Search the Catalog
MCP Inspector
Market Space
Safe-use guides
OpenAI Codex security directory
Qodo
Published by OpenAI
High risk
Adds Qodo codebase-context and code-review workflows to your coding assistant. Review local changes and work through pull-request feedback. Requires Qodo CLI setup and sign-in; standards administration is a separate optional package.
Security assessment
Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.
- Review workflows can edit local code and persist review context: Can read, create, or change files on the local filesystem or in a selected project.
- Repository patches and questions are sent to Qodo: Can send prompts, files, queries, or connected-service data to an external service.
- Review resolver writes finding dispositions to Qodo state: Can create or change persistent records, files, projects, permissions, settings, or credentials.
- Qodo reads local diffs and remote private repository history: Can read private account, workspace, repository, message, analytics, or file data.
- Qodo login retains deployment credentials: Uses credentials, OAuth grants, API keys, or tokens that may remain valid after the current session.
- Qodo skills install, update and execute a local CLI: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
The interactive security report will load automatically.