Codex CLI

Why it's ranked here

What stands out is completeness rather than novelty. The whole local agent ships in the open under Apache-2.0: the model client, the patch engine, the permission policy engine, and sandbox backends for three operating systems, not just a thin client for a hosted service. It also speaks the Model Context Protocol in both directions, managing external servers while exposing the agent itself as one that other tools can call. Renamed internals keep deprecated aliases, a sign that consumers get carried through changes rather than broken by them.

What's good

Its internal boundaries are enforced by the compiler, not just documented. The core and headless components ban printing to standard output outright, so machine-readable output stays valid JSON, one event per line. The patch engine is honest about partial failure: when a write fails midway, it flags that the working tree may already have been touched instead of pretending nothing happened. And command permissions live in a dedicated policy component with prefix rules, network rules, and an explicit decision type rather than ad-hoc string matching.

Tradeoffs

This is a big thing to take on. Several subcommands are marked experimental and a few are hidden from the help output entirely, so a meaningful slice of the command surface is either unstable or invisible. Configuration is layered and wide, spanning cloud bundles, managed policy, and permission profiles. Analytics default to on when the setting is left unset, and the codebase carries a test asserting exactly that. The primary install path in the documentation pipes a remote script into a shell.

How to use it well

For automation, use the headless mode with JSON output rather than scripting the interactive interface: standard output is guaranteed to be one JSON event per line, everything else goes to the error stream, and you can capture a structured result against a schema you supply. Turn diagnostic logging on explicitly, since headless runs default to reporting errors only. Prefer named permission profiles over the flag that bypasses approvals and sandboxing entirely. Try an unfamiliar command under the built-in sandbox subcommand before trusting it in a full run, and use the doctor subcommand to check installation, config, auth, and runtime health.

Observed

License

Apache-2.0, stated in the README

Primary language

Rust workspace; the root package manifest is private and only carries formatting and repo-maintenance tooling

Install surfaces

shell installer, PowerShell installer, npm global package, Homebrew cask, or a per-platform release binary

Interfaces

interactive terminal UI, headless exec mode with JSON output, MCP server over stdio JSON-RPC, plus sandbox and doctor subcommands

Sandbox backends

macOS seatbelt, Linux seccomp plus bubblewrap, Windows restricted token