OpenAI's Official Plugin: Let Codex Review Your Code Inside Claude Code

Article

OpenAI built a plugin that runs its own Codex inside a competitor's tool — Anthropic's Claude Code — to help developers get work done. This isn't a community side project. It's an official open-source repository under OpenAI's organization, licensed under Apache 2.0. It hit 3,700+ stars within hours of launch, climbed to 22,000+ stars over three months, with 1,300+ forks and 200+ open issues — a live project being actively used and tested by real users.

Two companies locked in fierce model-level competition suddenly shaking hands inside your editor. The reason is simple: developers never cared about taking sides — they just want the freedom to combine the best tools available.

What Problem Does It Actually Solve

One sentence: stop letting the AI that writes your code also review it.

If you have Claude write a piece of code and then ask the same Claude to review it, it's like asking a student to grade their own homework. Same reasoning patterns, same blind spots — whatever it missed while writing, it'll probably miss again while reviewing. There's a specific term for this: sycophancy bias — the model's tendency to agree with its own output.

This bias is rooted in how large language models are trained. During the RLHF (Reinforcement Learning from Human Feedback) phase, models optimize their weights based on positive feedback from human annotators. Since annotators tend to rate answers that sound confident and internally consistent higher, models learn to prioritize maintaining the coherence of their own output rather than actively looking for errors. This bias is especially dangerous in self-review scenarios — the reasoning path a model relies on when generating code heavily overlaps with the attention patterns it activates when reviewing that same code, causing it to systematically ignore edge cases and error branches it already "reasoned around" during generation. Anthropic's 2023 research paper Sycophancy to Subterfuge documents this empirically: even under prompts that explicitly request "critical review," models still exhibit an implicit bias toward their own earlier outputs.

This is exactly where cross-model review earns its value. One community observation captures it perfectly: Claude is better at catching big-picture and design-taste issues, while Codex is better at catching correctness and code quality issues. Their blind spots don't overlap — combine them and you actually cover the gaps. If Codex catches a bug that Claude missed, that's a real quality improvement no single model could deliver.

Claude Code and Codex CLI: Why These Two Tools Complement Each Other

Claude Code is Anthropic's terminal-native AI programming agent, launched in 2025. Its core design philosophy is deep integration into the developer's local workflow — directly reading and writing the file system, executing shell commands, calling Git, and integrating with external tools via the MCP (Model Context Protocol). Its comparative advantage lies in architecture-level reasoning over long contexts and understanding the global structure of a codebase. OpenAI's Codex CLI packages the GPT-4o/o-series models into a command-line agent, focusing on precise code generation, test fixing, and safe sandbox execution — its sandbox mechanism runs in a restricted environment by default to prevent accidental system side effects from code execution.

The reason these two tools can connect seamlessly through a plugin comes down to the MCP (Model Context Protocol). MCP is a standardized protocol open-sourced by Anthropic in late 2024 that defines a unified JSON-RPC communication spec between AI models (as MCP Clients) and external tools (as MCP Servers). The Claude Code for Codex plugin uses the MCP mechanism to call Codex CLI as a standardized tool node rather than directly calling OpenAI's HTTP API — which means it reuses your locally installed Codex login state and configuration, rather than opening a separate OpenAI session inside Claude. This design is what makes the "lossless context transfer" described in the Transfer command technically possible.

Breaking Down the Five Core Commands

Codex:Review — Read-Only Review

This is the most basic feature. It takes your uncommitted changes, or the diff between your current branch and main, hands them to Codex, and returns review feedback at the same quality level you'd get running Review directly in Codex. Note that it's read-only — it will never touch your code. Reviewing multi-file changes can be slow; the official recommendation is to use Background to run it in the background, then use Status and Result to collect the output.

Codex:Adversarial Review — Adversarial Review

This is where things get interesting. A regular Review picks at code details; an adversarial review challenges your design decisions themselves.

The concept of adversarial code review originates from the "Red Teaming" methodology in security engineering. Traditional code review focuses on implementation: is naming clear, are edge cases handled, are there obvious null pointer risks? Adversarial review asks higher-level questions: are the underlying assumptions of this design valid? Where will this architecture break under extreme load? Is there a simpler, safer alternative? This kind of thinking is called a "Design Critique" internally at Google, and an extension of the "Chaos Engineering Mindset" in Netflix's engineering culture. Injecting this pattern into an AI agent requires explicitly specifying an "adversarial" role at the prompt level — otherwise, the AI defaults to playing "friendly advisor" rather than "skeptical challenger."

So the wrong way to use this is to run a bare Review command — it'll just tell you a null check is missing on line 12. The right way is to append a pointed challenge after the command, like "question whether this caching and retry design is correct, and focus hard on concurrency conditions and rollback as the high-risk areas." Then it stands on the opposite side and demands answers: do your assumptions actually hold? Is there a simpler, safer approach? This is the "harsh reviewer" energy you need most before shipping.

Codex:Rescue — Sub-Agent Task Delegation

Delegate an entire task directly to Codex as a sub-agent: hunt down a mysterious bug, fix a failing test. If you want to save money, you can specify a smaller, faster model to run a quick pass. The positioning is clever: Claude handles architecture planning and complex reasoning, while one-liners hand off the dirty, repetitive work to Codex using a cheaper model.

Codex:Transfer — Lossless Context Migration

You've been debugging in Claude Code for an hour, building up a rich conversation context, and now you want to continue in Codex. Transfer packages your current session into a persistent Codex thread and gives you a Codex Resume command. Run it in Codex and you pick up exactly where you left off — nothing lost. It reuses the Codex instance already on your machine: same login, same config, same MCP setup. To quote the official documentation: this isn't a separate runtime — it is Codex, just invoked from within Claude Code.

Review Gate — Review Checkpoint

When enabled, every time Claude wants to wrap up and end a session, Codex intercepts it first, runs a review pass, and if it finds issues, blocks the exit and sends Claude back to fix them. It sounds like an automated quality gate bolted onto your AI. The usage guideline: only enable it when you're actively sitting in front of your screen and monitoring the session.

A Hard Lesson: When Review Gate Spins Out of Control

Why does Review Gate emphasize "only use it when you're watching"? This comes from a real user report.

They hit rate limits on their ChatGPT subscription. When the Codex review failed, the review gate blocked the session, woke Claude to retry, which failed again, which blocked again — an infinite loop. The user's own words: "If I hadn't been at my computer, this thing would have kept burning until it drained my Claude Code credits too."

This runaway pattern has a specific name in multi-agent orchestration systems: Agent Loop failure, also called Failure Cascade. The structural root cause: when one agent's "completion condition" depends on another agent's successful response, any external failure is interpreted by the inner agent as "task incomplete, retry required," triggering another call — which may fail again — creating exponentially stacking invocations. This is mechanically identical to a "Retry Storm" in microservice architectures. Mature production systems typically defend against this through exponential backoff retry, the circuit breaker pattern, and hard caps on maximum retry attempts. The Review Gate feature currently lacks all three protections, which is why the official guidance falls back to "manual monitoring" as a temporary safety net.

The official documentation warns in plain terms: Review Gate can cause long loops and rapidly drain your credits. This isn't a hypothetical warning — it has already happened.

The Math You Need to Run Before Getting Started

Beyond the runaway risk, there are a few practical barriers worth understanding upfront.

Incomplete Windows support. Some users report that on Windows, with certain versions of Codex CLI, Review and Rescue silently return empty results. The cause is that the plugin hardcodes a sandbox mode that the Windows version of Codex can't honor — only the fully-permissioned "dangerous mode" barely works. Windows users should set expectations accordingly, or just use WSL.

Two accounts, two bills. You need active accounts and credits with both Anthropic and OpenAI. There's no consolidated billing — you're watching two separate meters. On the Plus plan, you get a limited number of Reviews per hour; if you run adversarial reviews on every commit, you'll hit the ceiling fast.

One-directional integration. Currently this only works as Claude Code calling Codex — there's no official version going the other direction. That said, the community has already built a reverse plugin that runs Claude Code inside Codex for review purposes. Cross-model mutual review is becoming the default assumption for engineers who take code quality seriously.

The Industry Signal Behind This

Separating writing from reviewing is becoming the default practice for engineers who take their craft seriously. OpenAI and Anthropic fight tooth and nail over models, yet they shake hands inside the developer's editor — because both have internalized the same realization: the one who writes the code and the one who reviews it shouldn't be the same person, and they shouldn't be the same model either.

The underlying logic of this trend is the inevitable evolution of AI agent tooling from "single-model assistants" to "multi-model collaborative systems." As the capability boundaries of individual models become clearer, engineers are assembling AI toolchains the way they assemble human teams — letting the one strong at architectural reasoning do planning, letting the one strong at code correctness verification do quality control, and assigning repetitive dirty work to cheaper, smaller models. This division of labor is a direct projection of the "Single Responsibility Principle" from software engineering onto the tooling layer.

Who it's for: Developers who use Claude Code daily and are willing to set up a Codex account as a "second opinion."

Who it's not for: Pure Windows environments, or users who don't want to manage two separate credit balances.

Give your AI a critic from a different school of thought — that's how your code actually becomes review-proof.

Key Takeaways