Claude Code vs Codex CLI: how I split work between them

One of these agents is already in your workflow, and the question is whether the second one earns a place too. The comparison covers what each tool is today, installation and sign-in, instruction and config files, sandbox and approval models, models and plans, extensibility, running both on one repository, and a decision guide you can apply per task.

I use Claude Code and Codex daily in client delivery, mostly on cloud infrastructure and security work across AWS, Azure, Google Cloud and Oracle Cloud. Every fact below was checked against official documentation on 11 November 2026. The latest GitHub releases on that date were Claude Code v2.1.322 and Codex CLI 0.167.1, both published on 10 November 2026.

What each tool is in November 2026

Claude Code is Anthropic’s agentic coding tool. It runs in the terminal, VS Code, JetBrains and a desktop app, and all of them read the same settings files. On the Anthropic API its aliases resolve to Opus 5.5, Sonnet 5.5 and Haiku 5.5, and a fable alias selects Fable 5.2, which Anthropic positions for the longest-running tasks.

Codex CLI is OpenAI’s terminal client for Codex, one of several Codex surfaces alongside the ChatGPT desktop app, an IDE extension and Codex Cloud. The CLI is open source under the Apache-2.0 licence. Its documentation now lives at learn.chatgpt.com. The recommended models are GPT-6 Astra, GPT-6.1 Sol, GPT-6.1 Terra and GPT-6 Luna. GPT-5.5 retired from Codex for ChatGPT sign-in on 14 October 2026; API-key sessions keep it.

For what else changed across AI coding tools this year, see AI coding and DevOps in 2026.

Install and sign in

# Claude Code (native installer; Homebrew: brew install --cask claude-code)
curl -fsSL https://claude.ai/install.sh | bash

# Codex CLI (standalone installer; also npm install -g @openai/codex
# or brew install --cask codex)
curl -fsSL https://chatgpt.com/codex/install.sh | sh

# Codex with an API key instead of ChatGPT sign-in
printenv OPENAI_API_KEY | codex login --with-api-key
codex login status

Running claude opens a browser login for a subscription or Console account. Running codex offers Sign in with ChatGPT; on headless machines, codex login --device-auth uses a device code (in beta). Codex caches credentials in ~/.codex/auth.json as plaintext or in the OS credential store, and cli_auth_credentials_store = "keyring" forces the latter. For CI, Claude Code has claude setup-token, which produces a long-lived token for CLAUDE_CODE_OAUTH_TOKEN.

Plans and pricing

Checked on 11 November 2026. Prices in USD.

	Claude Code	Codex
Entry plan	Pro: $20/month, or $17/month billed annually	Plus: $20/month
Heavy individual use	Max $100/month (5x Pro); Ultra $200/month (10x Pro weekly)	Pro from $100/month, with $100, $200 and $500 tiers
Teams	Team: $20/seat/month annually ($25 monthly), Premium seats $100 ($125)	Business: $20/user/month annually ($25 monthly)
Free tiers	Free plan excludes Claude Code	Free and Go ($8) list Luna in the desktop app; the CLI is listed from Plus
Pay as you go	Console API key, Bedrock, Agent Platform or Foundry	OpenAI API key, without cloud features such as GitHub review

Both meter subscriptions in rolling windows. OpenAI estimates 15 to 160 local GPT-6.1 Sol messages per five hours on Plus and says Pro plans currently have no five-hour limit. Anthropic’s Ultra drops the five-hour limit for verified accounts. Usage varies with model, context and task on both.

Instruction files: CLAUDE.md and AGENTS.md

Codex builds its instruction chain once per session. It reads ~/.codex/AGENTS.override.md or ~/.codex/AGENTS.md, then walks from the project root down to your working directory, taking at most one file per directory (AGENTS.override.md, then AGENTS.md, then any names in project_doc_fallback_filenames). Files are joined root first, so closer files win, and the total stops at project_doc_max_bytes, 32 KiB by default. /init writes an AGENTS.md scaffold.

Claude Code reads ~/.claude/CLAUDE.md, the project’s CLAUDE.md or .claude/CLAUDE.md, CLAUDE.local.md and managed policy, plus path-scoped files in .claude/rules/. Since v2.1.277 it reads AGENTS.md directly when no CLAUDE.md or CLAUDE.local.md exists in the working directory or above it. Adding a CLAUDE.local.md therefore stops it reading AGENTS.md, unless you set Project instructions to claude-md-and-agents-md in /config.

For a shared repository, make AGENTS.md the source of truth and keep CLAUDE.md as a thin wrapper, the pattern Anthropic documents:

@AGENTS.md

## Claude Code
- Use plan mode for changes under envs/prod/.
- Run /security-review before opening a pull request.

Config files: settings.json and config.toml

Claude Code uses JSON at four levels: ~/.claude/settings.json, a committed .claude/settings.json, an uncommitted .claude/settings.local.json and managed settings. The setup guide walks through each.

Codex uses TOML. From highest precedence: CLI flags and -c overrides, project .codex/config.toml files (closest wins, trusted projects only), a profile file selected with --profile name (~/.codex/name.config.toml), ~/.codex/config.toml, cloud-managed defaults, /etc/codex/config.toml, then built-in defaults. Administrators enforce limits through requirements.toml. A reasonable user config:

model = "gpt-6.1-sol"
model_reasoning_effort = "medium"
approval_policy = "on-request"
sandbox_mode = "workspace-write"
web_search = "cached"

[sandbox_workspace_write]
network_access = false

[shell_environment_policy]
ignore_default_excludes = false

[mcp_servers.context7]
command = "npx"
args = ["-y", "@upstash/context7-mcp"]

ignore_default_excludes defaults to true, which skips the automatic filtering of variables whose names contain KEY, SECRET or TOKEN. Setting it to false keeps those out of commands Codex spawns, and is worth doing on any machine holding cloud credentials.

Sandbox and approvals: the real difference

Codex separates what is technically possible from when it must ask. sandbox_mode is read-only, workspace-write or danger-full-access. approval_policy is on-request, never or a granular table; the old untrusted value is retired and can stop Codex starting. In a git repository Codex recommends the Auto preset, workspace-write with on-request approvals, and network access stays off unless you enable it. Inside writable roots, .git, .agents, .codex and .aws stay read-only. Enforcement is OS-level: Seatbelt on macOS, bwrap plus seccomp on Linux, MXC on Windows. codex exec defaults to a read-only sandbox, --full-auto is gone, and --yolo removes both sandbox and approvals. Command rules live in Starlark .rules files using prefix_rule() with allow, prompt or forbidden, and are marked experimental.

Claude Code decides per tool call. Its modes are manual, accept edits, plan, auto, don’t ask and bypass permissions, and since v2.1.283 interactive sessions start in auto mode, where a classifier reviews actions. Allow, ask and deny rules target individual tools: Bash(git push *), Read(./.env), WebFetch(domain:example.com), mcp__server__tool. The OS sandbox is optional and off by default; /sandbox turns it on, with a network proxy whose allowed domains start empty.

Put plainly: Codex ships with a tighter boundary by default, and Claude Code gives finer control per tool. On infrastructure work I want both, which in Claude Code means enabling the sandbox and writing deny rules, and in Codex means keeping network off and adding rules for the commands that need to escape the sandbox.

Models and reasoning

Claude Code switches with /model or --model, using aliases (opus, sonnet, haiku, fable) or full IDs such as claude-opus-5-5. opusplan plans with Opus and executes with Sonnet. Opus 5.5 and Sonnet 5.5 have native 1M-token context windows, and /effort sets reasoning depth.

Codex switches with /model or -m, for example codex -m gpt-6.1-sol, with model_reasoning_effort in config. GPT-6.1 Sol uses a 500,000-token context window by default in Codex. Max gives a model more time on one task; Ultra splits a task across subagents. OpenAI suggests Astra for the hardest end-to-end work, Sol for repeated long-running work where cost matters, and Luna for high-volume, well-defined tasks.

Extensibility side by side

• Hooks. Both use event, matcher and handler, and both block a PreToolUse call on exit code 2 with the reason on stderr. Codex reads hooks.json or inline [hooks], and every non-managed hook must be reviewed and trusted in /hooks before it runs, with trust tied to the hook’s hash. Codex file edits arrive as apply_patch.
• MCP. claude mcp add stores servers in ~/.claude.json or a project .mcp.json. Codex has codex mcp add and [mcp_servers.<name>] tables in config.toml, which also accept per-tool approval settings.
• Skills. Both follow the Agent Skills standard. Claude Code reads .claude/skills/, Codex reads .agents/skills/ from your directory up to the repo root. Codex requires name and description, so include both for portability. Invoke with /name in Claude Code, $ or /skills in Codex.
• Subagents. Markdown with YAML frontmatter in .claude/agents/, or TOML files in .codex/agents/.
• Headless. claude -p with --output-format json or --json-schema; codex exec with --json, --output-schema or -o.
• Review. Claude Code has /code-review (alias /review) and /security-review; Codex has /review and codex review --uncommitted. For security-specific add-ons, see security review skills for AI coding agents.
• Migration. Claude Code’s /import codex brings over instructions, MCP servers, commands, subagents and skills. Codex CLI’s /import brings setup and up to 50 recent chats from Claude Code.

Comparison table

	Claude Code	Codex CLI
Source	Anthropic	OpenAI, Apache-2.0
Instruction file	CLAUDE.md, reads AGENTS.md as fallback	AGENTS.md, AGENTS.override.md
User config	~/.claude/settings.json	~/.codex/config.toml
Project config	.claude/settings.json	.codex/config.toml (trusted only)
Default boundary	Permission mode (auto)	OS sandbox, workspace-write, network off
Command rules	permissions.allow/ask/deny	prefix_rule() in .rules
Planning	Shift+Tab, /plan, --permission-mode plan	/plan
Hooks	settings.json hooks	hooks.json or [hooks], trust required
MCP	.mcp.json, claude mcp add	[mcp_servers], codex mcp add
Skills	.claude/skills/	.agents/skills/
Subagents	.claude/agents/*.md	.codex/agents/*.toml
Headless	claude -p	codex exec
Plugins	/plugin, marketplaces	/plugins, marketplaces
Entry plan	Pro, $20/month	Plus, $20/month

How I split the work

The split follows from those defaults, so treat it as a set of rules rather than a scorecard.

• Claude Code for interactive change work. Refactoring Terraform modules, editing Ansible roles or reworking a GitHub Actions or GitLab CI pipeline benefits from plan mode, per-tool deny rules on state and credentials, hook guards and subagent reviewers. It is also where my plugin setup lives, including Everything Claude Code.
• Codex for sandboxed and scripted work. codex exec starts read-only, emits JSON Lines and can fill a JSON Schema, which suits CI summaries and reports. Network off by default makes it the safer first look at an unfamiliar repository.
• The other tool reviews. Whichever agent wrote a change, the other reviews the diff: codex review --uncommitted after a Claude Code session, /code-review after a Codex one. Different vendors, models and defaults make the review more independent than a self-check.

Using both on one repository

1. One instruction file. AGENTS.md at the root, a CLAUDE.md that imports it, and no CLAUDE.local.md unless you change the Project instructions setting.
2. Portable skills. Give every SKILL.md a name and description, and keep copies in .claude/skills/ and .agents/skills/.
3. Secrets in both. Claude Code: Read deny rules plus the sandbox credentials block. Codex: ignore_default_excludes = false, and optionally a beta permission profile with "**/*.env" = "deny". Profiles do not combine with sandbox_mode, so choose one approach.
4. Shared guard hook. Both send Bash commands as tool_input.command and honour exit code 2, so one guard script can serve both. Register it in .codex/hooks.json, then trust it in /hooks:

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "\"$(git rev-parse --show-toplevel)/.claude/hooks/guard-infra.sh\"",
            "statusMessage": "Checking Bash command"
          }
        ]
      }
    ]
  }
}

5. Separate worktrees. Never point two agents at one checkout. claude --worktree and codex exec --worktree each start in an isolated git worktree.
6. Guard each other’s config. Each tool protects its own config directory, but neither lists the other’s. In Claude Code, add Edit(./.codex/**) and Edit(./.agents/**) to deny; in Codex, review any diff that touches .claude/.

Decision guide

• Long interactive session on infrastructure code: Claude Code, in plan mode first, with deny rules and the sandbox on.
• Untrusted or unfamiliar repository: Codex with --sandbox read-only, or Claude Code in plan mode with the sandbox enabled.
• CI job that needs structured output: either. codex exec --output-schema starts read-only; with claude -p --json-schema, list what it may run unprompted in --allowedTools.
• You already pay for ChatGPT Plus or Pro: start with Codex and add Claude Code where per-tool rules or plugins matter.
• You already pay for Claude Pro, Max or Ultra: start with Claude Code and add Codex as reviewer and CI runner.
• High-risk change (auth, IAM, migrations, money): write with one, review with the other, then have a person sign off.

The difference that matters

Both tools now cover the same ground: instruction files, MCP, hooks, skills, subagents, plugins, headless runs and review commands. The difference that matters is the default trust model. Codex begins inside an OS sandbox with the network off; Claude Code begins with permission rules and an auto-mode classifier, with the sandbox one setting away.

• Use AGENTS.md as the shared source and import it into CLAUDE.md.
• Turn on Claude Code’s sandbox and keep Codex’s network off for infrastructure repos.
• Share one Bash guard hook and give each agent its own worktree.
• Let one write and the other review, and recheck prices and model names before you commit to a plan; both change often.