# Claude Code vs Cursor vs Codex: which AI coding agent to use

All 3 are AI coding agents that read your code, edit files and run commands until a task is done, and all 3 read an AGENTS.md file, so one set of project instructions serves them all. Pick Claude Code for Claude models in the terminal and IDEs with detailed permission rules, Cursor for an AI-first editor with models from several makers, and Codex for OpenAI's models with an operating-system sandbox on by default and an open-source CLI. The bigger differences are in how each one limits what the agent may touch.

- Page: https://tecyfy.com/coding-agents/claude-code-vs-cursor-vs-codex
- Part of: Coding agents (https://tecyfy.com/coding-agents)

- **Claude Code** (Anthropic, https://code.claude.com/docs/en/overview): Anthropic's coding agent, using Claude models, in the terminal, VS Code, JetBrains, a desktop app and on the web. Install: `curl -fsSL https://claude.ai/install.sh | bash`
- **Cursor** (Cursor, https://cursor.com/docs/agent/overview): An AI code editor with an agent built in, plus a CLI and cloud agents, using Cursor's own models or other makers' models. Install: `curl https://cursor.com/install -fsS | bash`
- **Codex** (OpenAI, https://developers.openai.com/codex/cli): OpenAI's coding agent, using OpenAI's models, in an open-source CLI, an IDE extension, the ChatGPT desktop app and the cloud. Install: `curl -fsSL https://chatgpt.com/codex/install.sh | sh`

An AI coding [Agent](https://tecyfy.com/concepts/agent) works in your project the way a developer would: it reads files, changes them and runs commands such as your tests, checking the results until the task is done. Claude Code, Cursor and Codex all work that way, and on a well-described task they all get far. The differences that matter day to day are where you use each one, which models it runs, how you pay, and, most of all, how you limit what it may touch.

## Claude Code

Claude Code is Anthropic's agent. It began in the terminal and now runs in VS Code, JetBrains, a desktop app and on the web, with the same settings everywhere. It uses Claude models only, paid through a Claude plan or per token through the Anthropic Console or a cloud provider. Its strength is control: permission rules per tool, such as allowing `npm test` while denying `.env`, several permission modes, [subagents](https://tecyfy.com/concepts#subagent), skills, hooks and plugins. The guide covers each one, starting at [Claude Code, topic by topic](/coding-agents/claude-code).

## Cursor

Cursor is a code editor built around AI, with the agent beside tab completion and inline edits. It also has a CLI, `agent`, and cloud agents that keep working while you are away. Cursor sells its own models in a weekly usage pool and, on Premium and above, other makers' models, Claude, GPT and Gemini among them, at their API list price. Its instructions are rule files that apply always, to matching files, or when the agent judges them relevant, and it reads AGENTS.md too.

## Codex

Codex is OpenAI's agent: an open-source CLI, an IDE extension, the ChatGPT desktop app and cloud tasks, all using OpenAI's models and included in paid ChatGPT plans. It starts the most locked down of the 3. Commands run in an operating-system sandbox that limits writes to the project and turns the network off, with an approval policy deciding when it asks you, and permission profiles and rules files to adjust both.

## Side by side

| | Claude Code | Cursor | Codex |
| --- | --- | --- | --- |
| **Where it runs** | Terminal, VS Code, JetBrains, a desktop app and the web. | Its own editor, a CLI (agent) and cloud agents you check on the web or a phone. | A CLI, an IDE extension, the ChatGPT desktop app, the web and iOS. |
| **Models** | Claude models, from Anthropic or through cloud providers such as Amazon Bedrock. | Cursor's own models in the plan; Claude, GPT and Gemini at API list price on Premium and above. | OpenAI's models. With an API key, the models that key can use. |
| **How you pay** | A Claude plan (Pro, Max, Team or Enterprise) or an Anthropic Console account paid per token. | Plans from $8 to $200 a month with a weekly usage pool; Teams from $30 a seat. | A ChatGPT plan (Plus $20 a month, Pro from $100, Business) or an API key paid per token. |
| **Project instructions** | CLAUDE.md. Reads AGENTS.md instead when the project has no CLAUDE.md. | Rule files in .cursor/rules, each with when it applies, or AGENTS.md, nested by folder. | AGENTS.md from the project root down to the current folder, up to 32 KiB by default. |
| **Permission rules** | Allow, ask and deny rules per tool in settings.json, such as Bash(npm test) or Read(./.env), plus modes. | Allow and deny rules in .cursor/cli.json for the CLI; run modes and an allowlist in the editor. | An approval policy, permission profiles for files and network, and rules files for commands. |
| **Sandbox** | An operating-system sandbox for shell commands, off until you turn it on. | A sandbox for terminal commands, set by your run mode. | An operating-system sandbox, on by default, with the network off. |
| **MCP servers** | .mcp.json in the project, or claude mcp add. | .cursor/mcp.json in the project, or ~/.cursor/mcp.json for every project. | [mcp_servers] in config.toml, or codex mcp add. |
| **Hooks** | Shell commands on events such as PreToolUse and Stop, in settings.json. | hooks.json, with events such as beforeShellExecution; can load Claude Code's hooks. | hooks.json or [hooks] in config.toml, with events such as PreToolUse and Stop. |
| **Scripts and CI** | claude -p "task", with the tools it may use. | agent -p "task"; add --force to let it change files. | codex exec "task". |
| **Source code** | Closed. | Closed. | The CLI is open source, under Apache 2.0. |

## The same project, set up for each

Start with the instructions every agent shares. All 3 read an AGENTS.md at the project root, so a team using several agents keeps one copy of its conventions:

```markdown
# Shop API

- Install with `npm ci`. Run `npm test` before you say a change is done.
- The code is TypeScript in `src/`; each test sits beside its file as `*.test.ts`.
- Never open or print `.env`. If you need a value from it, ask.
- Never push. Leave the branch for review.
```

An instruction is only guidance. A model can misread it, and text inside a file or web page it reads can try to override it, which is [prompt injection](https://tecyfy.com/concepts/prompt-injection). So each agent also gets a file that enforces the rules that matter.

The same project set up for each agent: a TypeScript API whose instructions say to run the tests, never open .env and never push. The AGENTS.md above serves all 3; each agent then gets its own file that keeps the agent away from .env. Codex's files were run with Codex CLI 0.162: it loaded AGENTS.md into its prompt, and its sandbox refused cat .env and writes outside the project. Claude Code's settings were checked against the published settings schema, and the same sandbox limits run with Anthropic's sandbox runtime, which Claude Code is built on, refused .env even to a Node script. Cursor's file follows its documented format; Cursor's CLI was not run.

### Claude Code: `.claude/settings.json`

```json
{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": ["Bash(npm test)", "Bash(npm run lint)"],
    "deny": ["Read(./.env)", "Read(./.env.*)", "Bash(git push *)"]
  },
  "sandbox": {
    "enabled": true,
    "filesystem": { "denyRead": ["./.env", "./.env.*"] }
  }
}
```

The permission rules run the tests without asking, refuse git push, and refuse .env to Claude's file tools and to commands it recognises, such as cat. The sandbox blocks .env for every shell command, including a script that opens the file itself.

### Cursor: `.cursor/cli.json`

```json
{
  "permissions": {
    "allow": ["Shell(npm:test)", "Shell(npm:run lint)"],
    "deny": ["Read(.env*)", "Shell(git:push*)"]
  }
}
```

Cursor's CLI reads permissions from this project file; deny wins over allow. In the editor, .env files are on Cursor's default ignore list already, but its docs say ignore files do not stop the terminal or MCP tools.

### Codex: `.codex/config.toml`

```toml
approval_policy = "on-request"
default_permissions = "shop"

[permissions.shop]
extends = ":workspace"

[permissions.shop.filesystem.":workspace_roots"]
"**/.env*" = "deny"
```

The profile extends Codex's built-in workspace profile, which lets commands write inside the project only, and denies .env files to every command. Codex loads a project's .codex folder only once you trust the project.

The 3 files enforce them at different depths. Cursor's rules govern its CLI's own tools. Claude Code's rules cover its file tools and the commands it recognises, such as `cat`, and its sandbox, once enabled, blocks `.env` for every process a command starts. Codex's profile works at that same operating-system level from the start. When we ran the Codex profile, `cat .env` failed with "Operation not permitted", while writing a file inside `src/` worked.

Codex keeps rules for commands in their own files. This one forbids pushing; `match` and `not_match` are examples Codex checks when it loads the file, so a wrong pattern fails at once. `codex execpolicy check` confirmed that `git push origin main` is forbidden and `npm test` is untouched:

```python
# .codex/rules/default.rules
prefix_rule(
    pattern = ["git", "push"],
    decision = "forbidden",
    justification = "Leave the branch for review; never push.",
    match = ["git push", "git push origin main"],
    not_match = ["git status"],
)
```

## Which to use

- **I live in the terminal and want Claude models:** Claude Code. It is built around the terminal, with the same agent in VS Code, JetBrains and the desktop app, and Claude models only.
- **I want an editor with the agent built in:** Cursor. Cursor is the editor itself, with tab completion, inline edits and the agent in one place.
- **I want to switch between models from several makers:** Cursor. Cursor offers its own models and, on Premium and above, Claude, GPT and Gemini, chosen per task.
- **I already pay for ChatGPT:** Codex. Codex is included in ChatGPT Plus, Pro and Business, in the CLI, IDE extension and cloud.
- **The agent must not be able to read secrets or reach the network:** Codex or Claude Code. Codex's sandbox is on by default and blocks files you deny for every process. Claude Code's does the same once you turn it on.
- **Agents in CI or scripts:** Claude Code or Cursor or Codex. All 3 have a print mode for one task and an exit; give each only the permissions the job needs.
- **One team, several agents:** Claude Code or Cursor or Codex. Keep shared instructions in AGENTS.md, which all 3 read, and each agent's limits in its own file.

## Things to watch

- **Instructions are not limits.** Anything that must never happen, such as reading secrets or pushing, belongs in permission rules or a sandbox, not only in AGENTS.md or CLAUDE.md.
- **Keep instructions short.** Every line is read on every task and takes room in the [context window](https://tecyfy.com/concepts/context-window). Codex stops adding AGENTS.md files at 32 KiB by default.
- **Trust before project settings load.** Codex ignores a project's `.codex` folder until you trust the project, and Claude Code asks before using files a project imports from outside it. A cloned repository's settings are someone else's choices.
- **[MCP](https://tecyfy.com/concepts/model-context-protocol) servers run with your access.** All 3 can connect them. Add only servers you trust, and allow their tools one at a time.

To set Claude Code up for your own project, the [settings builder](/coding-agents/claude-code/settings-builder) writes the settings.json, MCP file and starter CLAUDE.md. To see what each Claude model costs per task, use the [LLM cost calculator](/prices/cost-calculator).

## Questions

### What is the difference between Claude Code, Cursor and Codex?

All 3 are AI coding agents that read code, edit files and run commands. Claude Code is Anthropic's, with Claude models, in the terminal, IDEs, a desktop app and the web. Cursor is an AI code editor, with a CLI and cloud agents, and models from several makers. Codex is OpenAI's, with OpenAI's models, in an open-source CLI, an IDE extension, the ChatGPT app and the cloud.

### Which is best, Claude Code, Cursor or Codex?

There is no single best; it depends on how you work. If you want an editor, Cursor. If you work in the terminal, both Claude Code and Codex are built for it, and the choice is mostly the model family you prefer and how strictly you want the agent fenced in. Try each on a real task from your project before deciding.

### Can Cursor use Claude models?

Yes. On Cursor's Premium plan and above, third-party models including Claude, GPT and Gemini are available at the maker's API list price, paid from prepaid credit. They are not part of the plan's included usage pool, which covers Cursor's own models.

### Do Claude Code, Cursor and Codex all read AGENTS.md?

Yes. Codex and Cursor read AGENTS.md by default, including files in subfolders. Claude Code reads AGENTS.md when the project has no CLAUDE.md, or you can import it from a CLAUDE.md with @AGENTS.md. One AGENTS.md can hold the instructions every agent on a team shares.

### Is Codex free?

No. Codex is included in paid ChatGPT plans, from Plus at $20 a month, or you can use it with an OpenAI API key and pay per token. The Codex CLI itself is open source under the Apache 2.0 licence.

### Which coding agent is the safest?

Codex starts the most locked down, with an operating-system sandbox on by default that limits writes to the project and turns the network off. Claude Code has the same kind of sandbox, off until you enable it, and the most detailed permission rules. In every agent, rules in an instructions file are guidance; only permission rules and the sandbox enforce limits.

### Can I use more than one coding agent on the same project?

Yes. Put the shared instructions in AGENTS.md and give each agent its own permission file, .claude/settings.json, .cursor/cli.json and .codex/config.toml, as in the example above. Each agent ignores the others' files.

## Sources

- [Claude Code overview](https://code.claude.com/docs/en/overview)
- [How Claude remembers your project](https://code.claude.com/docs/en/memory)
- [Configure permissions](https://code.claude.com/docs/en/permissions)
- [Sandboxing](https://code.claude.com/docs/en/sandboxing)
- [Connect Claude Code to tools via MCP](https://code.claude.com/docs/en/mcp)
- [Hooks reference](https://code.claude.com/docs/en/hooks)
- [Run Claude Code programmatically](https://code.claude.com/docs/en/headless)
- [Rules](https://cursor.com/docs/context/rules)
- [CLI](https://cursor.com/docs/cli/overview)
- [CLI permissions](https://cursor.com/docs/cli/reference/permissions)
- [Headless CLI](https://cursor.com/docs/cli/headless)
- [Ignore file](https://cursor.com/docs/context/ignore-files)
- [Agent security](https://cursor.com/docs/agent/security)
- [Terminal](https://cursor.com/docs/agent/tools/terminal)
- [Model Context Protocol (MCP)](https://cursor.com/docs/context/mcp)
- [Hooks](https://cursor.com/docs/agent/hooks)
- [Models and pricing](https://cursor.com/docs/models)
- [Codex CLI](https://developers.openai.com/codex/cli)
- [Custom instructions with AGENTS.md](https://developers.openai.com/codex/guides/agents-md)
- [Agent approvals and security](https://developers.openai.com/codex/agent-approvals-security)
- [Permissions](https://developers.openai.com/codex/permissions)
- [Rules](https://developers.openai.com/codex/rules)
- [Config basics](https://developers.openai.com/codex/config-basic)
- [Hooks](https://developers.openai.com/codex/hooks)
- [Model Context Protocol](https://developers.openai.com/codex/mcp)
- [Codex pricing](https://developers.openai.com/codex/pricing)
- [openai/codex](https://github.com/openai/codex)