Skip to content

Custom API endpoint #52

Description

@ignoramous

u/strictnein: Does [codex-security] require hitting OpenAI's APIs or can one also stand up a local OpenAI compatible LLM endpoint?

@mldangelo-oai: We are actively working on officially supporting this. Because it's open source it is pretty easy to point a coding agent at it now and switch out the model.

u/ignoramous: Exciting! Is there any open GitHub issue we can track?

@mldangelo-oai: If you open an issue with the endpoint or model you want to use, I'd be happy to follow up there.

(link)

Activity

  1. mldangelo-oai commented on Aug 3, 2026

    @mldangelo-oai
    Collaborator

    Maintainer cross-reference for the two provider approaches: #125 proposes a relatively small generic OpenAI-compatible endpoint, while #139 implements Azure-specific provider support and credential isolation across a much larger change. Both currently conflict with main, and neither should be selected until HTTPS requirements, credential isolation, supported providers, and cost semantics are defined consistently. Prefer the smallest implementation that satisfies that shared policy; Azure support and a generic custom endpoint are related, not automatically equivalent.

  2. added
    area:authLogin, credentials, account access, and authentication recovery.
    area:cliCommand-line help, arguments, terminal UI, and user interaction.
    priority:p2Significant defect or product gap with narrower impact or a workaround
    on Aug 15, 2026
  3. tan-yong-sheng commented on Sep 21, 2026

    @tan-yong-sheng

    Hope that would be supported in future, currently using Bex Security as a temporary alternative to OpenAI Codex Security. It keeps the same workflow for finding, validating, and fixing security vulnerabilities, while moving toward an open agent system based on ACP (Agent Client Protocol): https://github.com/bex-co/bex-security

  4. mldangelo-oai commented on Oct 8, 2026

    @mldangelo-oai
    Collaborator

    This may now be covered through native Codex provider settings. Merged #1281 preserves per-scan provider configuration, and #1326 carries endpoint overrides into fresh and resumed Deep workers. Could you check whether that works for your Responses-compatible endpoint?

  5. added
    area:configProject configuration, profiles, schemas, and effective scan settings.
    area:providersModel providers, custom endpoints, model selection, and provider-specific settings.
    and removed
    area:authLogin, credentials, account access, and authentication recovery.
    area:cliCommand-line help, arguments, terminal UI, and user interaction.
    on Oct 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area:configProject configuration, profiles, schemas, and effective scan settings.area:providersModel providers, custom endpoints, model selection, and provider-specific settings.enhancementNew feature or requestpriority:p2Significant defect or product gap with narrower impact or a workaround

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions