#3030th of 308 in Skills, plugins and prompts
oh-my-codex
Workflow layer for OpenAI Codex CLI with skills, roles, and durable state
- Stars
- 33.6k
- License
- MIT
- Last commit
- Oct 2026
- Last release
- Oct 2026
- Language
- TypeScript
2,487 on 27 Mar 202633,618 on 23 Oct 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
oh-my-codex (OMX) wraps the Codex CLI and keeps Codex as the execution engine. It adds skills such as $deep-interview, $ralplan, $ultragoal and $team, specialist roles, scoped AGENTS.md setup, and plans, logs and state stored under .omx/. It launches sessions in tmux with a HUD and can run each session in its own git worktree.
Who it is for: Codex CLI users who want structured planning and multi-agent workflows
Strengths
- Staged flow from requirements interview to planning to durable goals, each stage usable alone
- Named git worktree launches isolate concurrent sessions
- Plans, logs, memory and mode state persist in .omx/ in the project
- Ships a Codex plugin layout alongside the npm CLI
Weaknesses
- Only works on top of Codex CLI, which must be installed and authenticated
- Tuned for macOS/Linux; native Windows and Codex App get less support
- Recommended --madmax flag bypasses Codex approvals and sandbox
- Setup scope and AGENTS.md merge policy rules are involved
What it needs
- no GPU
- Needs Node.js 20+, OpenAI Codex CLI, tmux (recommended on macOS/Linux), git
- Models: OpenAI models via Codex CLI
Quick answers
Is oh-my-codex open source?
Yes. Its code is on GitHub under the MIT license.
Safety checks
Checks passed: 11 of 12 (19 Oct 2026)
Checked commit 840f2a1 ↗ (opens in a new tab) · content sha256:5f29fc39a140…
Changed on 2026-10-18 (commit e62bbe2 → commit b4a0817): check 6 now passes.
- Fail
No advisories at CVSS 7 or higher
Advisories at CVSS ≥ 7: 24 in the repo's lockfile, with a fixed version out. First: @modelcontextprotocol/sdk@1.30.0: GHSA-6qxp-vccf-f47h
GHSA-6qxp-vccf-f47h ↗ (opens in a new tab), GHSA-3jxr-9vmj-r5cp ↗ (opens in a new tab), GHSA-6j4f-fj2g-mc7p ↗ (opens in a new tab)
- Pass
No hardcoded keys or tokens
2 reviewed finding(s) overridden
Corrected after review: Placeholder values in a setup guide ('your-bot-token', channel 123456789012345678).
discord-integration.md:89 ↗ (opens in a new tab), discord-integration.md:110 ↗ (opens in a new tab)
- Pass
No binaries or archives in agent or server folders
No binary or archive in 61 files
- Pass
No dangerous CI workflow
No dangerous workflow pattern and no write-all token in 4 workflows. Note: 2 of 4 workflows set no top-level permissions
- Pass
- Pass
HTTPS endpoints, no credentials in shipped config
No plain-http endpoint or literal credential in 2 files
- Pass
No hidden Unicode in agent-facing text
No hidden Unicode in 61 files
- Pass
No override, concealment or secret-file instructions
No override, concealment or sensitive-path instruction in 55 files
- Pass
A private way to report a vulnerability
Private vulnerability reporting is on
- Pass
- Pass
No fake prerequisite or installer steps
No installer or prerequisite step in 61 files
- Pass
No email recipients added since the last checked version, no hidden BCC
No address added since the check on 2026-10-18 (commit b4a0817) (0 in the code)
N/A: 6 checks do not apply here or had no data
- N/A
Package points back to this repo
Applies to MCP servers only
- N/A
Listed in the official MCP Registry under the owner's name
Applies to MCP servers only
- N/A
Latest release has build provenance
Applies to MCP servers only
- N/A
No install-time scripts
Applies to MCP servers only
- N/A
No shell commands built from input, no unchecked URL opening
Applies to MCP servers only
- N/A
HTTP endpoints check auth or stay on localhost
Applies to MCP servers only
Facts, not pass or fail
- Bundles scripts
- Yes, 1
- Hooks
- Yes
- A bin folder
- No
- MCP config file
- Yes
- Calls other MCP tools
- No
- Domains its agent files link to
- github.com, raw.githubusercontent.com, yeachan-heo.github.io
- Hosts in its code new since the last check
- None
Read on 19 Oct 2026 from the repo's files, npm, PyPI, deps.dev, OSV and the MCP Registry. We ran nothing from the project. N/A means the check does not apply or we could not read its data. Not part of the score: what each check looks at and what it cannot see. A result looks wrong? Tell us on GitHub (opens in a new tab).
Also in Skills, plugins and prompts
See all 308| Rank | Project | Score |
|---|---|---|
| 1 | impeccableDesign skill with 24 slash commands for AI coding agents' frontend output | 96 out of 100 |
| 2 | cavemanCuts token use in coding agents with terse replies and compressed inputs | 95 out of 100 |
| 3 | skillsAgent skills for planning, TDD, debugging and code review | 94 out of 100 |
| #4 | eccAgents, skills, hooks and rules bundle for Claude Code, Codex and other harnesses | 94 out of 100 |
| #5 | oh-my-claudecodeMulti-agent orchestration plugin and CLI for Claude Code | 94 out of 100 |