Skip to main content
Integrate Semgrep Guardian with Codex for scans of AI-generated code through hooks and plugins. Codex is a recommended Guardian setup. The plugin uses Semgrep’s hosted server and OAuth, so you don’t need to install the Semgrep CLI locally.

​
Prerequisites

  • A Semgrep account
  • Codex CLI installed (codex command)

​
Setup

1

Install the plugin

Add the Semgrep marketplace, then install the Guardian plugin from it:
2

Start a new Codex session

Start a new Codex session so the plugin loads:
3

Sign in to Semgrep

Ask Codex:
Complete the sign-in prompts in your browser.
4

Confirm you're signed in

Ask Codex:
Codex confirms your identity and Semgrep deployment.
To verify the installation from your terminal, run:
For Windows machines: Windows Subsystem for Linux (WSL) is no longer required. Guardian works in native Windows shells such as PowerShell and Cygwin, as well as in WSL.

​
What rules does this setup use?

The Codex plugin scans with the guardian-default ruleset, which you can customize with Guardian Policies. You configure Guardian’s rules separately from your CI and platform scans. See Rules and configuration for more information.

​
Local PHP version check

Guardian checks the PHP version installed on your machine. See Why did Guardian show a PHP version error? for when the check runs, which versions are affected, and how to turn it off. For the full list of incidents Guardian checks for, including Node2Shell, see Semgrep Guardian incident advisories.

​
Next steps