# Limitations of the Built-in Reviewer vs. Adversarial Review in Codex > Explore the limitations of Codex's built-in reviewer compared to adversarial review. Understand how each approach impacts design decisions and safety analysis for your code. - Repository: [OpenAI/codex-plugin-cc](https://github.com/openai/codex-plugin-cc) - Tags: deep-dive - Published: 2026-07-29 --- **The built-in reviewer (`/codex:review`) provides a fast implementation check that cannot challenge design decisions or accept custom focus text, while adversarial review (`/codex:adversarial-review`) enforces a skeptical, safety-critical analysis with structured output requirements at the cost of increased verbosity and processing time.** The **openai/codex-plugin-cc** repository ships two distinct code review commands that serve different safety validation needs. Understanding the **limitations of the built-in reviewer versus adversarial review in Codex** helps teams choose the appropriate scrutiny level for their pull requests. While the built-in reviewer excels at rapid sanity checks, adversarial review applies a systematic "attack surface" analysis defined in [`plugins/codex/prompts/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/prompts/adversarial-review.md). ## How the Built-in Reviewer Works The built-in reviewer performs a standard pass-or-fail code review focused on implementation defects. ### Scope and Prompting According to [`plugins/codex/commands/review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/commands/review.md), the built-in reviewer uses the default Codex reviewer prompt without an explicit adversarial stance. It examines the repository’s current state—whether the working tree, a branch diff, or an explicit `--base` comparison—but **cannot be limited to staged or unstaged changes** alone. The review is restricted to changed files only and accepts no additional focus text to direct its attention toward specific concerns. ### Depth of Analysis and Output The built-in reviewer looks for obvious defects and missing guards, but it **does not enforce adversarial constraints** such as race-condition checks, rollback safety, or version-skew hazards unless they manifest as obvious bugs. The output conforms to the standard JSON format, but unlike adversarial review, it requires no explicit `needs-attention` versus `approve` rating. ## How Adversarial Review Differs Adversarial review actively tries to find the strongest reasons a change should not ship. ### Skeptical Framing and Attack Surface As defined in [`plugins/codex/commands/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/commands/adversarial-review.md), this command loads the adversarial prompt from [`plugins/codex/prompts/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/prompts/adversarial-review.md). This prompt forces the model to adopt skepticism and perform a systematic analysis of the ``. The reviewer must examine broad failure vectors—including authentication gaps, data loss scenarios, race conditions, and observability holes—that the built-in reviewer might overlook. ### Custom Focus and Structured Output Unlike the built-in reviewer, adversarial review accepts an optional **`[focus …]`** argument that lets users direct the review toward specific concerns such as security or performance. The output must adhere to the `` defined in the adversarial prompt, including a **`needs-attention`** or **`approve`** decision, confidence scores, and concrete remediation recommendations. Both commands ultimately invoke `scripts/codex-companion.mjs`, but adversarial review validates against [`schemas/review-output.schema.json`](https://github.com/openai/codex-plugin-cc/blob/main/schemas/review-output.schema.json) for additional structure. ## Key Limitations Compared When deciding between review modes, consider these architectural constraints. ### Design Challenge vs. Implementation Check The **built-in reviewer cannot challenge high-level architecture or design trade-offs**. It validates that code functions correctly, not that it should exist in its current form. Adversarial review explicitly questions design choices, hidden assumptions, and long-term maintenance burdens as part of its mandate to prevent shipping unsafe changes. ### Focus Text and Customization The built-in reviewer **does not accept custom focus text**; it applies a generic lens to all diffs. Adversarial review supports targeted analysis via the `focus` parameter, but leveraging this requires the extra `(focus …)` argument and increases output complexity that the team must triage. ### Performance and Verbosity Trade-offs Adversarial review is **more verbose and slower**, requiring additional processing time to generate comprehensive safety analysis. It may produce voluminous findings that require human triage, whereas the built-in reviewer offers a lightweight check suitable for small diffs of roughly one to two files. ### Scope Constraints Both commands rely on the same underlying scope logic in `scripts/codex-companion.mjs`, meaning neither can isolate staged changes separately from unstaged ones. However, adversarial review can layer additional focus criteria onto this scope without losing its skeptical framing. ## Practical Examples Run these commands in your terminal to invoke each review mode. Run a quick foreground review for immediate feedback: ```bash /codex:review --wait ``` Launch a background review for larger changes: ```bash /codex:review --background ``` Execute an adversarial review with a security focus: ```bash /codex:adversarial-review --wait security ``` Start a background adversarial review against a specific base branch: ```bash /codex:adversarial-review --background --base main ``` ## Summary - The **built-in reviewer** (`/codex:review`) provides fast implementation checks but cannot challenge design decisions, accept custom focus text, or catch subtle failure modes like race conditions unless they appear as obvious bugs. - **Adversarial review** (`/codex:adversarial-review`) enforces a skeptical analysis of attack surfaces and design trade-offs via the prompt in [`plugins/codex/prompts/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/prompts/adversarial-review.md), requiring structured `needs-attention` or `approve` outputs. - Adversarial review accepts optional **focus arguments** to target specific concerns, while the built-in reviewer offers no customization. - The built-in reviewer suits quick sanity checks on small diffs; adversarial review suits safety-critical changes, security-sensitive code, and large architectural shifts at the cost of increased verbosity and processing time. - Both commands invoke `scripts/codex-companion.mjs` and share the same scope limitations regarding staged versus unstaged changes. ## Frequently Asked Questions ### Can the built-in reviewer analyze staged changes separately from unstaged changes? No. According to the command definition in [`plugins/codex/commands/review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/commands/review.md), the built-in reviewer works on the repository’s current state, branch diffs, or explicit `--base` comparisons. It cannot be limited to staged or unstaged changes alone. This scope constraint applies to both review modes, as both invoke the same underlying runtime in `scripts/codex-companion.mjs`. ### Why does adversarial review require a structured output contract while the built-in reviewer does not? The adversarial prompt defined in [`plugins/codex/prompts/adversarial-review.md`](https://github.com/openai/codex-plugin-cc/blob/main/plugins/codex/prompts/adversarial-review.md) includes a `` section that mandates explicit `needs-attention` or `approve` decisions, confidence scores, and remediation recommendations. This requirement ensures the skeptical analysis produces actionable, standardized results suitable for safety-critical gates. The built-in reviewer uses a simpler prompt without these adversarial constraints, producing a standard JSON report without mandatory decision labels. ### When should I use adversarial review instead of the built-in reviewer? Use adversarial review for deep, safety-critical analysis of large changes, security-sensitive code, or when stress-testing architectural assumptions. Use the built-in reviewer for quick sanity checks before merging small diffs of roughly one to two files. According to the source code, adversarial review adds significant processing overhead and verbosity, making it less suitable for rapid iteration on trivial changes. ### Does adversarial review support custom focus areas? Yes. Unlike the built-in reviewer, the adversarial review command accepts an optional **`[focus …]`** argument that directs the AI toward specific concerns such as "security" or "performance." This focus text is injected into the adversarial prompt to shape the attack surface analysis without losing the skeptical framing required by the `` section.