Claude Code and OpenAI Codex both edit code and run development commands. Compare them by where tasks execute and how you control their access. Claude Code combines tool rules and hooks with an optional shell sandbox; Codex separates sandbox permissions from approval policy.
Both support local work and cloud tasks. Your choice should account for the repository state a task receives, the settings enforced in that environment, and how you review its changes.
Copy link to headingWhat are the key differences between Claude Code and Codex?
Start with the environment where you expect to use each agent. Local edits, cloud handoffs, and scripted jobs need different access and review arrangements.
Copy link to headingCompare the workflow you will use
Run a trial on your own tickets with the same starting commit and acceptance criteria. Record which files each agent changes, whether required checks pass, and where a person must intervene. Keep local and cloud trials separate so you can inspect the controls applied in each environment.
These controls need configuration in the environment where the work runs. Changing a local setting does not establish the policy for a separate cloud task.
Copy link to headingInclude code review in the trial
Check the proposed diff as well as the test result. For a change to an API route, that means reviewing how it handles invalid input and whether the tests exercise the behavior the ticket requested.
In METR's maintainer review study, four maintainers reviewed 296 AI-generated pull requests from three SWE-bench Verified repositories. Roughly half of test-passing patches from agents released between mid-2024 and mid-to-late 2025 would not have been merged, after adjustment for variation in maintainer decisions.
The agents had no chance to revise their work in response to feedback, so the study does not establish a limit on what current agents can accomplish with review.
Copy link to headingCheck what a cloud task receives
Cloud work starts with the files and configuration available in its remote environment. Before handing off a ticket, confirm the branch or uploaded repository state, required dependencies, and access to services used by the tests.
Claude Code's cloud launch method determines whether it clones a remote repository or uploads a local bundle. Codex Cloud starts tasks from a published environment with its configured repositories and tools. In either workflow, review the remote setup before treating a successful local build as evidence that the cloud task can reproduce it.
Copy link to headingCheck sandbox scope and exceptions
Claude Code's optional sandbox restricts shell commands and their child processes. File tools, hooks, and Model Context Protocol servers operate outside that shell boundary. It is off by default and supports macOS, Linux, and WSL2; native Windows commands run without this sandbox.
Codex uses an OS-enforced sandbox for local command execution. Its selected mode determines filesystem and network access, and approved escalation can expand that access. On Windows, Codex supports a native sandbox, so WSL2 is not required for command isolation. Verify the sandbox configuration on your machine.
Copy link to headingHow does Claude Code fit a full-stack workflow?
Claude Code is Anthropic's coding agent. Developers use it to generate code, run builds, and commit changes on their behalf.
Copy link to headingConfigure tool rules and hooks
Claude Code combines permission modes with rules for individual tools. You can use hooks to inspect an action before it runs, and administrators can distribute managed settings to the team. These controls complement the shell sandbox.
Claude Code runs in the terminal, IDE extensions, desktop app, and browser. Its hook events are available across those environments, but a cloud session does not inherit every local settings file. Check which settings reach the cloud session before relying on a local rule.
Deny rules apply across permission modes, including bypassPermissions. However, installed mods can override some denials when neither managed settings nor a Team or Enterprise login governs the session. Treat plugin configuration as part of the policy you review.
Copy link to headingPrepare cloud handoffs and policy hooks
Claude Code can clone a connected GitHub repository or, for supported CLI launches, upload a local repository bundle. The bundle can include unpushed commits and changes to tracked files, subject to its size and file restrictions. Confirm that the cloud session includes the local changes your task needs.
For a blocking event such as PreToolUse, set onFailure to "block" on a synchronous command or HTTP hook if a crash or timeout must stop the action. This option requires Claude Code v2.1.295 or later. Without it, many hook failures leave the action to the normal permission flow, although some events and environments have stricter defaults.
Enable the shell sandbox separately if the task needs filesystem and network restrictions. Hook failure policy, a repository upload, and command isolation address different parts of an unattended run.
Copy link to headingPin model traffic to an approved gateway
Administrators can set allowedProviders to ["customEndpoint"] and pin ANTHROPIC_BASE_URL in a managed env block. Claude Code then checks the selected endpoint against that managed value. This control requires v2.1.285 or later and governs model-provider access; it does not restrict every network request made by shell commands or tools.
Copy link to headingHow does Codex fit a full-stack workflow?
Codex is OpenAI's coding agent. You can work locally through its CLI and IDE integration or give a task a separate cloud environment.
Copy link to headingSet sandbox access and approval behavior
Codex's sandbox controls what a command can access. The approval policy decides whether an action outside those permissions can ask for approval or must fail. Review both settings before handing off work, especially when a task needs network access or writes outside its workspace.
The granular approval policy can keep selected prompt categories interactive and reject others, including sandbox, MCP, and skill-script approval requests. This lets you define the interruptions your workflow can handle.
Copy link to headingHandle blocked operations in unattended runs
In non-interactive subagent workflows, an action that needs fresh approval fails when the run cannot surface that request, and Codex reports the error to the parent workflow. Give the parent a way to record the blocked step and return it for review.
Git operations can also need additional permission. The default workspace-write policy protects .git as read-only, so check whether the task can commit under its selected permissions before leaving it unattended.
Turning the sandbox off to stop approval interruptions trades away the boundary along with the friction. Full-access mode removes filesystem and network restrictions, while disabling prompts alone is a separate, narrower setting.
Codex Cloud gives each task its own workspace and can keep working while your computer sleeps. Review the environment's repository and service access separately from your local Codex settings.
Copy link to headingRun a scripted job with explicit permissions
Use codex exec for scripts and CI jobs. It defaults to a read-only sandbox, so set the permissions the job needs and handle errors in your script. Local provider settings support compatible model endpoints.
Copy link to headingClaude Code vs Codex: which is right for full-stack developers?
Choose the agent whose execution and review workflow fits the task. Start with a change that needs both source edits and a test run, then repeat it in the environment where you expect to use the agent.
Copy link to headingWhen the task must run unattended
Check that the task has its repository state, dependencies, and required service access before it starts. Test what happens when an operation needs permission that nobody can approve during the run. Record the blocked operation and the work already completed so a reviewer can decide how to continue.
Copy link to headingWhen your team needs enforced controls
Map each requirement to the control that enforces it. Tool rules govern calls, a sandbox restricts command access, and managed settings determine which configuration a user can change. Check an allowed and a blocked operation in the actual environment, including any plugins the team installs.
Claude Code's plan mode supports exploration before source edits. Codex offers a read-only sandbox for inspection. Review either agent's proposed changes before granting the additional access an implementation needs.
Copy link to headingHow can Vercel support either agent?
AI Gateway routes model requests and records usage. Vercel Sandbox provides an isolated environment for running agents. Gateway configuration changes inference routing; remote execution requires its own setup.
Copy link to headingConnect local agents to AI Gateway
The Vercel CLI setup command detects supported agents and writes their Gateway configuration. It can create a key or reuse one, and --dry-run previews changes without writing files or creating a key.
On macOS, the CLI uses Keychain when available. Otherwise, it stores the key in agent configuration or shell startup files. Inspect the setup output so you know where the credential will be stored.
With Vercel CLI installed and a team selected, run this command to configure both agents. New keys get a $500 monthly budget; reused keys keep their settings.
vercel ai-gateway setup \ --agent claude-code \ --agent codex \ --amount 500 \ --refresh-period monthly \ --yesOpen a new terminal after setup so the shell exports load, then restart the agents. Keep the Gateway key in the configured credential storage and out of browser code or a committed repository.
Copy link to headingSelect a compatible model configuration
Gateway exposes agent-specific model catalogs for Claude Code and Codex. Use the models offered in each agent's picker; the full Gateway catalog also contains model types that a coding agent cannot use.
An AI Gateway virtual model stores a model choice and routing settings under one ID. It can carry provider preferences, fallbacks, and requirements such as zero data retention. Updating that configuration changes subsequent requests without editing each developer's agent config.
Provider fallback can retry an eligible model request through another provider. It does not resume a crashed agent process or restore a lost workspace. Durable execution needs a runtime that saves session state and resumes interrupted work.
Copy link to headingInspect sessions and set a budget
The AI Gateway Sessions view groups requests by session and shows the agent, models, providers, and usage, including cached input. Use that record alongside the task's diff and test results when reviewing a trial.
Session affinity prefers the provider that served the previous turn when routing rules still allow it. Provider failure can move the request elsewhere, so cache reuse depends on the route and the provider's cache behavior.
Gateway keys can have budgets that reset daily, weekly, or monthly. Gateway checks the budget before each request and blocks further requests once it is exhausted. The request that crosses the limit can finish, so the budget is a soft cap.
Copy link to headingRun commands in a separate environment
An agent running locally can reach the files and services its effective permissions allow. If the task needs a separate machine, Vercel Sandbox runs code in a Firecracker microVM with its own filesystem and network configuration. You choose which code, credentials, and network access to provide.
Conductor uses Vercel Sandbox for Cloud Workspaces, including work with Claude Code and Codex. Its application provides the setup for remote agent execution.
Review the agent's permissions inside the remote environment as well. Isolation limits the machine the task can affect, but the credentials and services you expose still need an appropriate access policy.
Copy link to headingReview the change before you deploy
Once your trial produces a change you can review, run the project's checks and inspect its behavior in a preview environment. Model routing and agent execution do not replace the deployment review.
Start a new project or browse Vercel templates to deploy your application.
Copy link to headingFrequently asked questions about Claude Code vs Codex
Copy link to headingHow should I compare Claude Code and Codex on my project?
Give each agent the same starting commit and acceptance criteria, then review the diff and test results. Run the trial in the local or cloud environment you intend to use. Record any missing access or approval interruptions, because those determine how much supervision the workflow needs.
Copy link to headingCan Claude Code and Codex keep working after I close my laptop?
Yes, when the task runs in a cloud environment. Claude Code supports remote cloud sessions, and Codex Cloud gives each task a workspace that can continue while your computer sleeps. Local execution still depends on the machine running it, so confirm where execution happens before disconnecting.
Copy link to headingCan Claude subscriptions work through Vercel AI Gateway?
Yes. Claude Code supports a manual subscription flow through AI Gateway using the Gateway base URL, an ANTHROPIC_CUSTOM_HEADERS value containing the Gateway key, and Claude subscription sign-in. The CLI setup command configures API-key authentication, so configure the subscription flow separately. Those requests appear in Gateway observability.
Copy link to headingDoes AI Gateway move Claude Code or Codex into the cloud?
No. AI Gateway routes the agent's model requests; the local agent continues to execute on its current machine. Running either agent remotely needs a cloud execution environment, such as a separately configured Vercel Sandbox integration.