Bex Security: Agent-Agnostic AI Security Scanner

Repositorybex-co/bex-securityTool

Bex Security is an open-source, upstream-first fork of OpenAI Codex Security that brings vulnerability detection, validation, and remediation to multiple coding agents via the Agent Client Protocol (ACP).

Key points

  1. Upstream-first fork of openai/codex-security designed to keep pace with upstream vulnerability workflows.
  2. Implements an open agent layer using the Agent Client Protocol (ACP) to decouple scanners from specific vendors.
  3. Codex is supported by default, with alpha-stage support for Claude Code, Kimi Code, Muse Code, Qwen Code, and MiMo Code.
  4. Requires Node.js (22.13.0+, 24.x, or 26.x) and Python 3.10+; distributed under the Apache-2.0 licence.

Why it matters

AI-driven code security and patch validation are frequently tied to a single vendor's CLI or platform. Decoupling the security workflow through standard agent protocols gives engineering teams flexibility in their choice of models without sacrificing upstream detection capabilities.

Analysis

The project addresses vendor lock-in within agentic security workflows by providing a portable execution environment across different models and editors. Its stack relies on TypeScript, Node.js, and Python, centring on the emerging Agent Client Protocol. Bex Security is aimed at DevSecOps engineers and developers using diverse coding agents who require automated scanning and patching workflows. In terms of maturity, it is currently in an early phase: non-Codex agents and ACP integrations are explicitly labelled as alpha, and the repository holds modest engagement metrics (51 stars, 11 forks).

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 14 October 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • X post:Tibo

    OpenAI Releases Codex Security CLI and TypeScript SDK

    OpenAI has open-sourced Codex Security, a tool designed to discover, validate, and remediate vulnerabilities in codebases. It provides a CLI, a TypeScript SDK, and support for multiple model providers.

    5.6kbookmarks736.6kviews

    AI & LLMs· Tool

  • Repository:nealbridges/VulnHunter

    VulnHunter: Agentic AI Security Scanner for Exploitable Vulnerabilities

    VulnHunter is an open-source, agentic AI security scanner that inspects source code from an attacker's perspective, confirms exploitability, and generates fixes. This maintained fork of Capital One's original project decouples the tool from Claude Code to support arbitrary agent harnesses and open-weight models.

    223starsPython

    AI & LLMs· Tool

  • Repository:affaan-m/agentshield

    AgentShield: Security Auditor for Claude Code and MCP Configurations

    AgentShield is an open-source TypeScript security scanner designed for AI agent setups. It inspects `.claude/` directories to detect hardcoded secrets, unverified MCP servers, hook injection vulnerabilities, and tool permission misconfigurations.

    1.2kstarsTypeScript

    AI & LLMs· Tool

  • Repository:NVIDIA/SkillSpector

    SkillSpector: Security Scanner for AI Agent Skills by NVIDIA

    SkillSpector is an open-source security scanner from NVIDIA designed to inspect extensions and skills for AI agents (such as Claude Code, Codex CLI, and MCP) for vulnerabilities and malicious patterns before installation.

    15.9kstarsPython

    AI & LLMs· Tool

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.