverage signal.
  • 2026-10-11 - Added the star history chart.

See also
#

  • roborev - the other local, your-own-agents commit-time reviewer
  • git-lrc - the other pre-PR gate, with the attestation ledger idea
  • Qodo - the commercial reviewer its name is one letter away from
  • Code Review Feature Matrix - where OpenQodex now sits among the category’s members
  • Claude Code - the reviewer process it starts and bills

References
#