codex-review-plan

codex-review-plan is a command for coding agents from andreidavid/codex-review. It costs 11 tokens per session (846 once invoked), scanned A, original, MIT.

A command that sends a Claude Code plan file to OpenAI Codex for review. The plan is a Markdown document describing proposed work before code is changed.

In plain words
What is it for?
Use it to review the newest plan in Claude Code's plans folder or a specific plan file before implementation.
Why use it?
It provides a second review of the planned approach and reports when the requested plan file is missing or empty. The review runs when requested rather than automatically.

Command

Part of the codex-review plugin — 1 skill, 4 commands, 3 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/andreidavid/codex-review/codex-review-plan
Clone the repo
git clone --depth 1 https://github.com/andreidavid/codex-review

Or install codex-review, the plugin that ships this one along with the rest of its 1 skill, 4 commands, 3 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for codex-review-plan

README.md
[![agentmods](https://agentmods.dev/badge/commands/andreidavid/codex-review/codex-review-plan.svg)](https://agentmods.dev/commands/andreidavid/codex-review/codex-review-plan)
Your own site
<a href="https://agentmods.dev/commands/andreidavid/codex-review/codex-review-plan"><img src="https://agentmods.dev/badge/commands/andreidavid/codex-review/codex-review-plan.svg" alt="Measured on agentmods" height="20"></a>
Per session 11 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 846 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00011 $0.00846
Opus 5 $0.00005 $0.00423
Sonnet 5 $0.00002 $0.00169
Haiku 4.5 $0.00001 $0.00085

Measured 4d ago against content hash e5c0b7582a33, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

codex-review-plan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/codex-review/commands/codex-review-plan.md · 69 lines

How it starts

The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Codex Plan Review

The user invoked this command with: $ARGUMENTS

Instructions

Review a Claude Code plan file with OpenAI Codex. The flow is on-demand and non-blocking — unlike the post-commit hook, it operates on markdown prose in ~/.claude/plans/ rather than a git diff.

1. Resolve the plan path

Parse $ARGUMENTS:

  • No argument — pick the most-recently-modified plan file:

    ls -t ~/.claude/plans/*.md 2>/dev/null | head -1
    

    If the directory is empty or missing, tell the user "No plan files in ~/.claude/plans/." and stop.

  • Argument contains / — treat as an absolute path (or relative to the current working directory). Expand ~ yourself.

  • Bare filename (no /) — resolve against ~/.claude/plans/<arg>. Append .md if no extension.

Before proceeding, verify the resolved path exists and is non-empty:

[ -s "<PATH>" ] || { echo "Plan file <PATH> does not exist or is empty"; exit 1; }

If the file doesn't exist, tell the user the path you checked and stop without running Codex.

2. Run Codex against the plan

Invoke (honor $CODEX_BIN the same way the post-commit hook does, and pass --skip-git-repo-check so reviewing a plan works from any directory — scratch folders, non-git trees, etc.):

"${CODEX_BIN:-codex}" exec --full-auto --skip-git-repo-check "Review the implementation plan at <PATH>. Read it fully, then critique from these angles: missing steps or gaps; design flaws or wrong-architecture choices; scope creep or under-scoping; risks and unhandled edge cases; verification that's insufficient or missing. Format findings using priorities: [P1] = critical (the plan will fail or produce wrong outcomes as written), [P2] = important (will cause rework), [P3] = advisory. If nothing material is wrong, say so explicitly."

Notes:

  • Substitute the resolved <PATH> literally into the prompt so Codex can read the file from its sandbox.
  • --full-auto runs sandboxed and non-interactive, matching the post-commit hook.
  • --skip-git-repo-check is required because Codex aborts in non-repo / untrusted-dir contexts by default; plan review has no git dependency so always skip the check.
  • Do not pass --json — this command is interactive; the user reads the prose directly.
  • Expect 30–120 seconds for a moderate plan; complex plans can take longer.

Read the full file on GitHub · 69 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 69 lines · 11 tokens per session scan A e5c0b7582a33

Subscribe to this mod's changes

codex-review-plan is a command published in the GitHub repository andreidavid/codex-review (2 stars, last pushed 1mo ago), licensed MIT. It adds 11 tokens to every session and 846 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other commands, from other repositories

sm-sail

Command "sm-sail" from ScienceIsNeato/slop-mop, covering /sm-sail — drive a pr to green, autonomously, the loop, when sail parks on review threads, when to stop before "pr ready" — only two reasons and expect convergence, not one pass.

ScienceIsNeato/slop-mop · 0 tokens

sm-buff

You usually don't run buff directly — run sm sail. sm sail drives the whole PR to green and calls buff watch / triage for you, stopping only when it needs you to act (see /sm-sail). Reach for sm buff here only for surgical work: inspecting a specific failure, or resolving a single review thread when sail has parked on…

ScienceIsNeato/slop-mop · 0 tokens

sm-wake-angry-drunk-captain

The last-resort verb. Use it ONLY when the loop is genuinely exhausted: barnacles filed, gates green or truly unfixable, and the single remaining move is a human judgment call no sm verb can make for you.

ScienceIsNeato/slop-mop · 0 tokens

sm-barnacle

Use when sm itself gives invalid guidance, blocks valid work, produces confusing output, or breaks install/upgrade/refit flow. Do not use this for real target-repo failures; fix those through the normal rail.

ScienceIsNeato/slop-mop · 0 tokens

doctor

hi-vibe's own health check — actually runs hi-vibe's 5 hooks & scanner to catch silent failure. Not Claude Code's built-in /doctor (that one checks your CLI install).

jx-hxxx/hi-vibe · 40 tokens

sm-init

Run when you find a repo with sm installed but no .sbconfig.json — or after upgrading slopmop to pick up new gates.

ScienceIsNeato/slop-mop · 0 tokens