OpenQodex is Qodex.ai's Apache-2.0 pre-push code review CLI: it runs scanners over the lines you changed, then starts a separate Claude Code or Codex process to review the change and check every scanner finding, using your existing agent login and no other key. ## What it is **The design answer to "the agent that wrote the code should not review it": the reviewer is a fresh process with no memory of the authoring session.** One command, `openqodex review`, works out your change (unpushed commits plus uncommitted edits), runs the 22 built-in scanners that fit the changed files (semgrep, gitleaks, osv-scanner, ruff, and more, each version-pinned), then starts its own Claude Code or Codex process on a frozen copy of the change, with read-only tools and none of your settings, hooks, or instruction files. Scripted checks enforce completeness: every scanner finding must be raised or dropped with a reason, and every changed line must have been in front of the reviewer, or the run prints "Review incomplete" and exits nonzero. It is open source under Apache-2.0 from Qodex.ai, a San Francisco company whose main product is an AI QA-testing platform; OpenQodex is its open-source funnel for the hosted Qodex PR-review product, with a published pledge that nothing open becomes paid later. ## Status **Nine days old and moving fast, with adoption numbers but no independent coverage yet.** The repo (openqodex/openqodex) was created October 2, 2026 and shows 574 stars, 38 forks, and 15 npm releases (v0.12.0, October 10, 2026, is latest) as of 2026-10-11, pushed the same day. Star History Chart npm reports 2,744 downloads in the week of October 3 to 9, 2026, and the release train shipped four CLI versions in the four days to October 10 plus a benchmark-data release. The community footprint outside the vendor's own surfaces is absent so far, and I state that as a finding: no Hacker News thread under its name (Algolia search, 2026-10-11), so the 574-star start has no visible independent discussion behind it. ## Strengths - **The separate-reviewer guarantee is enforced by scripts, not vibes: a review is complete only when every stage ran, every scanner finding was dispositioned, and every changed line reached the reviewer.** - Scanners carry pinned versions and run only on files they fit, so the static half is reproducible, and the report lists exactly what each one read. - The reviewer's tool surface is deliberately neutered (read, search, list, and none of your config), which shrinks the prompt-injection and credential surface that Kudelski-style exploits ride. - Local-first economics: reviews bill to your existing Claude Code or Codex plan, with no API key, account, or server beyond the agent login. - The README's "What it does not do yet" section is unusually candid vendor self-disclosure. ## Cautions - **Nine days of history is no track record: no independent benchmark, review, or discussion of its finding quality exists as of 2026-10-11.** - The name collides with two neighbors: Qodo, the commercial reviewer in this category, and Codex, the OpenAI agent, so citations and searches will misfire. - A full review takes one to three minutes and consumes your own agent plan quota on every pre-push run, and the installed scanners need about 1 GB of disk. - The hosted Qodex sibling is the business: the open tool has no team memory, no dashboard, and no merge gate, all reserved for the paid product. ## Pricing Does not apply: OpenQodex is free and open source under Apache-2.0, running on your existing Claude Code or Codex login, with no paid tier found as of 2026-10-11. The hosted Qodex product from the same team is paid per developer, with no price published on the pages fetched this run. ## Compared to - [roborev](../roborev/index.md): the other local, bring-your-own-agent reviewer; roborev reviews every commit with a resident daemon and a findings ledger, OpenQodex is a pre-push gate with a scanner half and a completeness contract. - [git-lrc](../git-lrc/index.md): the commit-time gate that records attestations in git history; git-lrc routes through a vendor cloud, OpenQodex stays on your machine and your agent login. - [Qodo](../qodo/index.md): the similarly named commercial reviewer; Qodo sells a hosted platform with rules mined from PR history, OpenQodex sells nothing and rides your subscription. ## Bottom line **Recommended for individual developers on Claude Code or Codex who want a hard pre-push review gate that cannot be skipped silently.** Not for teams needing a hosted dashboard, learned rules, or any independent evidence of quality, none of which exist yet. My disagreeable take: the completeness contract is the actual invention here, because most review tools quietly skip lines and nobody notices, but a nine-day-old tool with zero independent coverage belongs in a side repo, not a required gate. ## Changes - 2026-10-11 - Created after the entrant scan resolved the openqodex/openqodex candidate from the GitHub topic search; seven sources fetched this run, including the absent-HN-footprint search as the coverage signal. - 2026-10-11 - Added the star history chart. ## See also - [roborev](../roborev/index.md) - the other local, your-own-agents commit-time reviewer - [git-lrc](../git-lrc/index.md) - the other pre-PR gate, with the attestation ledger idea - [Qodo](../qodo/index.md) - the commercial reviewer its name is one letter away from - [Code Review Feature Matrix](../code-review-feature-matrix/index.md) - where OpenQodex now sits among the category's members - [Claude Code](../../harnesses/claude-code/index.md) - the reviewer process it starts and bills ## References - https://github.com/openqodex/openqodex - repo facts: 574 stars, 38 forks, Apache-2.0, created 2026-10-02, pushed 2026-10-11 (GitHub API, as of 2026-10-11) - https://raw.githubusercontent.com/openqodex/openqodex/HEAD/README.md - the scanner-then-separate-reviewer mechanism, the completeness contract, the 22 scanners, and the candid limitations list - https://qodex.ai/openqodex - the product page: the separate-reviewer thesis, the hosted-Qodex split, the no-telemetry and nothing-open-becomes-paid pledges, San Francisco address, fetched 2026-10-11 - https://registry.npmjs.org/openqodex - 15 versions, v0.12.0 latest, package created 2026-10-02 (npm registry, fetched 2026-10-11) - https://api.npmjs.org/downloads/point/last-week/openqodex - 2,744 downloads, week of 2026-10-03 to 2026-10-09 (fetched 2026-10-11) - https://api.github.com/repos/openqodex/openqodex/releases - the release train: v0.9.0 through v0.12.0 in the four days to October 10, plus a benchmark-data release (fetched 2026-10-11) - https://hn.algolia.com/api/v1/search?query=openqodex&tags=story - no thread for this project under its name, the absent-coverage signal (queried 2026-10-11)