Codex Security Cloud

Only use for an explicitly requested Codex Security Cloud task. List Cloud environments and their repositories for security scan setup. Choose an environment containing the target repository.

Only use for an explicitly requested Codex Security Cloud task. Search Cloud environments visible to the caller for security scan setup. Choose an environment containing the target repository.

Start or reopen a Cloud conversation about a finding.

Only use for an explicitly requested Codex Security Cloud task. Close an accessible commit-scan finding as fixed with a written justification. First read the exact finding, then pass commit_detail.id, its current version, and a nonempty resolution_reason.

Create a pull request for a finding patch.

Export the caller-visible findings using the selected filters.

Submit feedback on a finding visible to the caller.

Only use for an explicitly requested Codex Security Cloud task. Read an exact security finding visible to the current caller. For a commit-scan finding, use commit_detail.id and commit_detail.version when closing it.

Only use for an explicitly requested Codex Security Cloud task. List security findings visible to the current workspace and caller.

Summarize all security findings matching the app's filters.

Update a finding using the existing edit permissions and version check.

Only use for an explicitly requested Codex Security Cloud task. Get the GitHub app installation URL to configure organization and repository access. Select connector_id from bootstrap's githubConnectorIds.

Only use for an explicitly requested Codex Security Cloud task. Read a repository visible to the caller's GitHub connection.

Only use for an explicitly requested Codex Security Cloud task. List repositories in the caller's GitHub connection to choose a security scan target. Select connector_id from bootstrap's githubConnectorIds; use the returned repository IDs for scan setup.

Only use for an explicitly requested Codex Security Cloud task. Search the caller's connected GitHub repositories by name for security scan setup. Select connector_id from bootstrap's githubConnectorIds; use the returned repository IDs, not guessed IDs.

Read lifetime commit-scan costs for a monitoring configuration visible to the caller.

Create monitoring for a repository the caller may configure.

Delete a monitoring configuration the caller may edit.

Read a monitoring configuration visible to the current caller.

List monitoring configurations visible to the caller for scan setup.

Read monitoring setup options for the current workspace.

Recover a deleted monitoring configuration the caller may edit.

Read a scan for a monitoring configuration visible to the caller.

List scans for a monitoring configuration visible to the caller.

Update monitoring using the existing edit permissions and version check.

List the caller's Codex Slack workspaces for notifications.

Send a test notification to an authorized Slack channel.

Check whether an authorized Slack workspace can deliver to a channel.

Save the current account member's Codex Security Cloud introduction preference.

List a combined page of repository and commit scans visible to the caller.

Only use for an explicitly requested Codex Security Cloud task. Read scan allowance and billing availability for the current workspace.

Read a report artifact of a security workflow visible to the caller.

Only use for an explicitly requested Codex Security Cloud task. Request cancellation of a security scan owned by the caller, using its exact run_id. If the response is cancel_requested, cancellation is still pending; use workflow_get to check the resulting status.

Only use for an explicitly requested Codex Security Cloud task. Read step IDs and allowed model and reasoning choices before launching a security scan. Use workflow_id codex-security.security-scan for repository scans. Ask the user to choose when multiple options remain unspecified.

Only use for an explicitly requested Codex Security Cloud task. Read a security scan run's status, progress, and output IDs. Use a run_id returned by workflow_launch or workflow_list.

Only use for an explicitly requested Codex Security Cloud task. Start a requested security scan in the selected Cloud environment. First discover the repository, matching environment, and workflow model/reasoning choices. Send the selected step configuration; omit reasoning when unavailable. Reuse the same idempotency_key when retrying the same launch. Returns a run_id for status and results; launch is asynchronous.

Only use for an explicitly requested Codex Security Cloud task. List security scan runs visible to the caller, including run IDs and statuses. Use filters and pagination to find the requested run.

Only use for an explicitly requested Codex Security Cloud task. Read security scan output metadata and artifact references using run_id and output_id from workflow_get. Use findings_list with source repository_scan and scan_id equal to run_id to read findings. Report artifacts can be downloaded in the app.

Only use for an explicitly requested Codex Security Cloud task. List repositories with security workflows visible to the caller.