How to review GitHub pull requests with Codex

Codex can take a second, high-signal pass on a GitHub pull request. It reviews the pull request diff, follows repository guidance you give it, and posts a standard GitHub code review focused on serious issues. In GitHub, it flags only P0 and P1 findings so comments stay on high-priority risks. Security Review, available in research preview, is a separate, deeper look at potential security issues.

This is a setup-and-trigger walkthrough from the Codex GitHub docs: turn on Code review, comment @codex review, optionally review every PR opened for review, encode checks in AGENTS.md, and run Security Review when you want extra attention on security.

Before you start

Make sure you have:

Codex cloud set up for the repository you want to review
Access to Codex code review settings
An AGENTS.md file if you want Codex to follow repository-specific review guidance

To configure automatic reviews, you also need a connected GitHub repository and GitHub push or admin permission for its settings.

Turn on Code Review

Set up Codex cloud.
Go to Codex settings.
Turn on Code review for your repository.

Code review settings live at chatgpt.com/codex/settings/code-review. If Codex cloud is not set up for the repository yet, complete that cloud setup first, then return to those settings and turn on Code review.

Once Code review is on, you can mention @codex in a pull request to ask questions or start a task.

Request a Codex review

In a pull request comment, mention @codex review.
Wait for Codex to react (👀) and post a review.

Codex posts a review on the pull request, just like a teammate would. For a one-off focus, add it to the same comment:

@codex review for issues in the database migration

Use the exact trigger @codex review. If you mention @codex with anything other than review, Codex starts a cloud chat using the pull request as context instead of posting that review.

Enable automatic reviews

If you want Codex to review every pull request automatically, turn on Automatic reviews in Codex settings. Codex will post a review whenever someone opens a new PR for review, without needing an @codex review comment.

Customize reviews with AGENTS.md

Codex searches your repository for AGENTS.md files and follows the applicable code review rules. Add a ## Code Review Rules section to the file closest to the code the rules govern. Use ### headings to group related checks when helpful.

For example, an experiment-reporting service can keep post-exposure behavior from changing a comparison cohort:

## Code Review Rules

### Experiment cohorts

- Do not filter treatment comparisons on post-exposure behavior, including conversion or retention.
  Safe path: build cohorts from assignment or exposure; report conversion as an outcome.

Put repository-wide rules in the root AGENTS.md and service-specific rules in a nested file, such as services/experiment_reporting/AGENTS.md. Codex applies the root and the more-specific guidance that covers each changed file, so unrelated changes do not have to carry service-specific context.

Start with two or three concise rules that encode checks reviewers often explain. Useful rules:

Focus on consequential, repository-specific behavior. Describe the compatibility constraint, data boundary, or unsafe side effect to flag and why it matters.
State the safe path or exception. Give Codex enough context to distinguish a real issue from expected behavior.
Keep rules scoped and durable. Prefer outcomes over function names that can change, and place guidance near the code it governs.
Leave mechanical checks in CI. Keep formatting, lint, and other deterministic checks out of review rules.

Open a representative pull request and request a review with @codex review. Refine the rules based on the findings and feedback you see, and narrow or remove guidance that produces noise.

Code review rules guide Codex; they do not replace tests, branch protections, or required approvals.

Run a Security Review

Security Review is an additional review for customers that want particular attention on security issues in pull requests. It goes deeper than Code Review on security-specific risks by analyzing the pull request diff, supporting repository context, and configured threat models or security guidance.

Code Review can also identify security-related issues as part of its general review, so you may see occasional overlap between the two.

Set up Security Review

The GitHub integration docs point to a dedicated Security Review page for more detailed setup instructions and configuration options. The setup on this page is:

Set up Codex cloud.
Go to Codex settings.
Under Repository preferences, choose which pull requests get Security Review and when it runs. Select Whenever code review runs to run it alongside Code Review.

Request a Security Review

To request one manually, add this comment to a pull request:

@codex security review

Codex reacts while the review is running, then posts security findings directly on the pull request. Open the associated Codex task and select the Security Report tab to view the full report.

Act on findings

After Codex posts a review, you can ask it to fix issues in the same pull request:

@codex fix the P1 issue

Codex starts a cloud chat with the pull request as context and can push a fix back to the branch when it has permission to do so.

The same pattern works for other tasks. Mention @codex with anything other than review and you get a cloud chat, for example:

@codex fix the CI failures

Troubleshoot a missing review

If Codex does not react or post a review:

Confirm you turned on Code review for the repository in Codex settings.
Confirm the pull request belongs to a repository with Codex cloud set up.
Use the exact trigger @codex review in a pull request comment.
For automatic reviews, check that you turned on Automatic reviews and that the pull request event matches your review trigger settings.

Next step: open Codex code review settings, turn on Code review for a connected repository, then comment @codex review on a representative pull request. Use what comes back to tighten the ## Code Review Rules section in AGENTS.md before you rely on automatic reviews.

Sources

GitHub · Codex documentation