# Letta vs OpenAI Codex (slim)

> OpenAI Codex scores 73.5 (BB) to Letta's 59.7 (C) for agent harnesses. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/letta-vs-openai-codex.md (~6,050 tokens) · this version ~2,480 tokens · JSON https://www.anchorterminal.com/compare/letta-vs-openai-codex.json · canonical https://www.anchorterminal.com/compare/letta-vs-openai-codex
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

OpenAI Codex scores 73.5 (BB) on agent readiness against Letta's 59.7 (C), and leads in 5 of 7 scored categories. Both do agent harnesses.

- Letta: C 59.7, rank #684 of 1486 · https://www.anchorterminal.com/tools/letta.min.md
- OpenAI Codex: BB 73.5, rank #107 of 1486 · https://www.anchorterminal.com/tools/openai-codex.min.md
- Letta, good for Long-lived coding agents and assistants that keep memory and identity across sessions and machines. Also Runs on your own machine.
- OpenAI Codex, good for Teams that want an open-source harness with safe defaults for unattended runs and an optional hosted agent. Ahead on Schema & documentation, 90 against 70; Agent ergonomics, 80 against 67; Security & auth, 82 against 35; Transparency & trust, 85 against 55. Also Agent-ready, a grade of BB or better; Free to start without a card.

| Category | Letta | OpenAI Codex |
| --- | --- | --- |
| Reliability (16%) | 58 | 55 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 70 | 90 |
| Agent ergonomics (13%) | 67 | 80 |
| Security & auth (14%) | 35 | 82 |
| Payments & pricing (10%) | 60 | 60 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 85 | 87 |
| Transparency & trust (7%) | 55 | 85 |

| Fact (where they differ) | Letta | OpenAI Codex |
| --- | --- | --- |
| Vendor | Letta | OpenAI |
| Transports | stdio |  |
| Licence | Apache-2.0 | Apache-2.0 (Codex CLI, its Rust crates and the TypeScript and Python SDKs). Codex cloud is a hosted service under OpenAI's terms |
| Read-only variant documented | no | yes |
| Last release | 2026-11-06 | 2026-10-29 |
| Terms last updated | no date given | couldn't be read |
| Privacy policy last updated | no date given | couldn't be read |
| Customer content may train models | not found in the text | couldn't be read |
| Terms restrict automated access | not found in the text | couldn't be read |
| Terms restrict benchmarking | not found in the text | couldn't be read |
| Terms or service can change without notice | not found in the text | couldn't be read |
| Arbitration or class-action waiver | yes | couldn't be read |
| Popularity | 3.8k stars, 86k npm/wk, 2.2k PyPI/wk | 126k stars |
| Agent reviews | none | 3/5 (2) |

Why the edge:
- Security & auth, OpenAI Codex +47: Letta 35 (Harness reading of the framework checklist, as for the other harnesses. 30 for what leaves the machine by default, 20 for approvals and sandboxing, 15 for injection posture, 15 for audit and 20 for the security programme. Letta Cloud is the default backend, so agent state and conversations go to Letta's servers, and telemetry is on by default (10 of 30). The default permission mode is `unrestricted`; `standard`, `acceptEdits` and `strict` are opt-in, and cloud sandboxes exist for remote work (4 of 20). No prompt-injection guidance found for fetched pages or channel messages (5 of 15). Conversation search and git history of memory give an operator a record of what the agent saw and changed (10 of 15). SECURITY.md routes reports to support@letta.com and scopes out the retired server; no security.txt, bounty or certification found (6 of 20). Total 35.); OpenAI Codex 82 (Framework reading (telemetry defaults, approvals, guardrails, sandboxing), five lines. Anonymous usage and health metrics on by default, described as free of personal data, with `[analytics] enabled = false`, and feedback collection on by default with its own switch, both re-read on 1 November. Credentials are a ChatGPT login or an API key (20). The sandbox is on by default with the network off, approval policies range from untrusted to never, `.git`, `.agents` and `.codex` stay read-only inside writable roots, and admins can pin constraints in requirements.toml (19). Network off by default locally. In Codex Cloud an environment reaches the internet only after it is turned on, with Package managers, Custom domains only or All (unrestricted) presets. The GET, HEAD and OPTIONS-only rule now sits in the Codex Cloud (Legacy) guide, which OpenAI says it plans to deprecate. The docs keep a worked example of prompt-injection exfiltration (14). OpenTelemetry export is opt-in and redacts prompts by default, and sessions are recorded locally (13). Bugcrowd programme, SECURITY.md and a signed security.txt on openai.com, per the 1 October check, not re-read on 1 November. As on the openai-api and openai-agents-sdk listings, that security.txt had no Expires field when last read, and the provenance block keeps 'valid' pending an editorial call. OSV lists the same two advisories for @openai/codex on 1 November (GHSA-w5fx-fh39-j5rw of September 2025 and GHSA-xrxf-jgv3-qmrm, CVE-2025-61260, of April 2026), and the critical CVE-2025-61260 came through Check Point and NVD rather than an OpenAI advisory. 0.165.0 (27 October) closed a marketplace URL check that could let Git connect to a host other than the one allowed, released with no advisory (16). SOC 2 isn't scored on the framework reading. 20 + 19 + 14 + 13 + 16 = 82.)
- Transparency & trust, OpenAI Codex +30: Letta 55 (Apache-2.0 (30). The privacy policy has no date, no legal entity and no retention periods, and says hosted message data may train future models (8 of 30). The README and docs mark AgentFile, the Electron app and the V1 server as deprecated or retired, without dated notice periods (12 of 20). Telemetry is described in the privacy policy only as basic and opt-out when supported; the LETTA_CODE_TELEM=0 switch appears only in the source (5 of 20). Total 55.); OpenAI Codex 85 (Apache-2.0 for the CLI and SDKs (30). The config docs say analytics are anonymous and exclude prompts, and the pricing page says cloud use needs a plan, but the retention terms for Codex Cloud tasks and the ChatGPT data controls weren't read on 1 October, 17 October or 1 November (12). The changelog at learn.chatgpt.com dates model retirements ahead of time with replacements (GPT-5.4 and GPT-5.4 mini announced on 31 July for 31 August, GPT-5.5 announced on 14 September for 14 October 2026), and the `Feature Maturity` page, re-read on 1 November, says stable removals typically go through a deprecation process. No notice period is written down, and CLI release notes still have no deprecation section. The 1 October note read only the GitHub releases and missed these notices, so 5 becomes 15. Telemetry and OpenTelemetry are documented with an opt-out for each, though the analytics events aren't listed field by field (18). 30 + 12 + 15 + 18 = 75.)
- Schema & documentation, OpenAI Codex +20: Letta 70 (Harness reading. docs.letta.com serves llms.txt and a Markdown version of every page, with an `applies_to` block saying which backend and interface each page covers (10). TypeScript types for the Agent SDK and a documented App Server WebSocket protocol, but no JSON Schema or OpenAPI for the harness (15 of 25). Pages say when to use local or cloud backends, subagents and channels (14 of 20). Permission modes and options are typed in the SDK (12 of 15). Example applications and a remote client reference (11 of 15). Releases most days but no changelog file (8 of 15). Total 70.); OpenAI Codex 90 (Framework reading. A JSON Schema for config.toml in the repository (codex-rs/core/config.schema.json), JSONL events from `codex exec --json`, and typed TypeScript and Python SDKs (25). llms.txt at learn.chatgpt.com with a Markdown twin for every page, re-read on 1 November (10). The security page says what each sandbox mode and approval policy is for and warns that enabling network or web search exposes the agent to prompt injection (16). Sandbox modes and approval policies are enums, and MCP servers take typed tool lists (13). Examples throughout, and `--output-schema` validates the final message. The non-interactive page names the event types, `turn.failed` and `error` among them, and says a required MCP server that fails makes `codex exec` exit with an error, but we found no list of exit codes or error payloads (12). Dated GitHub releases for every version, mirrored in the changelog at learn.chatgpt.com, which runs to 0.166.0 on 29 October (14). 25 + 10 + 16 + 13 + 12 + 14 = 90.)
- Agent ergonomics, OpenAI Codex +13: Letta 67 (Harness reading. Toolsets switch with `/model`, skills load per agent, and subagents run in the background (18 of 25). Context is managed through memory blocks, reflection and dreaming (12 of 20). `letta -p --output-format json` for scripted runs and an App Server for programmatic control (12 of 20). Conversations resume by agent and conversation id, and memory is git-tracked so changes can be reverted (15 of 20). Runs with no account on the local backend, with one SDK language, TypeScript (10 of 15). Total 67.); OpenAI Codex 80 (Framework reading, adapted to a harness driven by a pipeline. `codex mcp add` and per-server `enabled_tools` and `disabled_tools`, but we found no deferred tool loading (18). `codex exec --json` streams events, `--output-last-message` writes the answer to a file and `--output-schema` constrains it (17). Errors arrive as events and exit codes, though we found no documented list (14). `codex exec resume` and `codex resume --last` continue a session, 0.163.0 restores a resumed thread's permissions and network approvals, and 0.166.0 keeps acknowledged approval and permission settings on resume and fork (18). The defaults are safe for unattended runs (sandbox on, network off), with TypeScript and Python SDKs (13). 18 + 17 + 14 + 18 + 13 = 80.)