Codex CLI: What It's Good At (and What It Isn't)

I have Codex CLI open in two terminal tabs as I write this. It is the fastest tool I own for changing code that already exists, and it is also the tool I have learned to stop asking for things it was never built to do. That second half is the part nobody writes down, so this is the honest version: what the Codex CLI is genuinely good at, exactly where it stops, and what I run beside it so the work that isn't code still gets finished.

No FUD here. I pay for it. I just stopped pretending one terminal agent was my whole operating system.

What Codex CLI actually is

Codex CLI is OpenAI's terminal agent. One line installs it — curl -fsSL https://chatgpt.com/codex/install.sh | sh, or npm install -g @openai/codex, or brew install --cask codex — and the first run offers Sign in with ChatGPT, per OpenAI's CLI docs. From there you are in a loop: it reads your repo, edits files, runs your test command, shows you the diff.

Two separate controls decide how far it can go. The sandbox is technical (where it can write, whether it can reach the network) and the approval policy decides when it must stop and ask. OpenAI's approvals and security page states that by default the agent runs with network access turned off, and that the Auto preset is literally --sandbox workspace-write --ask-for-approval on-request. Network stays off in workspace-write unless you set network_access = true yourself.

That default is the single most underrated thing about it.

What Codex CLI is genuinely good at

The repo-local loop. Explore unfamiliar code, plan a change, edit, run the project's own tools, iterate. No copy-paste, no context re-upload, no browser tab.

Scripted runs. codex exec "..." runs without the TUI. Progress goes to stderr and only the final message to stdout, so codex exec "generate release notes for the last 10 commits" | tee release-notes.md just works. Add --json and stdout becomes a JSON Lines stream of thread.started, turn.completed and item.* events you can pipe into anything — all documented on the non-interactive mode page.

Safe defaults in automation. codex exec runs in a read-only sandbox unless you widen it to --sandbox workspace-write or, in an isolated runner only, --sandbox danger-full-access.

Review before you commit. A dedicated review pass against uncommitted changes, a commit, or a base branch, without touching your working tree.

Extensibility. codex mcp adds local or remote MCP servers, and subagents split a big investigation into focused pieces that report back into the same session.

Notice what those three strengths have in common. They all point at one repository.

Where Codex CLI stops

1. The five-hour window is real. OpenAI's Codex pricing page puts local messages per five-hour window at 10–100 on GPT-5.6 Sol for Plus ($20/month), 25–200 on Terra, and 250–2,000 on Luna, with Pro 20x reaching 200–2,000 Sol messages. Local messages and cloud chats share that window, and the page warns that additional weekly limits may apply. A hard afternoon on Sol can end your afternoon.

2. The API-key escape hatch costs real money. You can run Codex on an API key instead, but the same page is blunt about the trade: "No cloud-based features (GitHub code review, Slack, etc.)" and you pay per token. At current API rates, gpt-5.6-sol is $4.00 per million input tokens and $20.00 per million output at short context; gpt-5.6-terra is $2.00 and $12.00. An agent that re-reads a large repo all afternoon is not a rounding error. I broke down what a month of that actually looks like in how much an AI agent really costs.

3. It has no scheduler. OpenAI says it plainly in the scheduled tasks doc: "Codex CLI doesn't provide the Scheduled management interface. Use ChatGPT web or the desktop app to create and manage scheduled tasks." Recurring work has to come from somewhere else — your own cron, ChatGPT, or the openai/codex-action@v1 GitHub Action, which wants an OpenAI key stored as a repo secret.

4. Everything is repo-shaped. Even the Slack route is. The Slack integration doc requires Codex cloud, a connected GitHub account and at least one environment, and the chat "runs against the default branch of the first repository listed in that environment's repo map." Brilliant for a pull request. Useless for "reconcile last month's invoices and email me the exceptions."

5. One vendor's judgment. Some tasks land better with Claude. That isn't heresy — OpenAI ships a Codex plugin for Claude Code and points you at it in its own docs. If you want the long version of that trade, I wrote Codex vs Claude Code.

Codex CLI vs Claude Code vs a message-first agent

How I actually run all three

I stopped choosing. Codex CLI keeps the code loop. Claude Code takes the long autonomous runs. And the jobs that have no repo — chase a supplier, pull five invoices out of Gmail, update a Notion database, write the weekly recap — get sent by message.

That last lane is what I built Notis for, and the part that matters here is that it does not replace either CLI. It drives them. Notis routes a request to your Codex account, your Claude Code account, or its own hosted agent, locally through the desktop app or in an isolated cloud container, and per the routing docs your login "stays in that CLI's own credential store and never leaves the machine." Notis never asks for an API key and never accepts one, so a delegated Codex run bills to the ChatGPT subscription you already pay for.

The economics are the boring part. Notis publishes that every task draws a few cents from the usage included in the plan — last week's average across every user was $0.09 — and that when the allowance runs out you can turn on on-demand usage at the same published rates. Pro is $13 a month billed annually. There is no per-seat model bill layered on top, because the model bill lands on the subscription you already hold.

Who should pick what

• You write code all day and the repo is the job. Codex CLI, Plus or Pro, and nothing else. Learn /permissions and codex exec properly.
• You want overnight autonomous coding. Add Claude Code and its routines, and read 7 jobs worth handing over first.
• Half your backlog isn't code. No CLI fixes that. Put the message-first layer on top and let it route to whichever CLI you already pay for.
• You just want fewer subscriptions. Start with the free ChatGPT plan and Codex CLI locally, and only add a lane when the window keeps stopping you mid-task.

The one thing I would not do is what I did for six months: use a repo-shaped tool for a business-shaped problem, then blame the model. Codex CLI is excellent inside its boundary. Draw the boundary honestly and the whole stack gets calmer.