codex — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited codex (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A harness wraps a model. A rig wraps your harnesses. Define your agent team in YAML, boot it with one command. Claude Code and Codex in the same rig, managed as one system.
OpenRig turns AI coding agents from a pile of terminal sessions into a persistent, organized team. A rig is the team that doesn't go away. If you've got tabs full of agents you're afraid to close, this is the layer you're missing: it's open source, it's local, and you're four commands away.
npm install -g @openrig/cli
rig setup
rig up product-team
rig ui open
It runs locally: a daemon, a SQLite database, a CLI, and a dashboard. The agents are ordinary Claude Code and Codex sessions in tmux. product-team is the fuller starter, 7 seats, 4 Claude and 3 Codex, with an orchestration HA pair plus development and review pods.
Because 4 Claude seats run at once, single-plan users should expect provider throttling. For the light-footprint path, use conveyor, a 4-seat starter with 2 Claude and 2 Codex.
# Preview the smaller starter
rig specs preview conveyor
# Boot the light-footprint path
rig up conveyorAfter product-team boots, rig ps --nodes shows the running pods and seats. When you're ready to shut the team down and bring it back, use the same rig name:
rig ps
rig down product-team
rig up product-teamrig ps is a fleet glance. rig down product-team snapshots the team and stops it. rig up product-team brings it back by name from that snapshot.
OpenRig is a multi-agent harness — it manages the system that coding agents form when you run them together. Not the agents themselves, but the team they create: which sessions are running, how they relate, how to recover after a reboot, and how to stop it from becoming terminal sprawl.
rig up — tmux sessions, harnesses, startup files, readiness checksrig down, restore by name with rig up <name>rig send, rig broadcast, and rig chatroomrig expand, rig shrink, rig launch, rig removeEvery agent runs in a tmux session you can attach to, inspect, and work with directly.
OpenRig's hero starter is product-team, the fuller product-development rig:
rig specs preview product-team
rig up product-teamUse it when you want the week-one experience OpenRig is built around: an orchestrator HA pair, development work, review work, and enough moving pieces for the coordination layer to matter.
For a smaller starter, use conveyor:
rig specs preview conveyor
rig up conveyorconveyor is the smallest shippable software factory, one command. It keeps the footprint lower for single-plan users while still showing a real handoff path through intake, planning, build, and review.
Also ships: implementation-pair, adversarial-review, research-team, and secrets-manager (HashiCorp Vault managed by a specialist agent).
Browse the library:
rig specs lsOpenRig is a local daemon + CLI + MCP server + React UI, built on tmux.
CLI / UI / MCP
|
Hono HTTP daemon
|
Domain services
|
SQLite + tmux + runtime adaptersrig_up, rig_ps, rig_send, rig_chatroom_send, etc.)rig discover fingerprints existing tmux sessions. rig adopt brings them under management.rig down --snapshot captures full state. rig up <name> restores from latest snapshot. Restore reports per-node outcomes (resumed, fresh, or failed).A rig can package actual software alongside the agents that manage it. The shipped example is secrets-manager: a HashiCorp Vault instance operated by a specialist agent.
rig up secrets-manager
rig env status secrets-manager
rig send vault-specialist@secrets-manager "Check Vault health and report status." --verifyRequires Docker for service-backed rigs.
Optional:
Open CMUX node surface controlsrig setup attempts core machine preparation: tmux, cmux, Claude Code, Codex, and tmux defaults. It reports what it tried and what actually succeeded. If something fails, it gives the local agent enough context to finish the job.rig setup --full attempts a broader operator workstation setup (jq, gh) on top of core.rig doctor inspects current system health and helps diagnose problems after setup. Use it when something stops working or after machine changes.Both commands support --json for agent-driven workflows.
Managed runtime boot (during rig up) may modify runtime config for core bootstrap and spec-selected runtime resources. rig setup discloses these paths so agents know what may be changed:
~/.claude/settings.json for minimal OpenRig command allowlisting~/.claude.json for managed workspace trust and onboarding completion.claude/settings.local.json for context collector/activity hooks and selected claude_settings_fragment resources.mcp.json for selected claude_mcp_fragment resources~/.codex/config.toml for workspace trust and selected codex_config_fragment resourcesAlready-running adopted sessions may need restart before they pick up newly written runtime config.
For agents: Ask the user whether they want core setup (rig setup) or the fuller workstation path (rig setup --full) before choosing the invocation. Inspect the result with --json and use rig doctor to finish any remaining machine-specific issues.
Anthropic shipped Claude Managed Agents — a cloud-hosted, Claude-only runtime at $0.08/session-hour. OpenRig is the local side: open source, cross-harness, runs on your machine, costs nothing.
Apache 2.0
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.