Codex Security Cloud

List Cloud environments and their repositories for security scan setup. Choose an environment containing the target repository.

Search Cloud environments visible to the caller for security scan setup. Choose an environment containing the target repository.

Start or reopen a Cloud conversation about a finding.

Close an accessible commit-scan finding as fixed with a written justification. First read the exact finding, then pass commit_detail.id, its current version, and a nonempty resolution_reason.

Create a pull request for a finding patch.

Export the caller-visible findings using the selected filters.

Submit feedback on a finding visible to the caller.

Read an exact security finding visible to the current caller. For a commit-scan finding, use commit_detail.id and commit_detail.version when closing it.

List security findings visible to the current workspace and caller.

Summarize all security findings matching the app's filters.

Update a finding using the existing edit permissions and version check.

Read a repository visible to the caller's GitHub connection.

List repositories in the caller's GitHub connection to choose a security scan target. Select connector_id from bootstrap's githubConnectorIds; use the returned repository IDs for scan setup.

Search the caller's connected GitHub repositories by name for security scan setup. Select connector_id from bootstrap's githubConnectorIds; use the returned repository IDs, not guessed IDs.

Create monitoring for a repository the caller may configure.

Delete a monitoring configuration the caller may edit.

Read a monitoring configuration visible to the current caller.

List monitoring configurations visible to the caller for scan setup.

Read monitoring setup options for the current workspace.

Recover a deleted monitoring configuration the caller may edit.

Read a scan for a monitoring configuration visible to the caller.

List scans for a monitoring configuration visible to the caller.

Update monitoring using the existing edit permissions and version check.

List the caller's Codex Slack workspaces for notifications.

Send a test notification to an authorized Slack channel.

Check whether an authorized Slack workspace can deliver to a channel.

Save the current account member's Codex Security Cloud introduction preference.

List a combined page of repository and commit scans visible to the caller.

Read scan allowance and billing availability for the current workspace.

Read a report artifact of a security workflow visible to the caller.

Request cancellation of a security scan owned by the caller, using its exact run_id. If the response is cancel_requested, cancellation is still pending; use workflow_get to check the resulting status.

Read step IDs and allowed model and reasoning choices before launching a security scan. Use workflow_id codex-security.security-scan for repository scans. Ask the user to choose when multiple options remain unspecified.

Read a security scan run's status, progress, and output IDs. Use a run_id returned by workflow_launch or workflow_list.

Start a requested security scan in the selected Cloud environment. First discover the repository, matching environment, and workflow model/reasoning choices. Send the selected step configuration; omit reasoning when unavailable. Reuse the same idempotency_key when retrying the same launch. Returns a run_id for status and results; launch is asynchronous.

List security scan runs visible to the caller, including run IDs and statuses. Use filters and pagination to find the requested run.

Read security scan output metadata and artifact references using run_id and output_id from workflow_get. Use findings_list with source repository_scan and scan_id equal to run_id to read findings. Report artifacts can be downloaded in the app.

List repositories with security workflows visible to the caller.