
Research
/Security News
11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload
11 malicious NuGet tools pose as game cheats to deploy Windows payloads, track hosts, and use Google Sheets for telemetry and control.
@claude-flow/codex
Advanced tools
OpenAI Codex CLI adapter for Claude Flow V3. Enables multi-agent orchestration with self-learning capabilities for OpenAI Codex CLI following the Agentic AI Foundation standard.
┌─────────────────────────────────────────────────────────────────┐
│ CLAUDE-FLOW = ORCHESTRATOR (tracks state, stores memory) │
│ CODEX = EXECUTOR (writes code, runs commands, implements) │
└─────────────────────────────────────────────────────────────────┘
Codex does the work. Claude-flow coordinates and learns.
# Initialize for Codex (recommended)
npx claude-flow@alpha init --codex
# Full setup with all 137+ skills
npx claude-flow@alpha init --codex --full
# Dual mode (both Claude Code and Codex)
npx claude-flow@alpha init --dual
| Feature | Description |
|---|---|
| AGENTS.md Generation | Creates project instructions for Codex |
| MCP Integration | Self-learning via memory and vector search |
| 137+ Skills | Invoke with $skill-name syntax |
| Vector Memory | Semantic pattern search (384-dim embeddings) |
| Dual Platform | Supports both Claude Code and Codex |
| Auto-Registration | MCP server registered during init |
| HNSW Search | 150x-12,500x faster pattern matching |
| Self-Learning | Learn from successes, remember patterns |
When you run init --codex, the MCP server is automatically registered with Codex:
# Verify MCP is registered
codex mcp list
# Expected output:
# Name Command Args Status
# claude-flow npx claude-flow mcp start enabled
If MCP is not present, add manually:
codex mcp add claude-flow -- npx claude-flow mcp start
| Tool | Purpose | When to Use |
|---|---|---|
memory_search | Semantic vector search | BEFORE starting any task |
memory_store | Save patterns with embeddings | AFTER completing successfully |
swarm_init | Initialize coordination | Start of complex tasks |
agent_spawn | Register agent roles | Multi-agent workflows |
neural_train | Train on patterns | Periodic improvement |
memory_search
{
"query": "search terms",
"namespace": "patterns",
"limit": 5
}
memory_store
{
"key": "pattern-name",
"value": "what worked",
"namespace": "patterns",
"upsert": true
}
swarm_init
{
"topology": "hierarchical",
"maxAgents": 5,
"strategy": "specialized"
}
1. LEARN: memory_search(query="task keywords") → Find similar patterns
2. COORD: swarm_init(topology="hierarchical") → Set up coordination
3. EXECUTE: YOU write code, run commands → Codex does real work
4. REMEMBER: memory_store(key, value, upsert=true) → Save for future
Build an email validator using a learning-enabled swarm.
STEP 1 - LEARN (use MCP tool):
Use tool: memory_search
query: "validation utility function patterns"
namespace: "patterns"
If score > 0.7, use that pattern as reference.
STEP 2 - COORDINATE (use MCP tools):
Use tool: swarm_init with topology="hierarchical", maxAgents=3
Use tool: agent_spawn with type="coder", name="validator"
STEP 3 - EXECUTE (YOU do this - DON'T STOP HERE):
Create /tmp/validator/email.js with validateEmail() function
Create /tmp/validator/test.js with test cases
Run the tests
STEP 4 - REMEMBER (use MCP tool):
Use tool: memory_store
key: "pattern-email-validator"
value: "Email validation: regex, returns boolean, test cases"
namespace: "patterns"
upsert: true
YOU execute all code. MCP tools are for learning only.
| Score | Meaning | Action |
|---|---|---|
| > 0.7 | Strong match | Use the pattern directly |
| 0.5 - 0.7 | Partial match | Adapt and modify |
| < 0.5 | Weak match | Create new approach |
project/
├── AGENTS.md # Main project instructions (Codex format)
├── .agents/
│ ├── config.toml # Project configuration
│ ├── skills/ # 137+ skills
│ │ ├── swarm-orchestration/
│ │ │ └── SKILL.md
│ │ ├── memory-management/
│ │ │ └── SKILL.md
│ │ ├── sparc-methodology/
│ │ │ └── SKILL.md
│ │ └── ...
│ └── README.md # Directory documentation
├── .codex/ # Local overrides (gitignored)
│ ├── config.toml # Local development settings
│ └── AGENTS.override.md # Local instruction overrides
└── .claude-flow/ # Runtime data
├── config.yaml # Runtime configuration
├── data/ # Memory and cache
│ └── memory.db # SQLite with vector embeddings
└── logs/ # Log files
| File | Purpose |
|---|---|
AGENTS.md | Main instructions for Codex (required) |
.agents/config.toml | Project-wide configuration |
.codex/config.toml | Local overrides (gitignored) |
.claude-flow/data/memory.db | Vector memory database |
| Template | Skills | Learning | Best For |
|---|---|---|---|
minimal | 2 | Basic | Quick prototypes |
default | 4 | Yes | Standard projects |
full | 137+ | Yes | Full-featured development |
enterprise | 137+ | Advanced | Team environments |
# Minimal (fastest init)
npx claude-flow@alpha init --codex --minimal
# Default
npx claude-flow@alpha init --codex
# Full (all skills)
npx claude-flow@alpha init --codex --full
Minimal:
Default:
Full:
| Feature | Claude Code | OpenAI Codex |
|---|---|---|
| Config File | CLAUDE.md | AGENTS.md |
| Skills Dir | .claude/skills/ | .agents/skills/ |
| Skill Syntax | /skill-name | $skill-name |
| Settings | settings.json | config.toml |
| MCP | Native | Via codex mcp add |
| Overrides | .claude.local.md | .codex/config.toml |
Run init --dual to set up both platforms:
npx claude-flow@alpha init --dual
This creates:
CLAUDE.md for Claude Code usersAGENTS.md for Codex users.claude-flow/ runtimeIn OpenAI Codex CLI, invoke skills with $ prefix:
$swarm-orchestration
$memory-management
$sparc-methodology
$security-audit
$agent-coder
$agent-tester
$github-workflow
$performance-optimization
| Category | Examples |
|---|---|
| Swarm | $swarm-orchestration, $swarm-advanced |
| Memory | $memory-management, $agentdb-vector-search |
| SPARC | $sparc-methodology, $specification, $architecture |
| GitHub | $github-code-review, $github-workflow-automation |
| Security | $security-audit, $security-overhaul |
| Testing | $tdd-london-swarm, $production-validator |
Create custom skills in .agents/skills/:
.agents/skills/my-skill/
└── SKILL.md
SKILL.md format:
# My Custom Skill
Instructions for what this skill does...
## Usage
Invoke with `$my-skill`
# Model configuration
model = "gpt-4"
# Approval policy: "always" | "on-request" | "never"
approval_policy = "on-request"
# Sandbox mode: "read-only" | "workspace-write" | "danger-full-access"
sandbox_mode = "workspace-write"
# Web search: "off" | "cached" | "live"
web_search = "cached"
# MCP Servers
[mcp_servers.claude-flow]
command = "npx"
args = ["claude-flow", "mcp", "start"]
enabled = true
# Skills
[[skills]]
path = ".agents/skills/swarm-orchestration"
enabled = true
[[skills]]
path = ".agents/skills/memory-management"
enabled = true
[[skills]]
path = ".agents/skills/sparc-methodology"
enabled = true
# Local development overrides (gitignored)
# These settings override .agents/config.toml
approval_policy = "never"
sandbox_mode = "danger-full-access"
web_search = "live"
# Disable MCP in local if needed
[mcp_servers.claude-flow]
enabled = false
# Configuration paths
CLAUDE_FLOW_CONFIG=./claude-flow.config.json
CLAUDE_FLOW_MEMORY_PATH=./.claude-flow/data
# Provider keys
ANTHROPIC_API_KEY=sk-ant-...
OPENAI_API_KEY=sk-...
# MCP settings
CLAUDE_FLOW_MCP_PORT=3000
| Property | Value |
|---|---|
| Embedding Dimensions | 384 |
| Search Algorithm | HNSW |
| Speed Improvement | 150x-12,500x faster |
| Similarity Range | 0.0 - 1.0 |
| Storage | SQLite with vector extension |
| Model | all-MiniLM-L6-v2 |
| Namespace | Purpose |
|---|---|
patterns | Successful code patterns |
solutions | Bug fixes and solutions |
tasks | Task completion records |
coordination | Swarm state |
results | Worker results |
default | General storage |
// Find auth patterns
memory_search({ query: "authentication JWT patterns", namespace: "patterns" })
// Find bug solutions
memory_search({ query: "null pointer fix", namespace: "solutions" })
// Find past tasks
memory_search({ query: "user profile API", namespace: "tasks" })
import { CodexInitializer } from '@claude-flow/codex';
class CodexInitializer {
/**
* Initialize a Codex project
*/
async initialize(options: CodexInitOptions): Promise<CodexInitResult>;
/**
* Preview what would be created without writing files
*/
async dryRun(options: CodexInitOptions): Promise<string[]>;
}
import { initializeCodexProject } from '@claude-flow/codex';
/**
* Quick initialization helper
*/
async function initializeCodexProject(
projectPath: string,
options?: Partial<CodexInitOptions>
): Promise<CodexInitResult>;
interface CodexInitOptions {
/** Project directory path */
projectPath: string;
/** Template to use */
template?: 'minimal' | 'default' | 'full' | 'enterprise';
/** Specific skills to include */
skills?: string[];
/** Overwrite existing files */
force?: boolean;
/** Enable dual mode (Claude Code + Codex) */
dual?: boolean;
}
interface CodexInitResult {
/** Whether initialization succeeded */
success: boolean;
/** List of files created */
filesCreated: string[];
/** List of skills generated */
skillsGenerated: string[];
/** Whether MCP was registered */
mcpRegistered?: boolean;
/** Non-fatal warnings */
warnings?: string[];
/** Fatal errors */
errors?: string[];
}
import { CodexInitializer, initializeCodexProject } from '@claude-flow/codex';
// Quick initialization
const result = await initializeCodexProject('/path/to/project', {
template: 'full',
force: true,
dual: false,
});
console.log(`Files created: ${result.filesCreated.length}`);
console.log(`Skills: ${result.skillsGenerated.length}`);
console.log(`MCP registered: ${result.mcpRegistered}`);
// Or use the class directly
const initializer = new CodexInitializer();
const result = await initializer.initialize({
projectPath: '/path/to/project',
template: 'enterprise',
skills: ['swarm-orchestration', 'memory-management', 'security-audit'],
force: false,
dual: true,
});
if (result.warnings?.length) {
console.warn('Warnings:', result.warnings);
}
import { migrate } from '@claude-flow/codex';
const result = await migrate({
sourcePath: './CLAUDE.md',
targetPath: './AGENTS.md',
preserveComments: true,
generateSkills: true,
});
console.log(`Migrated: ${result.success}`);
console.log(`Skills generated: ${result.skillsGenerated.length}`);
CLAUDE.md → AGENTS.md.claude/skills/ → .agents/skills//skill-name → $skill-namesettings.json → config.tomlcodex mcp add claude-flow -- npx claude-flow mcp startInstead of migrating, use dual mode to support both:
npx claude-flow@alpha init --dual
This keeps both CLAUDE.md and AGENTS.md in sync.
# Check if registered
codex mcp list
# Re-register
codex mcp remove claude-flow
codex mcp add claude-flow -- npx claude-flow mcp start
# Test connection
npx claude-flow mcp test
# Initialize memory database
npx claude-flow memory init --force
# Check if entries exist
npx claude-flow memory list
# Manually add a test pattern
npx claude-flow memory store --key "test" --value "test pattern" --namespace patterns
# Verify skill directory
ls -la .agents/skills/
# Check config.toml for skill registration
cat .agents/config.toml | grep skills
# Rebuild skills
npx claude-flow@alpha init --codex --force
# Check HNSW index
npx claude-flow memory stats
# Rebuild index
npx claude-flow memory optimize --rebuild-index
| Package | Description |
|---|---|
| @claude-flow/cli | Main CLI (26 commands, 140+ subcommands) |
| claude-flow | Umbrella package |
| @claude-flow/memory | AgentDB with HNSW vector search |
| @claude-flow/security | Security module |
MIT
FAQs
Codex CLI integration for Ruflo (claude-flow) - OpenAI Codex platform adapter
The npm package @claude-flow/codex receives a total of 24,097 weekly downloads. As such, @claude-flow/codex popularity was classified as popular.
We found that @claude-flow/codex demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
11 malicious NuGet tools pose as game cheats to deploy Windows payloads, track hosts, and use Google Sheets for telemetry and control.

Research
/Security News
4 compromised asyncapi packages deliver miasma botnet loader on macOS, Linux and Windows.

Research
/Security News
A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.