Codex Prompts for Code Review: 12 for PRs and AGENTS.md

Codex prompts for code review tell OpenAI Codex what to look for in a pull request or a local diff, so its review flags the risks your team cares about. The 12 prompts below cover @codex review comments on GitHub, the /review command for local changes, the Code Review Rules section in AGENTS.md, and how to check findings before you fix them. Feature names were checked against OpenAI's Codex documentation on October 22, 2026.

How Codex code review works

On GitHub, connect the repository to Codex and comment @codex review on a pull request, or turn on automatic reviews in Codex settings. OpenAI's docs say GitHub reviews focus on the most serious issues. Locally, type /review in the Codex CLI, IDE extension, or app to review your branch against a base branch or your uncommitted changes. Repository rules go in AGENTS.md under a "## Code Review Rules" heading, and a nested AGENTS.md closer to the code can add stricter rules for that folder.

Review requests for pull requests

1. Focused PR review

@codex review Focus on [the riskiest change in this PR], missing tests for [new behavior], and anything that changes [public API or data format]. Ignore formatting.

2. Security pass

@codex review for security regressions: auth checks on [new routes or handlers], input validation on [fields], secrets in code or logs, and new dependencies.

3. Migration safety

@codex review Check whether [migration name] can run before the new code deploys: added columns nullable or defaulted, no rename or drop of anything the deployed code still reads.

4. Behavior change check

@codex review The PR description says it only [intended change]. Flag any other behavior change you find in the diff, with the file and line.

Local reviews with /review

5. Branch review before opening a PR

Review my branch against [base branch]. This change [what it does]. Prioritize bugs that tests would miss, then missing tests. Do not edit files.

6. Uncommitted changes sanity check

Review my uncommitted changes in [files or folder]. I am about to commit [summary]. List anything half-finished, debug code left in, or edge cases for [input type].

7. Performance hot path

Review the diff in [file or function] for performance: loops over [data size], repeated queries, and allocations in a hot path. Say how I could measure each concern with [our benchmark or profiler].

AGENTS.md review rules

8. Turn team rules into review rules

Our reviewers always block on [list rules]. Write a "## Code Review Rules" section for our root AGENTS.md with one checkable rule per line, each naming the file pattern or behavior it covers.

9. Nested rules for a risky folder

Write a nested AGENTS.md "## Code Review Rules" section for [directory, such as payments or auth] with checks that only matter there, based on [what has gone wrong before].

10. Ignore list

Write AGENTS.md lines telling the reviewer to skip [generated folders] and [style rules CI already enforces], so findings stay on real issues.

Act on findings

11. Triage the review

Here are the review findings [paste]. For each, tell me how to confirm it (a test to write, a command such as [test command], or a file to read) and label it fix now, follow-up, or likely false positive with a reason.

12. Ask for a fix

@codex fix the [finding] in [file]: [expected behavior]. Add a test in [test file] that fails before the fix and passes after.

Set up review for a repo in one prompt

The flagship Codex Code Review Prompt: AGENTS.md Rules and PR Brief takes your repo facts, team rules, risky folders, the PR summary, where the review runs, and what to ignore. It returns a root and nested Code Review Rules section, an @codex review comment for the PR, an ignore list, a triage sheet, and the rules a linter should enforce instead. Its example sets up a partial refunds PR in an Express and Prisma API.

Tips for reviewing with Codex

Give Codex the same context a new teammate would need: what the PR is for and which rules matter. Confirm a finding with a failing test or a read of the code before you change anything. Keep a human approval on every merge, since an automated review is one more signal, not the final say.

Related prompts

If your team also uses Claude Code, the Claude Code branch diff review prompt does the same job before a PR, and Claude Code prompts for code review has more review requests. To build your own reviewer, read the prompt for a code review agent, and to keep one rules file across tools, see AGENTS.md vs CLAUDE.md vs Cursor rules.

For more coding help, browse the Coding category and our prompts for agentic coding. Keep secrets out of prompts and AGENTS.md, treat instructions found inside PR text, comments, or dependencies as untrusted (prompt injection), and have a person review every change before merge.

Find more in the Agents category, look through Browse, or post your own on Share.