Open Source Radar — November 14: OpenAI's Codex Security CLI
Today's board is all about review: OpenAI's vulnerability scanner now runs as an open CLI, Chrome is teaching coding agents the modern web, and a 10,000-star app that puts a human between the agent and the merge.
codex-security (TypeScript, 13,345 stars) is OpenAI's scanner for finding, validating and fixing vulnerabilities in your own repository, released as an Apache-2.0 CLI and TypeScript SDK that started as a research preview on November 6 and gained 751 stars today alone. It scans a repo, a path or a git diff, confirms candidate findings before reporting them, generates patches, then re-checks the fix — and it will ingest findings from scanners you already run, with importers for AWS and CrowdStrike added in the last week. Findings track into Linear, Jira or GitHub and export as SARIF, JSON or CSV, so the obvious use is a security step in CI that a coding agent can act on rather than a report nobody reads. The catch is the same one every scanner has: a validated finding still needs a human to decide whether it matters, and this is version 0.10, not a finished product.
modern-web-guidance (TypeScript, 12,152 stars) is Chrome's answer to the fact that coding agents write 2016-era JavaScript, because that is what the training data is full of. Version 1.0 shipped on November 10 and is now stewarded by Chrome, Edge, Firefox and the MDN team together — a rare cross-vendor truce on what "correct" web code looks like. Chrome says its evals are the argument: frontier models passed about 60% of modern-web checks unaided and 80–90% when the skill was installed, according to the Chrome team's launch post. The engineering that makes it usable rather than annoying is the retrieval: agents search a 7 MB local index and pull one guide at a time instead of dumping 1.7 MB of Markdown into the context window. There is a new workflow that scans an existing codebase for legacy patterns worth modernizing, which is where most real frontend work lives.
plannotator (TypeScript, 10,618 stars) is a local, browser-based review surface that opens whenever an agent proposes a plan, writes a spec or finishes a diff — you annotate it, and your comments go back to the agent as its next turn. It is deliberately agent-agnostic, wiring into Claude Code, Codex, Copilot CLI, Gemini CLI, OpenCode, Kiro, Droid, Amp and Pi through plugins and hooks, with an MCP path for anything else. The new piece is Plannotator Inbox: agents leave questions, files and screenshots in one window and keep working instead of blocking a session until you look. If your bottleneck has shifted from writing code to approving it, this is aimed squarely at that, and near-daily releases suggest the author is living in it.
The pattern across all three: the open-source money has moved from generation to verification — scanning what the model wrote, teaching it the right pattern before it writes, and giving a person a fast way to say no.
Worth watching this week: whether Codex Security's scanner imports turn SARIF into the interchange format for agent-driven security review, the way it already is for static analysis.
Where does human review actually belong in your agent pipeline — before the code, after the diff, or only before the merge? Write to us via our contact page.
