Chrome DevTools MCP vs Codex Security

A side by side look at Chrome DevTools MCP and Codex Security: pricing, features and what each one is best for.

In this comparison

	Chrome DevTools MCP Code Generation Visit Chrome DevTools MCP	Codex Security Code Generation Visit Codex Security
What it costs
Pricing	Open source	Open source
Pricing details	Free and Apache-2.0 licensed. There is no paid tier and no pricing page: it installs from npm and drives Chrome on your own machine.	The CLI and SDK are Apache-2.0 and free to install from npm as @openai/codex-security. Scans are billed as model usage against your own key, and OPENAI_API_KEY, Amazon Bedrock, OpenRouter and Fireworks all work as providers. Set a soft ceiling with --max-cost; the docs are explicit that it is an estimate, not a hard spending cap. Note that some cybersecurity requests and protected findings require approval through Trusted Access for Cyber.
Free option	No free option	Free tier
What it is
What it does	An MCP server from the Chrome DevTools team that gives your coding agent a live browser to navigate, record traces, read the console and find the real bug.	OpenAI's application security agent. An Apache-2.0 CLI and TypeScript SDK that finds vulnerabilities, validates them before reporting, and proposes fixes.
The details
GitHub stars	51,261stars	10,937stars
Language	TypeScript	TypeScript
License	Apache License 2.0	Apache License 2.0
Last commit	7 Sept 2026	30 Sept 2026

What it costs

Pricing: Open source
Pricing details: Free and Apache-2.0 licensed. There is no paid tier and no pricing page: it installs from npm and drives Chrome on your own machine.
Free option: No free option

What it is

What it does: An MCP server from the Chrome DevTools team that gives your coding agent a live browser to navigate, record traces, read the console and find the real bug.

The details

What it costs

Pricing: Open source
Pricing details: The CLI and SDK are Apache-2.0 and free to install from npm as @openai/codex-security. Scans are billed as model usage against your own key, and OPENAI_API_KEY, Amazon Bedrock, OpenRouter and Fireworks all work as providers. Set a soft ceiling with --max-cost; the docs are explicit that it is an estimate, not a hard spending cap. Note that some cybersecurity requests and protected findings require approval through Trusted Access for Cyber.
Free option: Free tier

What it is

What it does: OpenAI's application security agent. An Apache-2.0 CLI and TypeScript SDK that finds vulnerabilities, validates them before reporting, and proposes fixes.

The details