mirror of
https://github.com/openai/codex.git
synced 2026-10-27 00:00:53 +00:00
stevenlee-oai
9be8d6e1c3
## Why MCP servers can share an OAuth callback URL. Without a validated issuer or a server-specific callback path, an authorization response could be associated with the wrong server. ## What changed - Use stable callbacks when authorization metadata advertises issuer-bound responses, and validate the returned issuer before exchanging the code. - Retain server-specific callback IDs for providers without issuer support, including fallback to the global or default callback for legacy registered clients. - Persist registered callback URLs for MCP servers and plugins, and insert the active listener port into portless loopback redirects. ## Testing Add coverage for issuer validation, callback-mode discovery, registered and legacy clients, plugin OAuth, CLI persistence, and loopback listener ports. GitOrigin-RevId: 2878c92e237fc17fd3def0bd2e1cce3e104a3db8
115 lines
4.3 KiB
Rust
115 lines
4.3 KiB
Rust
pub use binding::McpBinding;
|
|
pub use binding::PreparedMcpCall;
|
|
pub use client_capabilities::client_mcp_extensions;
|
|
pub use codex_rmcp_client::McpProtocolMode;
|
|
pub use connection_manager::tool_is_model_visible;
|
|
pub use elicitation::ElicitationLifecycle;
|
|
pub use elicitation::ElicitationReviewRequest;
|
|
pub use elicitation::ElicitationReviewer;
|
|
pub use elicitation::ElicitationReviewerHandle;
|
|
pub use resource_client::McpEventCatalogSnapshot;
|
|
pub use resource_client::McpEventDefinition;
|
|
pub use resource_client::McpEventNotification;
|
|
pub use resource_client::McpEventStream;
|
|
pub use resource_client::McpResourceClient;
|
|
pub use resource_client::McpResourceClientCacheKey;
|
|
pub use resource_client::McpResourcePage;
|
|
pub use resource_client::McpResourceReadResult;
|
|
pub use rmcp::model::ReadResourceRequestParams;
|
|
pub use rmcp_client::MCP_SANDBOX_STATE_META_CAPABILITY;
|
|
pub use runtime::McpRuntime;
|
|
pub use runtime::McpRuntimeContext;
|
|
pub use runtime::McpRuntimeInput;
|
|
pub use runtime::McpStartupPolicy;
|
|
pub use runtime::SandboxState;
|
|
pub use runtime::apply_http_headers_helper;
|
|
pub use tool_catalog_cache::McpToolCatalogCache;
|
|
pub use tools::ToolInfo;
|
|
|
|
/// Backward-compatible name for the shared Codex Apps tools runtime.
|
|
pub type CodexAppsToolsCache = codex_connectors::ConnectorRuntimeManager<ToolInfo>;
|
|
/// Backward-compatible name for the Codex Apps runtime context key.
|
|
pub type CodexAppsToolsCacheKey = codex_connectors::ConnectorRuntimeContextKey;
|
|
|
|
pub use catalog::McpCatalogBuilder;
|
|
pub use catalog::McpEnvironmentAuthority;
|
|
pub use catalog::McpPluginAttribution;
|
|
pub use catalog::McpServerConflict;
|
|
pub use catalog::McpServerConflictAction;
|
|
pub use catalog::McpServerRegistration;
|
|
pub use catalog::McpServerSource;
|
|
pub use catalog::ResolvedMcpCatalog;
|
|
pub use catalog::ResolvedMcpServer;
|
|
|
|
pub use mcp::CODEX_APPS_MCP_SERVER_NAME;
|
|
pub use mcp::McpConfig;
|
|
pub use mcp::ToolPluginProvenance;
|
|
pub use server::EffectiveMcpServer;
|
|
|
|
pub use auth_elicitation::CodexAppsAuthElicitation;
|
|
pub use auth_elicitation::CodexAppsAuthElicitationPlan;
|
|
pub use auth_elicitation::CodexAppsConnectorAuthFailure;
|
|
pub use auth_elicitation::MCP_TOOL_CODEX_APPS_META_KEY;
|
|
pub use auth_elicitation::auth_elicitation_completed_result;
|
|
pub use auth_elicitation::auth_elicitation_id;
|
|
pub use auth_elicitation::build_auth_elicitation;
|
|
pub use auth_elicitation::build_auth_elicitation_plan;
|
|
pub use auth_elicitation::connector_auth_failure_from_tool_result;
|
|
/// Backward-compatible name for the Codex Apps runtime context key builder.
|
|
pub use codex_connectors::connector_runtime_context_key as codex_apps_tools_cache_key;
|
|
pub use mcp::codex_apps_mcp_server_config;
|
|
pub use mcp::configured_mcp_servers;
|
|
pub use mcp::effective_mcp_servers;
|
|
pub use mcp::effective_mcp_servers_from_configured;
|
|
pub use mcp::host_owned_codex_apps_enabled;
|
|
pub use mcp::hosted_plugin_runtime_mcp_server_config;
|
|
pub use mcp::tool_plugin_provenance;
|
|
pub use plugin_config::PluginMcpConfigParseOutcome;
|
|
pub use plugin_config::PluginMcpServerParseError;
|
|
pub use plugin_config::parse_agent_plugin_mcp_config;
|
|
pub use plugin_config::parse_executor_plugin_mcp_config;
|
|
pub use plugin_config::parse_plugin_mcp_config;
|
|
|
|
pub use mcp::McpServerStatusSnapshot;
|
|
pub use mcp::McpSnapshotDetail;
|
|
pub use mcp::collect_mcp_server_status_snapshot_with_detail;
|
|
pub use mcp::read_mcp_resource;
|
|
|
|
pub use mcp::McpAuthStatusEntry;
|
|
pub use mcp::McpOAuthLoginConfig;
|
|
pub use mcp::McpOAuthLoginSupport;
|
|
pub use mcp::McpOAuthScopesSource;
|
|
pub use mcp::ResolvedMcpOAuthScopes;
|
|
pub use mcp::compute_auth_statuses;
|
|
pub use mcp::discover_supported_scopes;
|
|
pub use mcp::oauth_login_support;
|
|
pub use mcp::resolve_oauth_callback;
|
|
pub use mcp::resolve_oauth_scopes;
|
|
pub use mcp::should_retry_without_scopes;
|
|
|
|
pub use codex_apps::declared_openai_file_input_param_names;
|
|
pub use mcp::McpPermissionPromptAutoApproveContext;
|
|
pub use mcp::mcp_permission_prompt_is_auto_approved;
|
|
pub use mcp::qualified_mcp_tool_name_prefix;
|
|
|
|
pub(crate) mod auth_elicitation;
|
|
mod binding;
|
|
pub(crate) mod binding_clients;
|
|
mod catalog;
|
|
mod client_capabilities;
|
|
pub(crate) mod codex_apps;
|
|
pub(crate) mod connection_manager;
|
|
pub(crate) mod elicitation;
|
|
mod executor_environment_http_client;
|
|
pub(crate) mod mcp;
|
|
mod openai_docs_source_attribution;
|
|
mod pagination;
|
|
mod plugin_config;
|
|
mod resource_client;
|
|
mod resource_origin;
|
|
pub(crate) mod rmcp_client;
|
|
pub(crate) mod runtime;
|
|
pub(crate) mod server;
|
|
mod tool_catalog_cache;
|
|
pub(crate) mod tools;
|