OpenAI Codex CLI Research Report

Technology: OpenAI Codex CLI Version: 0.92.0 (Latest: rust-v0.92.0, released 2026-01-27) Purpose: Lightweight coding agent that runs locally in your terminal Recommendation: ADOPT for headless VM provisioning Confidence: High

Executive Summary

OpenAI Codex CLI is an official, actively maintained terminal-based coding agent from OpenAI. Originally, "Codex" referred to the model powering GitHub Copilot, but OpenAI has since released a standalone CLI tool (distinct from the historical Codex model). The tool runs locally, supports headless automation via `codex exec`, and integrates with ChatGPT Plus/Pro/Team/Enterprise subscriptions for usage-based access without additional API costs.

Key Finding: This is NOT a standalone API for the historical Codex model, but a modern CLI agent similar to Claude Code, built in Rust, with robust headless/automation capabilities suitable for VM provisioning.

1. Current Status

Is There an Official OpenAI Codex CLI Tool?

YES - OpenAI released an official Codex CLI tool in 2025.

Metric	Value
Repository	https://github.com/openai/codex
NPM Package	`@openai/codex`
Latest Version	0.92.0 (2026-01-27)
GitHub Stars	57,982
GitHub Forks	7,515
License	Apache-2.0
Language	Rust
Status	Actively maintained (last commit: 2 hours ago as of 2026-01-28)
Release Cadence	Regular (monthly releases)

Clarification: Codex vs Historical Codex Model

Historical Codex Model: The original GPT-3 based model that powered GitHub Copilot (deprecated)
Codex CLI (Current): A new terminal-based coding agent from OpenAI, similar to Claude Code or Cursor
Codex Web: Cloud-based version at https://chatgpt.com/codex

This research focuses on the Codex CLI tool, which is the appropriate technology for headless VM provisioning.

2. Installation Methods

Option A: NPM (Recommended for Automation)

npm install -g @openai/codex

Advantages:

Standard package manager installation
Automatic PATH configuration
Cross-platform support
Easy updates via `npm update -g @openai/codex`

Option B: Homebrew (macOS/Linux)

brew install --cask codex

Advantages:

System-level package management
Integrates with macOS/Linux package ecosystems

Option C: Direct Binary Download

Download platform-specific binaries from GitHub Releases:

Linux x86_64 (Recommended for VM provisioning):

curl -L -o codex.tar.gz https://github.com/openai/codex/releases/download/rust-v0.92.0/codex-x86_64-unknown-linux-musl.tar.gz
tar xzf codex.tar.gz
mv codex-x86_64-unknown-linux-musl /usr/local/bin/codex
chmod +x /usr/local/bin/codex

Other platforms:

macOS (Apple Silicon): `codex-aarch64-apple-darwin.tar.gz`
macOS (Intel): `codex-x86_64-apple-darwin.tar.gz`
Linux (ARM64): `codex-aarch64-unknown-linux-musl.tar.gz`
Windows: `codex-x86_64-pc-windows-msvc.exe`

Option D: Build from Source

git clone https://github.com/openai/codex.git
cd codex
cargo build --release
./target/release/codex

Note: Requires Rust toolchain installed.

3. Authentication Requirements

Primary Authentication: ChatGPT OAuth (Recommended)

codex login
# Interactive prompt: Select "Sign in with ChatGPT"

Subscription Requirements:

ChatGPT Plus ($20/month)
ChatGPT Pro ($200/month)
ChatGPT Team (Enterprise pricing)
ChatGPT Edu (Academic pricing)
ChatGPT Enterprise (Enterprise pricing)

Headless Authentication Issue: OAuth flow requires browser interaction, which is not compatible with headless VM provisioning during initial setup.

Alternative: API Key Authentication

# Read API key from stdin (secure method)
echo "$OPENAI_API_KEY" | codex login --with-api-key

# Or using environment variable
printenv OPENAI_API_KEY | codex login --with-api-key

API Key Setup: 1. Visit https://platform.openai.com/api-keys 2. Create new API key 3. Store securely (e.g., secrets manager, environment variable) 4. Pass to CLI via stdin

Note: The `--api-key` flag is deprecated. Use `--with-api-key` with stdin piping.

Device Code Authentication (Alternative for Headless)

codex login --device-auth

Displays a code and URL for authentication on another device. Suitable for headless environments with out-of-band authentication.

Authentication Storage

Credentials are stored in:

~/.codex/

Important: This directory contains sensitive tokens. Ensure proper file permissions in VM provisioning.

4. CLI Commands and Flags for Automation/Headless Use

Primary Command Structure

codex [OPTIONS] [PROMPT]
codex [OPTIONS] <COMMAND> [ARGS]

Interactive Mode (Default)

codex
codex "write a python script to parse CSV"

Not suitable for headless automation - launches TUI interface.

Non-Interactive Mode: `codex exec`

The `exec` subcommand is specifically designed for headless/automation use.

codex exec [OPTIONS] [PROMPT]

Key Flags for Headless Automation

Flag	Purpose	Example
`--json`	Output structured JSONL events	`codex exec --json "task"`
`--full-auto`	Skip all approval prompts	`codex exec --full-auto "task"`
`--yolo`	Bypass approvals AND sandbox	`codex exec --yolo "task"`
`--cwd <PATH>`	Set working directory	`codex exec --cwd /workspace "task"`
`--skip-git-repo-check`	Allow non-git directories	`codex exec --skip-git-repo-check "task"`
`--model <MODEL>`	Override default model	`codex exec --model gpt-4 "task"`
`--oss`	Use local/OSS models (Ollama, LMStudio)	`codex exec --oss "task"`
`--sandbox-mode <MODE>`	Control filesystem access	`codex exec --sandbox-mode workspace-write "task"`
`--last-message-file <FILE>`	Save final output to file	`codex exec --last-message-file out.txt "task"`
`--output-schema <FILE>`	Enforce JSON output schema	`codex exec --output-schema schema.json "task"`

Critical Flags for VM Provisioning

# Headless execution with full automation
codex exec \
  --json \
  --full-auto \
  --skip-git-repo-check \
  --cwd /workspace \
  --last-message-file /tmp/codex-output.txt \
  "Install nginx and configure as reverse proxy"

Sandbox Modes:

`workspace-read`: Read-only access to workspace
`workspace-write`: Read-write access (required for most provisioning)
`danger-full-access`: Unrestricted access (use with `--yolo`)

Resume Previous Session

codex exec resume --last "continue previous task"
codex exec resume <SESSION_ID> "continue task"

Code Review Mode

codex exec review --target <FILE_OR_DIR>

Other Subcommands

Command	Purpose
`codex login`	Authenticate with OpenAI
`codex logout`	Remove stored credentials
`codex apply`	Apply latest diff as git patch
`codex resume`	Resume interactive session (with picker)
`codex fork`	Fork previous session
`codex mcp`	MCP server management
`codex completion`	Generate shell completions

5. Configuration File Locations

Primary Config File

~/.codex/config.toml

Config Structure (TOML)

# MCP Server Configuration
[mcp]
# MCP servers can be configured here

# Notification Hooks
[notify]
# Hook commands when agent finishes

# UI Notices (do not show again flags)
[notice]
# UI prompt preferences

# Analytics
[analytics]
enabled = false  # Opt out of analytics

Config Profiles

Multiple config profiles can be used:

codex exec --config-profile production "task"

Advanced Configuration Options

Comprehensive config reference at:

https://developers.openai.com/codex/config-reference

Key sections:

Model selection
Approval policies
Sandbox configuration
MCP server connections
Notification hooks

Config Schema

JSON Schema available at:

codex-rs/core/config.schema.json

Or download from releases:

https://github.com/openai/codex/releases/download/rust-v0.92.0/config-schema.json

6. Environment Variables

While the documentation primarily references configuration via `config.toml`, the following environment variables are commonly used:

Authentication

OPENAI_API_KEY=sk-...  # API key for authentication

Logging and Debugging

RUST_LOG=debug  # Enable debug logging (uses tracing crate)
RUST_LOG=codex_exec=trace  # Trace-level logging for exec module

Configuration Override

# CLI supports -c flag for runtime overrides
codex exec -c model=gpt-4-turbo -c approval_policy=never "task"

Color Control

# Disable ANSI colors in output
codex exec --color never "task"

# Force colors
codex exec --color always "task"

Note: The Rust-based CLI uses `tracing` for logging. Standard Rust environment variables apply.

7. Differences from GitHub Copilot

Feature	GitHub Copilot	OpenAI Codex CLI
Interface	IDE extension (VS Code, JetBrains, etc.)	Terminal/CLI
Model	GPT-4 based (specialized for code completion)	GPT-4/GPT-5 based (full conversation)
Mode	Inline code suggestions, chat sidebar	Interactive TUI or headless exec
File Access	IDE-managed files	Filesystem-wide (with sandbox controls)
Approval Model	Manual accept/reject of suggestions	Configurable auto-approval for headless
Automation	Not designed for automation	Built for automation via `exec` command
Pricing	$10-20/month subscription	ChatGPT subscription or API usage
Authentication	GitHub account + Copilot license	OpenAI account + ChatGPT plan or API key
Agent Capabilities	Code completion, chat assistance	Full agentic workflow (file edits, shell commands)
Headless Use	No	Yes (via `codex exec`)

Historical Context: GitHub Copilot originally used OpenAI's Codex model (GPT-3 based code model, now deprecated). The current "Codex CLI" is a separate tool, not directly related to that historical model.

8. SDK and API Documentation

Codex SDK (TypeScript)

npm install @openai/codex-sdk

Purpose: TypeScript SDK for programmatic integration with Codex APIs.

Use Case: Building custom tools that interact with Codex programmatically.

Responses API Proxy

A companion tool for proxying OpenAI Responses API:

codex-responses-api-proxy

Available in releases as separate binary.

MCP (Model Context Protocol) Support

Codex CLI supports MCP servers for extending tool capabilities:

# config.toml
[mcp.servers.my-server]
command = "/path/to/mcp-server"
args = ["--arg1", "value"]

Community MCP Servers:

`codex-mcp-server`: Wrapper for Codex CLI as MCP server
`codex-cli-mcp-tool`: MCP integration tool

App Server Mode

codex app-server

Runs Codex as an app server (experimental), useful for IDE integrations.

Official Documentation

Main Docs: https://developers.openai.com/codex
Authentication: https://developers.openai.com/codex/auth
Config Reference: https://developers.openai.com/codex/config-reference
Non-interactive Mode: https://developers.openai.com/codex/noninteractive

Note: Some links reference `developers.openai.com/codex/*` which may require authentication or be updated paths.

9. Pricing Model

ChatGPT Subscription (Recommended)

Access Codex CLI via existing ChatGPT subscription:

Plan	Cost	Codex Access
ChatGPT Plus	$20/month	Included
ChatGPT Pro	$200/month	Included (higher limits)
ChatGPT Team	Custom	Included
ChatGPT Enterprise	Custom	Included

Advantages:

Fixed monthly cost
No per-token billing
Shared quota with ChatGPT web usage
Suitable for predictable workloads

Limitations:

Rate limits apply (not disclosed publicly)
Shared quota across all ChatGPT usage
May not be suitable for high-volume automation

OpenAI API Key

Pay-per-use via OpenAI API:

Pricing varies by model:

GPT-4: ~$0.03-0.06 per 1K tokens (input/output)
GPT-4 Turbo: ~$0.01-0.03 per 1K tokens
GPT-5 (if available): Pricing TBD

Advantages:

Pay only for what you use
Higher rate limits with paid tier
Suitable for sporadic or high-volume use

Disadvantages:

Variable monthly cost
Requires budget monitoring
Additional API key management

Cost Comparison for VM Provisioning

Scenario: Provision 100 VMs/month with ~10K tokens per provisioning task

ChatGPT Plus: $20/month (fixed), assuming within rate limits
API Key (GPT-4 Turbo): ~$10-30/month (100 VMs 10K tokens $0.01-0.03/1K)

Recommendation: ChatGPT subscription for predictable, moderate-volume use. API key for high-volume or sporadic provisioning.

10. Cloud-Init Compatible Installation Commands

Option A: NPM Installation (Preferred)

#cloud-config
package_update: true
packages:
  - npm
  - nodejs

runcmd:
  # Install Codex CLI globally
  - npm install -g @openai/codex

  # Verify installation
  - codex --version

  # Authenticate with API key (from cloud-init secret)
  - echo "${OPENAI_API_KEY}" | codex login --with-api-key

  # Run provisioning task in headless mode
  - |
    codex exec \
      --json \
      --full-auto \
      --skip-git-repo-check \
      --cwd /workspace \
      --last-message-file /tmp/provision-output.txt \
      "Install nginx, configure reverse proxy for localhost:3000, and enable HTTPS"

Option B: Binary Download (No Dependencies)

#cloud-config
write_files:
  - path: /tmp/install-codex.sh
    permissions: '0755'
    content: |
      #!/bin/bash
      set -e

      # Download Codex CLI binary
      CODEX_VERSION="0.92.0"
      CODEX_URL="https://github.com/openai/codex/releases/download/rust-v${CODEX_VERSION}/codex-x86_64-unknown-linux-musl.tar.gz"

      curl -L -o /tmp/codex.tar.gz "$CODEX_URL"
      tar xzf /tmp/codex.tar.gz -C /tmp
      mv /tmp/codex-x86_64-unknown-linux-musl /usr/local/bin/codex
      chmod +x /usr/local/bin/codex
      rm /tmp/codex.tar.gz

      echo "Codex CLI installed successfully"
      codex --version

runcmd:
  - /tmp/install-codex.sh

  # Authenticate with API key
  - echo "${OPENAI_API_KEY}" | codex login --with-api-key

  # Run headless provisioning
  - |
    codex exec \
      --json \
      --full-auto \
      --skip-git-repo-check \
      --cwd /workspace \
      "Provision development environment with Docker, Node.js 20, and PostgreSQL 15"

Option C: Device Code Authentication (No Secrets in cloud-init)

#cloud-config
runcmd:
  # Install via npm
  - npm install -g @openai/codex

  # Start device code authentication (requires manual approval)
  - codex login --device-auth > /tmp/device-auth.txt

  # Display authentication instructions (user completes on another device)
  - cat /tmp/device-auth.txt

  # Wait for authentication (implement polling or delay)
  - sleep 60

  # Run provisioning after auth
  - codex exec --full-auto --json "setup task"

Option D: Pre-Authenticated Config Volume

#cloud-config
mounts:
  # Mount pre-authenticated ~/.codex directory from host or volume
  - [ "/mnt/codex-config", "/root/.codex", "none", "bind", "0", "0" ]

runcmd:
  # Install Codex CLI
  - npm install -g @openai/codex

  # Config already present from mounted volume
  - codex exec --full-auto "provision VM"

Environment Variable Injection

#cloud-config
write_files:
  - path: /etc/environment
    content: |
      OPENAI_API_KEY=sk-proj-...
      RUST_LOG=info

runcmd:
  - source /etc/environment
  - npm install -g @openai/codex
  - echo "$OPENAI_API_KEY" | codex login --with-api-key

Complete VM Provisioning Example

#cloud-config
package_update: true
packages:
  - npm
  - nodejs
  - git

write_files:
  - path: /workspace/provision.txt
    content: |
      1. Install Docker and Docker Compose
      2. Create user 'appuser' with sudo privileges
      3. Clone repository from https://github.com/example/app.git to /opt/app
      4. Configure environment variables in /opt/app/.env
      5. Start application with docker-compose up -d
      6. Configure nginx as reverse proxy on port 80
      7. Enable and start nginx service

runcmd:
  # Install Codex CLI
  - npm install -g @openai/codex

  # Authenticate
  - echo "${OPENAI_API_KEY}" | codex login --with-api-key

  # Run provisioning with structured task file
  - |
    codex exec \
      --json \
      --full-auto \
      --skip-git-repo-check \
      --cwd /workspace \
      --last-message-file /var/log/codex-provision.log \
      "$(cat /workspace/provision.txt)"

  # Verify provisioning
  - docker ps
  - systemctl status nginx

Strengths

1. Official OpenAI Tool - First-party support with active development 2. Rust-Based Performance - Fast startup, low memory footprint 3. Headless Automation - `codex exec` designed specifically for non-interactive use 4. Flexible Authentication - Supports ChatGPT OAuth, API keys, and device code flow 5. JSON Output Mode - Structured JSONL events for programmatic parsing 6. Sandbox Controls - Configurable filesystem access for security 7. Active Maintenance - Monthly releases with bug fixes and features (0.92.0 released 2026-01-27) 8. Cross-Platform - Linux, macOS, Windows binaries available 9. Multiple Installation Methods - npm, Homebrew, direct binary, build from source 10. Large Community - 57K+ GitHub stars, extensive third-party integrations 11. MCP Protocol Support - Extensible via Model Context Protocol servers 12. Config File Support - Declarative configuration in `~/.codex/config.toml`

Weaknesses

1. OAuth Headless Challenge - ChatGPT authentication requires browser interaction (not VM-friendly)

Mitigation: Use API key authentication or device code flow

2. Documentation Gaps - Some docs link to `developers.openai.com` paths that may require authentication

Mitigation: Active GitHub repo with source code and community discussions

3. Rate Limiting Opacity - ChatGPT subscription rate limits not publicly documented

Mitigation: Use API key for predictable, metered usage

4. Config Complexity - Advanced features require TOML configuration understanding

Mitigation: JSON schema available for validation, good defaults provided

5. Sandbox Restrictions - Default sandbox may block legitimate provisioning tasks

Mitigation: Use `--full-auto` or `--yolo` flags with appropriate security controls

6. Git Repo Requirement - Default behavior requires git repository

Mitigation: Use `--skip-git-repo-check` flag for non-git environments

7. Pricing Uncertainty for API - OpenAI API pricing can change without notice

Mitigation: Monitor usage via OpenAI dashboard, set billing alerts

Comparison with Alternatives

Feature	OpenAI Codex CLI	Claude Code	GitHub Copilot CLI	Cursor
Interface	Terminal (TUI + exec)	Terminal	Terminal	IDE
Headless Mode	Yes (`exec`)	Yes	Limited	No
JSON Output	Yes (`--json`)	Yes	No	N/A
Authentication	OAuth/API key	API key	GitHub + Copilot	OAuth
Pricing	ChatGPT sub or API	Claude API	$10/month	$20/month
Installation	npm/brew/binary	npm	GitHub CLI extension	Standalone app
Sandbox Control	Yes (configurable)	Yes	No	IDE-based
Auto-Approval	Yes (`--full-auto`)	Yes	No	N/A
License	Apache-2.0	Proprietary	Proprietary	Proprietary
Open Source	Yes (fully)	No (binary only)	No	No

Key Differentiator: Codex CLI is the only fully open-source AI coding agent with robust headless automation from a major AI provider.

Integration Considerations

Prerequisites

System Requirements:

Linux (x86_64 or ARM64), macOS, or Windows
Node.js and npm (if installing via npm)
Internet connectivity for API access

Authentication:

ChatGPT Plus/Pro/Team/Enterprise subscription OR
OpenAI API key with billing enabled

Integration Effort

Estimated Time: 1-2 hours Complexity: Low to Medium

Steps: 1. Install Codex CLI (5 minutes) 2. Authenticate (10 minutes, longer for OAuth setup) 3. Test basic `exec` command (15 minutes) 4. Configure `config.toml` for environment (30 minutes) 5. Integrate into cloud-init or provisioning scripts (30 minutes) 6. Test end-to-end VM provisioning (15 minutes)

Team Expertise Required:

Basic terminal/CLI knowledge (existing)
Understanding of cloud-init (existing for VM provisioning)
Familiarity with TOML configuration (minimal, can learn quickly)

Migration Path

If replacing manual provisioning scripts: 1. Audit existing provisioning tasks 2. Convert imperative scripts to declarative prompts 3. Test Codex CLI in sandbox environment 4. Gradually migrate tasks to Codex-based provisioning 5. Maintain fallback scripts during transition period

Cost Analysis

Open Source

License: Apache-2.0 (permissive)

Free to use, modify, distribute
No vendor lock-in
Commercial use allowed

Total Cost of Ownership

Implementation:

Developer time: 4-8 hours @ $100/hr = $400-800 (one-time)
Testing and validation: 8 hours @ $100/hr = $800 (one-time)
Total initial cost: $1,200-1,600

Training:

Team onboarding: 2 hours/person for 5 people = 10 hours @ $100/hr = $1,000 (one-time)

Ongoing Maintenance:

Config updates: 1 hour/month @ $100/hr = $1,200/year
Monitoring and troubleshooting: 2 hours/month @ $100/hr = $2,400/year
Total maintenance: $3,600/year

Service Costs:

Option A: ChatGPT Plus

$20/month = $240/year
Suitable for <100 VMs/month provisioning

Option B: ChatGPT Pro

$200/month = $2,400/year
Suitable for high-volume provisioning

Option C: OpenAI API

Variable: $10-100/month depending on usage = $120-1,200/year
Suitable for sporadic or high-volume provisioning

3-Year TCO (ChatGPT Plus scenario):

Initial: $2,600
Ongoing (3 years): $10,800 + $720 = $11,520
Total: $14,120

Comparison to manual provisioning:

Manual provisioning time savings: 30 min/VM * 100 VMs/month = 50 hours/month
Developer time saved: 50 hours * $100/hr = $5,000/month = $60,000/year
ROI: Positive within 3 months

Risks and Mitigations

Risk	Likelihood	Impact	Mitigation
API rate limiting	Medium	High	Use API key for metered access; implement retry logic
Authentication complexity in headless	High	Medium	Use API key or device code flow; pre-authenticate configs
Sandbox prevents legitimate tasks	Medium	Medium	Use `--full-auto` with external sandboxing (VM isolation)
OpenAI API pricing changes	Medium	Medium	Monitor usage closely; set billing alerts; budget buffer
Tool generates incorrect provisioning	Medium	High	Validate outputs; implement verification steps post-provision
Dependency on OpenAI availability	Low	High	Implement fallback to manual scripts; cache credentials
Security: Secrets in prompts	Medium	Critical	Never pass secrets in prompts; use environment variables
Version compatibility breaks	Low	Medium	Pin to specific version; test updates in staging

Recommendation

Decision: ADOPT

Rationale

1. Official Tool: First-party support from OpenAI ensures long-term viability 2. Headless-Ready: `codex exec` command designed specifically for automation 3. Flexible Authentication: API key support enables headless VM provisioning 4. Open Source: Apache-2.0 license allows customization and no vendor lock-in 5. Active Development: Monthly releases indicate sustained investment 6. Cost-Effective: ChatGPT subscription pricing competitive with alternatives 7. JSON Output: Structured events enable programmatic integration 8. Sandbox Control: Security features suitable for production environments 9. Community Ecosystem: 57K stars, extensive third-party tools (MCP servers, etc.) 10. Superior to Alternatives: Only fully open-source AI agent with robust headless mode

Next Steps

1. Immediate Actions:

[ ] Install Codex CLI in test environment (`npm install -g @openai/codex`)
[ ] Obtain OpenAI API key for headless authentication
[ ] Run test provisioning task with `codex exec --json --full-auto`
[ ] Validate JSON output parsing for integration

2. Short-Term (1-2 weeks):

[ ] Create cloud-init template with Codex CLI installation
[ ] Test VM provisioning in isolated environment
[ ] Document config.toml settings for production use
[ ] Implement error handling and retry logic

3. Long-Term (1-3 months):

[ ] Integrate Codex provisioning into CI/CD pipeline
[ ] Monitor API usage and costs
[ ] Develop custom MCP servers for specialized tasks
[ ] Train team on Codex CLI best practices

Decision Review Timeline

3 months: Evaluate API costs and rate limiting impacts
6 months: Assess ROI from reduced manual provisioning time
12 months: Review for updates, alternatives, or optimizations

References

Official Documentation

GitHub Repository: https://github.com/openai/codex
NPM Package: https://www.npmjs.com/package/@openai/codex
Official Docs: https://developers.openai.com/codex
ChatGPT Plans: https://help.openai.com/en/articles/11369540-codex-in-chatgpt

Codex Web: https://chatgpt.com/codex
OpenAI API Docs: https://platform.openai.com/docs
MCP Protocol: https://modelcontextprotocol.io

Community Resources

Reddit discussions: r/OpenAI, r/ChatGPT
Discord: OpenAI Community Discord
Stack Overflow: `[openai-codex]` tag

Benchmark Sources

GitHub metrics: https://github.com/openai/codex
NPM downloads: https://www.npmjs.com/package/@openai/codex
Release notes: https://github.com/openai/codex/releases

Report Generated: 2026-01-28 Researcher: Claude Code (Technical Researcher) Report Version: 1.0

OpenAI Codex CLI Research Report

OpenAI Codex CLI Research Report

Executive Summary

1. Current Status

Is There an Official OpenAI Codex CLI Tool?

Clarification: Codex vs Historical Codex Model

2. Installation Methods

Option A: NPM (Recommended for Automation)

Option B: Homebrew (macOS/Linux)

Option C: Direct Binary Download

Option D: Build from Source

3. Authentication Requirements

Primary Authentication: ChatGPT OAuth (Recommended)

Alternative: API Key Authentication

Device Code Authentication (Alternative for Headless)

Authentication Storage

4. CLI Commands and Flags for Automation/Headless Use

Primary Command Structure

Interactive Mode (Default)

Non-Interactive Mode: `codex exec`

Key Flags for Headless Automation

Critical Flags for VM Provisioning

Resume Previous Session

Code Review Mode

Other Subcommands

5. Configuration File Locations

Primary Config File

Config Structure (TOML)

Config Profiles

Advanced Configuration Options

Config Schema

6. Environment Variables

Authentication

Logging and Debugging

Configuration Override

Color Control

7. Differences from GitHub Copilot

8. SDK and API Documentation

Codex SDK (TypeScript)

Responses API Proxy

MCP (Model Context Protocol) Support

App Server Mode

Official Documentation

9. Pricing Model

ChatGPT Subscription (Recommended)

OpenAI API Key

Cost Comparison for VM Provisioning

10. Cloud-Init Compatible Installation Commands

Option A: NPM Installation (Preferred)

Option B: Binary Download (No Dependencies)

Option C: Device Code Authentication (No Secrets in cloud-init)

Option D: Pre-Authenticated Config Volume

Environment Variable Injection

Complete VM Provisioning Example

Strengths

Weaknesses

Comparison with Alternatives

Integration Considerations

Prerequisites

Integration Effort

Migration Path

Cost Analysis

Open Source

Total Cost of Ownership

Risks and Mitigations

Recommendation

Rationale

Next Steps

Decision Review Timeline

References

Official Documentation

Related Tools

Community Resources

Benchmark Sources