To have Codex review GitHub pull requests without a manual prompt, connect the repository to Codex, enable Automatic review under Review code, and select a Review trigger. Codex then reviews pull requests when the configured event occurs; you do not need to comment @codex review. Add repository-specific guidance in an applicable AGENTS.md file under ## Code Review Rules, but keep tests and merge protections as the mechanisms that enforce requirements.
What you need before enabling automatic Codex reviews
- The GitHub repository must be connected to Codex, and Code Review must be enabled for it.
- You need access to Codex Code Review settings. To change repository settings, you need GitHub push or admin permission for that repository.
OpenAI’s GitHub pull request review guide describes these prerequisites and the setup controls.
As an Amazon Associate I earn from qualifying purchases.
How to enable automatic Codex reviews on GitHub pull requests
- Connect the GitHub repository to Codex if it is not connected already.
- In Codex settings, select the repository.
- Under Review code, enable Automatic review.
- Choose when reviews should run using Review trigger. Automatic reviews run for pull requests that match the selected trigger; no
@codex reviewcomment is required.
The exact trigger options are presented in the current settings. Choose the event that fits your review workflow rather than assuming every pull request update will trigger a review.
Recommended Free Tools
What triggers an automatic review, and how is it different from a manual request?
| Review mode | How it starts | What to expect |
|---|---|---|
| Automatic Code Review | Enable Automatic review for the connected repository and choose a Review trigger. | Runs when the pull request event matches the selected trigger. No comment is needed. |
| Manual Code Review | Comment @codex review on the pull request. |
Codex responds with a review. GitHub comments flag P0 and P1 issues. |
| Security Review | Use its separate setting or comment @codex security review. |
A security-focused review that can use threat-model guidance; it is distinct from general Code Review. |
For a one-off manual review with a specific focus, include that focus in the comment, for example @codex review for issues in the database migration. OpenAI documents the manual syntax and the distinction between Code Review and Security Review in its GitHub review guide.
#1 Best Overall
How to add custom Codex code review rules
Place rules in an AGENTS.md file under a ## Code Review Rules heading. Put repository-wide requirements in the root file and subsystem-specific requirements in the closest applicable nested file. Codex searches for these files and applies guidance relevant to the changed code, combining applicable root and more-specific instructions.
Write a few short rules about consequential repository behavior that a reviewer should repeatedly check. State the invariant, why it matters, and a safe path or exception. Avoid rules that merely restate formatting or lint checks: deterministic checks belong in CI, and guidance tied to outcomes is less likely to become stale than guidance tied to function names.
Example: protect an experiment comparison
## Code Review Rules
- Keep experiment comparison cohorts based on assignment or exposure, not on behavior measured after exposure. Post-exposure filtering can bias the comparison. It is safe to report conversion as an outcome after defining the cohort from assignment or exposure.This follows the kind of actionable rule OpenAI illustrates in its custom Code Review rules article: preserve the analytical invariant while identifying a valid way to report the outcome. The same pattern works for compatibility constraints, data boundaries, or unsafe side effects.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to test whether a rule helps instead of creating review noise
- Start with two or three durable rules for recurring, high-consequence issues.
- Check them against a representative pull request that violates the rule.
- Check a safe counterexample that should not be flagged.
- Check an unrelated change to see whether the rule is scoped well.
- Refine or remove rules that create noise, and keep mechanical requirements in CI.
OpenAI’s July 20, 2026 article reports that, in its primary evaluation suite, rule-guided variants recovered 98% of required custom findings, compared with 58.3% for the baseline control. These are OpenAI’s evaluation results, not a promise of production performance; the evaluation also considered coverage, restraint, retention of ordinary-bug findings, and actionability.
What Codex review rules can and cannot enforce
Review rules guide Codex’s findings; they do not block a merge or replace tests, branch protections, or required approvals. Keep hard requirements in automated tests and CI, and configure repository protections and approvals for the controls that must prevent merging.
Use human judgment for choices among valid designs and decisions that depend on product behavior, compatibility policy, naming, migrations, release communication, or cross-team alignment. OpenAI’s custom rules article describes Codex as an additional reviewer, not the enforcement layer.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When to use Security Review instead
Security Review is a separate, more security-focused pull-request review. OpenAI says it considers the diff, supporting repository context, and configured threat models or security guidance. General Code Review may also identify some security issues, so the two can overlap.
OpenAI’s August 21, 2026 Security Review article lists automatic triggers for a pull request opening, every push, or whenever an existing Codex Code Review runs. That article describes availability for ChatGPT Enterprise, Business, Edu, and Pro accounts; eligibility and settings can change, so check the current Security Review documentation and your account’s settings before relying on access.
Best Value
Why an automatic review might not start
- Confirm Code Review is enabled for the repository and that the repository is connected to Codex.
- For a manual request, use the exact comment trigger
@codex review. - For an automatic review, confirm that the pull request event matches the selected Review trigger.
- Check that you have the needed access to the repository and its Codex settings.
These checks follow the troubleshooting guidance in OpenAI’s GitHub pull request review guide.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
