# Copilot coding agent and Codex cloud vs a local, verified pipeline

Last updated: 2026-10-14

> **Support update, 14 October 2026:** Native enforcement and login modes are restricted. Linux enforcement remains unverified; all Claude stages temporarily refuse. Select Codex or Pi. See [current versions, prerequisites and protection limits](https://provefab.com/docs/configuration.md#repossandbox-native-execution-policy).

GitHub Copilot's cloud agent and OpenAI's Codex cloud run a coding agent in a hosted environment and hand you a diff or a pull request to review. Provefab runs the same kind of agents on your own Mac or Linux server, runs your repository's own checks as the gate, applies your risk policy and repository rules, and has a model from another provider review before the pull request opens. All three leave the merge to a person by default; the difference is where the work runs and what has to pass before you look. The [demo](https://provefab.com/index.md#demo) shows what Provefab refuses on the way to a pull request.

## Side by side

| | Copilot cloud agent | Codex cloud | Provefab |
|---|---|---|---|
| Where the agent runs | "an ephemeral cloud development environment, rather than your local IDE" ([GitHub docs](https://docs.github.com/en/copilot/concepts/copilot-surfaces/copilot-on-github)) | "Codex creates a container and checks out your repo"; "Each task has its own workspace" ([OpenAI docs](https://learn.chatgpt.com/docs/environments/cloud-environment)) | Your Mac or Linux server, in an isolated worktree, with every tool call filtered by a guard |
| How work starts | "the agents panel, a conversation, or an issue or pull request on GitHub.com" ([GitHub docs](https://docs.github.com/en/copilot/concepts/copilot-surfaces/copilot-on-github)), or a Linear issue through the Copilot app for Linear ([GitHub docs](https://docs.github.com/en/copilot/how-tos/copilot-integrations/integrate-cloud-agent-with-linear)) | A task started "from a published environment" with your repositories ([OpenAI docs](https://learn.chatgpt.com/docs/cloud)) | A label on a GitHub issue, or on a Jira Cloud or Linear ticket (beta) |
| What decides it is ready | The agent can "run tests and linters"; "You can review changes and request refinements before creating a pull request, or request a pull request in your initial prompt" ([GitHub docs](https://docs.github.com/en/copilot/concepts/copilot-surfaces/copilot-on-github)) | The agent "runs checks, and tries to validate its work", using AGENTS.md "to find project-specific lint and test commands" ([OpenAI docs](https://learn.chatgpt.com/docs/environments/cloud-environment)) | Your configured format, lint and test commands must pass, plus a reproduction for a bug. Your risk policy adds commands for risky areas (CI, dependencies, migrations, infrastructure, secret-looking files, paths you name), and your repository rules in `.provefab/rules.md` go to every stage |
| Second review | A separate feature: "Copilot code review reviews pull request changes, identifies potential issues, and suggests fixes" ([GitHub docs](https://docs.github.com/en/copilot/concepts/copilot-surfaces/copilot-on-github)) | A separate feature: "Codex reviews the pull request diff, follows your repository guidance, and posts a standard GitHub code review" ([OpenAI docs](https://learn.chatgpt.com/docs/third-party/github)) | Built into every task: a model from a different provider than the implementer's reviews (when your catalog has a model from another provider), cites the rule a finding breaks, and the implementer must write a test for each finding |
| Merge | "must be reviewed and merged by a human"; the agent "cannot approve or merge a pull request" ([GitHub docs](https://docs.github.com/en/copilot/concepts/security-governance-and-network-settings/risks-and-mitigations)) | You "commit or open a pull request when you're ready" ([OpenAI docs](https://learn.chatgpt.com/docs/cloud)) | Core: a person merges. Pro: optional auto-merge of small, tested changes; risky changes never merge without a person unless you allow them |
| Who pays for what | AI credits: "This includes Copilot Chat, Copilot CLI, Copilot cloud agent" ([GitHub docs](https://docs.github.com/en/copilot/concepts/billing-and-usage/organizations-and-enterprises/billing)) | ChatGPT plans; Plus lists "Codex on the web", and API-key use has "No cloud-based features (GitHub code review, Slack, etc.)" ([OpenAI pricing](https://learn.chatgpt.com/docs/pricing)) | Your own Claude or ChatGPT plans or API keys; Pro is EUR 79 per month per organization |

## The difference in one paragraph

Hosted agents are convenient: nothing to install, and the work runs on someone else's machines. What you get back is a proposal that you still have to check, and the review features both vendors offer run after the pull request exists. Provefab moves the checking before the pull request: your own commands decide, a test deleted or disabled is listed in the pull request, a change to a risky area gets extra commands and, when your catalog allows it, a frontier reviewer, and a model from another provider has to accept the change against your written rules. You review a pull request that already carries its evidence, on code that never left your machine except through the model providers you already use.

## When a hosted agent is the better choice

If you do not want a service running on a machine you manage, or if your checks cannot run locally, a hosted agent is simpler. If your organization already pays for Copilot, the cloud agent may be one setting away: GitHub says "Available features depend on your plan and organization policies" ([GitHub docs](https://docs.github.com/en/copilot/concepts/copilot-surfaces/copilot-on-github)). Codex cloud keeps working "while your computer is asleep" ([OpenAI docs](https://learn.chatgpt.com/docs/cloud)), while Provefab runs only when its machine is on; a small Linux server avoids that.

If you are weighing a fully hosted agent that works more on its own, see [the self-hosted Devin alternative](https://provefab.com/alternatives/devin.md). If your team lives in GitHub Actions, [Claude Code GitHub Actions vs Provefab](https://provefab.com/compare/claude-code-github-actions.md) compares that route.

## Using them together

They do not exclude each other. A hosted agent can draft, and Provefab can review what it drafted before anyone merges. On a pull request opened by Copilot or Codex, put the `provefab:review` label, or comment `/provefab review` as a repository owner, organization member or collaborator. At its next poll Provefab reviews it with a reviewer from your own model catalog, your repository rules (read from the base branch, never from the pull request) and your risk policy, and posts one comment listing the findings, with the rule number when a finding breaks one.

That review runs nothing from the pull request: no gates, checks or builds, and the reviewer can only read files with a short list of read-only commands. It never approves, requests changes on or merges the pull request; a person decides. It is a review, not the full pipeline: to get your checks run as well, file the work as a labelled issue and let Provefab implement it. The details are in [Pull request reviews](https://provefab.com/docs/pr-review.md).

Read [How to verify AI-generated pull requests](https://provefab.com/guides/verify-ai-pull-requests.md) for the checklist, see [Provefab's own pull requests](https://provefab.com/built-by-provefab) for real examples, or watch [the demo](https://provefab.com/index.md#demo).