mrkeyoor.com_
Tue 01 Sept 17:43 UTC
Dev Toolsevaluationupdated 26 Aug 2026

oh-my-codex review

Oh My Codex, usually called OMX, is a workflow and runtime layer around OpenAI Codex CLI. It adds reusable planning and execution skills, persistent task state, worktree isolation, hooks, a terminal HUD, and coordinated agent teams for developers who find the stock CLI too bare.

+81stars / 7d
Verdict

Our oh-my-codex test command hit the 900-second cap with 35 tests passed and none failed, while npm audit reported 6 known vulnerabilities. OMX is worth trying if Codex CLI is already central to your work and you want an opinionated, resumable operating system around it. Stay with stock Codex if the setup footprint, rapid workflow migrations, or prominent sandbox-bypass examples create more process than they remove.

We ran it

Lab card: what happened when we ran oh-my-codexScreenshot of oh-my-codex (oh-my-codex.dev)
Install✓ · 18s200 packages · 144 MB
Build✓ · 11s
Tests✗ timed out · 900s35 passed · 0 failed of 35 (node:test)
Known vulns60 critical · 3 high · 2 moderate · 1 low (npm audit)
Repo1335 files~440,854 lines of source · 20.4 MB · 5 CI workflows

Answers from our run

Does oh-my-codex build from source?

Dependencies installed in 18 seconds (200 packages), and the build succeeded in 11 seconds. We cloned commit 3ad79a8 into a clean Debian container with 3 CPUs and no project-specific setup.

Do oh-my-codex's tests pass?

Yes: 35 of 35 passed when we ran the project's own test command (node:test). Some failures need services or credentials a bare container does not have.

Does oh-my-codex have known vulnerabilities in its dependencies?

npm audit flagged 6 known advisories in the dependency tree at the time of our run.

Who should not use oh-my-codex?

Native Windows or Codex App users who need first-class support: the README says those paths may break and receive less support than macOS or Linux CLI use.

What are the alternatives to oh-my-codex?

Codex CLI, gajae-code, Superpowers. Our oh-my-codex test command hit the 900-second cap with 35 tests passed and none failed, while npm audit reported 6 known vulnerabilities.

Setup3/5Fast install, but setup spans Codex, tmux, hooks, and guidance
Docs4/5Detailed and candid, though the command surface is sprawling
Community5/5Heavy August activity with fixes landing against fresh issues
Maturity3/5Deep runtime work, but minor releases still remove major surfaces

Who it’s for

Experienced Codex CLI users who repeat the same planning, review, and verification routines across projects.
Developers on macOS or Linux who are comfortable with tmux, Git worktrees, and project-level agent instructions.
Teams that need resumable multi-step work with state and logs stored under .omx/.
Codex power users willing to inspect generated guidance and choose execution permissions deliberately.

Who it’s NOT for

Native Windows or Codex App users who need first-class support: the README says those paths may break and receive less support than macOS or Linux CLI use.
Developers who want stock Codex with minimal project scaffolding: OMX installs skills, hooks, configuration, guidance, and runtime state.
Security-sensitive users likely to copy the recommended --madmax launch without understanding it: the README says this flag disables approval and sandbox guardrails.
Teams that require stable workflow names across minor releases: v0.21.0 removed 25 deprecated skills and the MCP state-write tools, albeit with migration errors.
Organizations that require an unambiguous license file: the README says MIT, but GitHub did not detect a license and the repository tree exposed no LICENSE file when checked.

Setup reality

Our npm install succeeded in 18 seconds, adding 200 packages and using 144 MB. The build passed in 11 seconds. Tests reached the 900-second cap; node:test had recorded 35 passes and 0 failures out of 35, but the process did not finish. Npm audit found 6 known vulnerabilities: 3 high, 2 moderate, and 1 low.

OMX needs Node.js 20 or newer plus an installed and authenticated Codex CLI. Its recommended team runtime also needs tmux on macOS or Linux. Setup writes project or user guidance, hooks, configuration, and .omx/ state; a real omx exec request is required to verify authentication.

The recommended --madmax flag disables Codex approval and sandbox protections, so use it only in a trusted, isolated worktree. Native Windows and Codex App are secondary paths. Updates can rerun setup and migrate installed skills, making release notes part of normal operation.

OMX adds a workflow system around Codex CLI

Oh My Codex does not replace the coding model or command-line agent. Codex still edits files and runs commands. OMX adds named skills for clarification, planning, durable execution, team coordination, code review, and QA, then stores plans, logs, and runtime state under .omx/. This is useful when a developer has outgrown one prompt followed by improvised follow-ups and wants a repeatable way to move from a vague request to checked work.

The canonical path in v0.21.0 runs deep interview, consensus planning, and durable goal execution, with team workers available when the work can be divided. Each stage can also run alone. That flexibility is sensible, but the vocabulary is substantial: $ralplan, $ultragoal, $team, missions, HUDs, hooks, roots, and state repair all appear in the main README. New users have to learn OMX's mental model alongside Codex itself.

The safer value is isolation, while --madmax removes safeguards

Named Git worktrees are one of OMX's best defaults. A task can run in a separate checkout, concurrent sessions get distinct roots, and the main working tree is less likely to collect overlapping edits. Team mode also gives workers separate worktrees. The runtime fails closed when two ordinary sessions try to own the same pointer, which is preferable to silently mixing their state.

The recommended launch examples often pair that isolation with --madmax. OMX defines the flag as Codex's --dangerously-bypass-approvals-and-sandbox, so it removes the boundary that would normally stop an agent before risky commands. A worktree limits source collisions, not filesystem, credential, network, or external-service damage. Developers should first run OMX with normal protections and only enable bypass mode inside an environment built to contain it.

What happened when we ran it

Our sandbox cloned commit 3ad79a8 into an unprivileged container with 3 CPUs and 8 GB of RAM. Npm installed 200 packages in 18 seconds and used 144 MB on disk. The build succeeded in 11 seconds. Npm audit reported 6 known vulnerabilities, split into 3 high, 2 moderate, and 1 low. Those advisories need package-level review before OMX is placed in a trusted developer environment.

The test command did not complete within 900 seconds. Node's test runner had recorded 35 passes and 0 failures out of 35 when the harness stopped it. The last visible output showed the notify fallback delivery protocol wiring suite passing, including its durable-delivery routing case. That is not a clean test pass because the process never exited, and the tail does not reveal what kept it alive. It is also not evidence of a failed assertion.

The repository was much larger than the global install suggests: 1,335 files, roughly 440,854 lines of source, and 20.4 MB checked out. Our scan found 5 CI workflow files and no Dockerfile or conventional tests directory. The test command still discovered tests elsewhere in the project. Contributors should expect a runtime-heavy TypeScript codebase rather than a small collection of prompt files.

Setup changes project guidance and runtime state

OMX requires Node.js 20 or newer, a working Codex CLI, and authentication visible in the same shell. The docs make a useful distinction between omx doctor, which checks local wiring, and a real omx exec request, which proves the active profile can authenticate and complete a call. Team mode is tuned for macOS or Linux with tmux. Native Windows can use psmux, though the README calls Windows a secondary path and recommends WSL2.

Project setup can merge generated OMX sections into AGENTS.md, install skills and hooks, write .codex/config.toml, and preserve choices in .omx/setup-scope.json. That is far more invasive than installing a command. The documented merge markers and uninstall behavior reduce the risk, yet a team should review the diff after every setup refresh. Existing global instructions are especially sensitive because one broad AGENTS.md can affect unrelated repositories.

v0.21.0 shows both maintenance speed and interface churn

GitHub recorded a push on August 26, 2026, four days after v0.21.0. Current bug reports about session cleanup and a macOS symlink failure already had linked fixes under review that day. GitHub showed 7 combined issues and pull requests, so the queue was small and moving. The project is plainly active.

The same release removed 25 deprecated skills and two MCP state-writing tools. Migration stubs point users toward replacement skills, and omx doctor --repair-state handles stale projections, which is better than silent breakage. Still, this is meaningful interface churn in a minor release. Automation that invokes skill names or MCP tools should pin a version and treat upgrades like code migrations.

The license signal needs a real file

The README labels OMX as MIT, but GitHub's repository metadata returned no detected license and the fetched tree did not expose a LICENSE file. A badge and a final README heading are weaker than license text attached to the repository. Individual developers may accept the stated intent; companies distributing or embedding the tool should ask for the missing file before relying on MIT permissions.

OMX is best for a narrow type of user: someone who already understands Codex, Git, tmux, agent permissions, and the cost of extra orchestration. For that person, durable state and worktree-aware teams solve real problems. For everyone else, stock Codex plus a few carefully chosen skills is easier to audit, easier to upgrade, and less likely to turn the workflow layer into the main project.

Alternatives

ProjectWhat it isPick it when
Codex CLI gh↗The underlying coding agent without OMX's workflow and runtime layer.pick this instead when built-in planning, skills, and collaboration are enough and you want fewer files and hooks.
gajae-codeA lighter SDK-based route from the OMX author for Codex-powered integrations.pick this instead when OMX feels too large and you need a simpler integration layer rather than a terminal workflow system.
Superpowers gh↗A portable set of software-development skills and workflows for coding agents.pick this instead when disciplined skills matter more than tmux teams, HUDs, and OMX state machinery.

What people are saying

  1. [velocity-scout] Yeachan-Heo/oh-my-codex

Sources

  1. Oh My Codex README
  2. Oh My Codex v0.21.0 release
  3. Oh My Codex agents reference
  4. macOS symlink session issue

More dev tools reviews

workmux · v2rayNG · SecLists · hashcat · eslint · fastfetch · the whole board →