openqodex/openqodex

选用指南

AI 根据 README 整理 · 2026/10/16 23:41:40

使用方式

通过命令行使用，例如运行 `npx openqodex init` 安装，然后使用 `~/.openqodex/bin/openqodex review` 进行审查。

查看 README 依据

- Some scanners need a language runtime that OpenQodex does not install. brakeman and rubocop need Ruby. golangci-lint needs Go. cargo-deny needs Cargo. ## Install For people, in your terminal: ``` npx openqodex init ``` In a terminal, `init` finds Claude Code, Cursor, Codex CLI and Cline on your machine. It lists the files it will write. It asks you once. It starts the scanner downloads that your repository needs. Then it reviews your current change when a reviewer can start.

After the install, say to your agent: "review my change with openqodex". In your own terminal, run `~/.openqodex/bin/openqodex review`. That path is the launcher, a small script that `init` writes. An `npx` install puts no `openqodex` on your `PATH`. For agents, the same install with no question: ``` npx -y openqodex@0.13.0 init --yes --agent <host> ```

部署要求

需要 Node 22 或更高版本以及 git，支持 macOS 或 Linux。完整审查需要安装并登录 Claude Code 或 Codex。

查看 README 依据

| Cursor | yes | no | no, a rule asks Cursor to review | | Cline | yes | no | no, a rule asks Cline to review | In Cursor and Cline, the review needs Claude Code or Codex installed as the reviewer. A push gate is a hook that looks for a review before your agent runs `git push`. ## Requirements - Node 22 or newer, and git. - macOS or Linux. CI runs the gate on Node 22, on macOS and on Ubuntu Linux. No test runs on Windows or WSL. - For a full review: Claude Code or Codex, installed and logged in. OpenQodex needs no account or API key of its own.

已知限制

目前仅支持 Claude Code 或 Codex 作为审查器，Cursor 不能作为审查器。在 Codex 沙箱内无法启动第二个 Codex 进程。

查看 README 依据

- `npx openqodex demo` builds a small repository with planted bugs. Then it scans that repository. ## What it does not do yet - No reviewer other than Claude Code or Codex. Cursor cannot be the reviewer. `cursor-agent` 2025.09.18 offered no way to limit it to reading. - Without a reviewer, `review` prints "Full review unavailable" and exits 2. It saves the scanner findings, unchecked, to `unchecked-candidates.json`. It also names a fallback command, `review --agent`. In that fallback, your coding agent reviews its own change.

- Inside the Codex sandbox, a second Codex process does not start. So Codex cannot be the reviewer there. OpenQodex tested this with codex-cli 0.160.0 on macOS. - No review on your own API key, except in the GitHub Action. - No Homebrew formula, no install script and no Docker image in this version. Install through npm. - No offline copy of the vulnerability databases. osv-scanner asks osv.dev. cargo-deny downloads the RustSec advisory database. - No review finds every problem. The report names each stage that did not run. <!-- benchmark-results:start --> ## Benchmark