Codex CLI Cheat Sheet: Every Command & Config Key (2026)
codex opens an interactive session, codex exec runs headless for CI, type / inside a session for the full slash-command list, and codex --help or ? shows every command for your installed version. This page is a scannable reference: top-level commands, global flags, slash commands by category, the config.toml keys that actually matter, MCP setup, sandbox/approval modes, and the real (short) list of keyboard shortcuts.
- Codex CLI ships new versions near-monthly and the exact command roster can shift; everything below was cross-checked against the official docs at the time of writing - run codex --help, /, or ? in your own install before depending on an exact flag name.
What this cheat sheet covers
This is the Codex CLI only - the terminal tool you run with codex. It does not cover the ChatGPT desktop app or the VS Code/JetBrains IDE extension; those ship different shortcut sets and some pages online blend all three together, which makes their "keyboard shortcuts" sections misleading. If you're brand new to Codex, start with what OpenAI Codex is first.
One disambiguation worth stating plainly since the names collide: OpenAI Codex (this CLI) is not AgentKit (agentkit.best, a paid third-party add-on that runs inside Codex) and neither is OpenAI's own AgentKit (its separate Agent Builder product, itself being wound down per OpenAI's 2026-06-03 deprecation notice). This page is about the free CLI; AgentKit gets one honest mention near the end.
Everything is grouped so you can jump straight to what you need: commands and flags first, then the largest section (slash commands, since that's how most day-to-day control actually happens), then config keys, MCP, sandbox/approval, and finally the honest shortcuts list.
Install & sign in - quick commands
Codex CLI is open-source (Rust) and installs with a single script on macOS, Linux, or Windows.
| Command | What it does |
|---|---|
curl -fsSL https://chatgpt.com/codex/install.sh | sh | Installs the CLI (mac/Linux; also works via WSL/Git Bash on Windows). |
codex login | Signs in with your ChatGPT account in the browser. |
codex login --device-auth | Device-code sign-in for headless machines (SSH boxes, containers). Not independently re-confirmed against a primary page this session - verify against codex login --help before relying on the exact flag. |
codex logout | Signs out and clears the local auth token. |
Once installed, run codex --version to confirm it worked, then codex alone to drop into your first interactive session. For a full walkthrough of every install path, including proxy/corporate-network edge cases, see how to install the Codex CLI.
Top-level CLI commands
These are the commands you type directly after codex.
| Command | What it does | Example |
|---|---|---|
codex | Opens an interactive session in the current project. | codex |
codex exec | Runs one prompt headlessly, no TUI - built for scripts and CI. | codex exec "add a health-check route" |
codex resume | Reopens a previous session. | codex resume |
codex login | Signs in to your ChatGPT account. | codex login |
codex mcp | Manages MCP server connections. | codex mcp add docs -- npx -y mcp-server-docs |
codex cloud | Opens/manages Codex Cloud sandbox tasks. | codex cloud |
codex apply | Applies a diff produced by a Codex Cloud task to your local checkout. | codex apply <task-id> |
codex doctor | Diagnostic check of your install/config. Added around v0.131.0 per a third-party source, not a primary doc - confirm it exists in your version with codex --help. | codex doctor |
codex features enable <flag> | Turns on a feature-flagged capability (e.g. goal mode). | codex features enable goals |
Global flags (work on most commands)
| Flag | What it does |
|---|---|
-m, --model | Overrides the model for this run. |
-s, --sandbox | Sets the sandbox mode (see the matrix below). |
-a, --ask-for-approval | Sets the approval policy for this run. |
-p, --profile | Loads a named profile from config.toml. |
-c, --config key=value | Overrides a single config key inline, no file edit. |
-i, --image | Attaches an image to the prompt. |
--search | Enables the live web-search tool for this run. |
-C, --cd | Runs against a different working directory. |
--add-dir | Grants read/write access to an extra directory outside the project root. |
--oss | Runs against a local open-weight model instead of the hosted one. |
--local-provider | Points Codex at a self-hosted/local model provider. |
codex exec for CI/CD
codex exec is the headless entry point for pipelines. A typical CI call:
codex exec --json --sandbox workspace-write --ephemeral \
--skip-git-repo-check \
"Fix the failing test in tests/auth.spec.ts and summarize the change"| Flag | What it does |
|---|---|
--json | Emits structured JSON events instead of TUI output. |
-o, --output-last-message | Writes only the final message to a file - easy to grab in a pipeline step. |
--output-schema | Forces the final message to match a JSON schema you supply. |
--ephemeral | Doesn't persist the session/history after the run. |
--skip-git-repo-check | Runs even if the working directory isn't inside a git repo. |
--ignore-rules | Skips the project's normal rule/lint checks for this run. |
Dangerous flags - isolated CI runner only:
--dangerously-bypass-approvals-and-sandbox(alias--yolo) and--dangerously-bypass-hook-trustremove the sandbox and approval gate entirely. Never run these on a machine with real credentials or production access - use them only in a throwaway, isolated CI container.
Slash commands (categorized)
Type / inside a session to see the live list for your version - this table groups the common ones. The five most-used day to day: /review, /goal, /permissions, /compact, and /mcp.
| Command | Group | What it does |
|---|---|---|
/clear | Session & context | Starts a new context, keeps the session. |
/compact | Session & context | Manually compresses context to free up room. |
/new | Session & context | Starts a brand-new session. |
/resume | Session & context | Reopens a previous session from within the TUI. |
/rename | Session & context | Renames the current session. |
/archive | Session & context | Archives the current session. |
/delete | Session & context | Deletes a session. |
/diff | Session & context | Shows the current working diff. |
/copy | Session & context | Copies the last response to your clipboard. |
/status | Session & context | Shows session and usage status. |
/model | Model, permissions & personality | Switches the active model. |
/permissions | Model, permissions & personality | Views or edits the sandbox/approval policy live. |
/personality | Model, permissions & personality | Changes the response tone/style. |
/sandbox-add-read-dir | Model, permissions & personality | Grants read access to an extra directory for this session. |
/review | Review & goals | Runs a code-review preset (diff, uncommitted, a commit, or custom). |
/goal | Review & goals | Starts goal mode - a long, persistent execution loop. |
/plan | Review & goals | Drafts a plan before Codex starts executing. |
/mcp | Extend | Manages MCP server connections from inside the session. |
/skills | Extend | Lists and manages installed skills. |
/hooks | Extend | Shows configured hooks. |
/apps | Extend | Manages connected apps/integrations. |
/plugins | Extend | Manages plugin-marketplace installs. Newer, third-party-sourced syntax - treat as less stable, verify live. |
/agent | Extend | Dispatches a subagent for a scoped sub-task. |
/import | Extend | Imports context from a file or URL. |
/keymap | Interface & utility | Remaps keyboard shortcuts. |
/vim | Interface & utility | Toggles vim-style keybindings for input. |
/theme | Interface & utility | Changes the color theme. |
/ide | Interface & utility | IDE-integration commands. |
/raw | Interface & utility | Sends raw input, bypassing normal parsing. |
/experimental | Interface & utility | Toggles experimental/feature-flagged behavior (incl. goal mode). |
/debug-config | Interface & utility | Prints the effective, fully merged config. |
/feedback | Interface & utility | Sends feedback to OpenAI. |
/exit | Interface & utility | Quits Codex. |
Key config.toml keys
Codex reads config from ~/.codex/config.toml by default. Four keys matter most day to day:
| Key | Values | What it does |
|---|---|---|
model | e.g. gpt-5.6-terra | Default model tier for new sessions. |
sandbox_mode | read-only / workspace-write (default) / danger-full-access | What the filesystem/network access looks like by default. |
approval_policy | untrusted / on-request / never | When Codex must stop and ask before acting. |
project_doc_max_bytes | integer, default 32768 (32 KiB) | Combined size cap for AGENTS.md files - anything over is silently dropped. |
project_doc_fallback_filenames | list of filenames | Alternate files Codex reads if no AGENTS.md is found. |
web_search | true/false | Allows the live web-search tool. |
model_reasoning_effort | low/medium/high | How much reasoning depth to spend per request. |
[features] | table of flags | Feature-flag block, e.g. goals = true for goal mode. |
Precedence order: CLI flags > project config > profile > user config. A -c key=value flag always wins; a project-level config.toml beats your personal one. For the full AGENTS.md merge rules (and the 32 KiB cap in more detail), see AGENTS.md for Codex.
MCP - connect a server in one command
Add a server from the CLI:
codex mcp add docs --env API_KEY=$DOCS_KEY -- npx -y mcp-server-docsThat writes the matching block into ~/.codex/config.toml:
[mcp_servers.docs]
command = "npx"
args = ["-y", "mcp-server-docs"]
env = { API_KEY = "..." }Codex is an MCP client only - it connects to servers, it doesn't expose one. Once added, a server's tools show up automatically in your next session; use /mcp to confirm it's connected before relying on it mid-task. For the full setup guide, see connecting your first MCP server in Codex.
Sandbox & approval - quick matrix
| sandbox_mode ↓ / approval_policy → | untrusted | on-request | never |
|---|---|---|---|
| read-only | Asks before almost anything. | Asks only for risky reads. | Never asks; can only read. |
| workspace-write (default) | Asks before writes outside the sandbox. | Asks only when it needs more than the workspace. | Writes freely inside the workspace, no prompts. |
| danger-full-access | Asks before destructive/system-level actions. | Asks rarely, mostly for irreversible actions. | Full access, zero prompts - use with real caution. |
Default install behavior is workspace-write + on-request - the middle row, middle column above. Most people never need to touch the other eight combinations, but knowing they exist matters the first time Codex asks for a permission you didn't expect. For what each mode actually allows in practice, see Codex sandbox and approval modes explained.
Keyboard shortcuts (the short, honest list)
Codex CLI leans on slash commands, not hotkeys - the real CLI-only shortcut list is short. If a page online lists a dozen-plus "Codex keyboard shortcuts," it's likely blending in the desktop app or IDE extension.
| Key | Action |
|---|---|
Ctrl+C | Cancel the current turn. |
Ctrl+D | Exit Codex. |
Ctrl+J | Insert a newline in the input box. |
Ctrl+L | Clear the screen. |
Ctrl+R | Reverse history search. Version-gated (~v0.121.0+ per a third-party source) - verify in your install. |
Esc | Interrupt the current turn. |
Esc Esc | Undo the last action. |
Tab | Queue a follow-up message while Codex is still working. |
Enter | Send the message. |
Want different bindings? Run /keymap to remap.
AGENTS.md & Skills - where to go deeper
Codex reads project instructions from AGENTS.md, not CLAUDE.md - see the full merge/override rules in AGENTS.md for Codex. Reusable, cross-compatible workflows live in SKILL.md files - see Codex Skills explained.
Add ready-made workflows on top
Codex CLI itself is free inside your ChatGPT plan. If you'd rather not assemble your own workflows, AgentKit adds prebuilt skills and workflows on top via ak kit init engineer --target codex --global, then $ak:cook inside a session - it's a paid add-on, not part of Codex itself. See AgentKit →
Quick answers
How do I see every command for my exact version?
Run codex --help from the terminal, or type / inside a session for the live slash-command list.
How do I check what config actually loaded?
Run /debug-config inside a session - it prints the fully merged config after precedence is applied.
Where does Codex store its config?
Inside CODEX_HOME, default ~/.codex - holding config.toml, auth.json, and history.jsonl. Point the environment variable elsewhere to use a different directory.
How do I update the CLI?
No self-update subcommand was independently confirmed this session - the safest path is re-running the install script (curl -fsSL https://chatgpt.com/codex/install.sh | sh), then checking codex --version.
Why does a command from another article not show up here?
This roster reflects what was confirmed in the official docs and cross-checked at time of writing. Codex ships near-monthly, so a newly added command or a renamed flag can lag behind any static page, this one included - codex --help and / in your own install are always the source of truth.
Conclusion
Install, type / for commands, check ? or codex --help for shortcuts, and bookmark this page - the roster shifts often enough that it's worth a re-check each time you update. New to Codex entirely? Start with what OpenAI Codex is, then install the CLI.