[codex] Gate plugin MCP servers by auth route by felixxia-oai · Pull Request #27459 · openai/codex

felixxia-oai · 2026-06-10T20:44:08Z

Context

Some plugins expose both Apps and MCP servers. This PR moves auth-aware surface projection into core-plugins::PluginsManager, so callers get a consistent effective plugin view. Later PRs narrow the conflict rule and update listing/install paths.

The high level goal of this PR is to set up the plumbing to conditionally filter App/MCP in the plugin manager layer. We start by removing MCP servers when using SIWC/Codex-backend auth, and removing Apps when using API-key-style auth.

This PR is now stacked on #27652, which contains only the constructor plumbing for seeding PluginsManager with the current auth mode.

Stack

PR1: [codex] Add auth mode to plugin manager constructor #27652 seed plugin manager auth at construction.
PR2: [codex] Gate plugin MCP servers by auth route #27459 route plugin surfaces by auth mode.
PR3: [codex] Dedupe plugin MCPs by app declaration name #27607 dedupe plugin MCP servers by App declaration name.
PR4: [codex] Preserve plugin apps in connector listings #27602 preserve plugin Apps in connector listings.
PR5: [codex] Skip plugin MCP OAuth for matching app routes #27461 skip install-time plugin MCP OAuth for matching App routes.

Summary

API-key/non-ChatGPT routes hide plugin Apps and keep plugin MCPs.
ChatGPT/SIWC with Apps enabled keeps plugin Apps and suppresses MCPs for dual-surface plugins.
MCP-only plugins stay available for ChatGPT/SIWC sessions.
Cached plugin load outcomes are re-projected when auth mode changes.

Validation

cargo test -p codex-core-plugins plugin_auth_projection
cargo test -p codex-core list_tool_suggest_discoverable_plugins
git diff --check

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e7cd1d0fc2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

felixxia-oai · 2026-06-11T15:26:10Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1170ba5097

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

felixxia-oai · 2026-06-11T20:20:34Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 621b968ad8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

## Context Plugins can expose more than one way for Codex to use them: App connectors for ChatGPT/SIWC-backed sessions and MCP servers for API key login sessions. The broader goal is to make `PluginsManager` the place that understands which plugin surfaces should be visible for the current auth route, so callers do not each have to make that decision themselves. This PR is the small setup step for that work. It lets the plugin manager be created with the current `AuthMode`, which gives the followup auth routing PRs the information they need without relying on setter injection. ## Stack - PR1: #27652 seed plugin manager auth at construction. - PR2: #27459 route plugin surfaces by auth mode. - PR3: #27607 dedupe plugin MCP servers by App declaration name. - PR4: #27602 preserve plugin Apps in connector listings. - PR5: #27461 skip install-time plugin MCP OAuth for matching App routes. ## Summary - Let `PluginsManager::new_with_restriction_product` accept an initial `AuthMode`. - Keep `PluginsManager::new` behavior unchanged for ordinary callers. ## Validation ```bash cargo test -p codex-core-plugins plugins_manager_tracks_auth_mode cargo test -p codex-core list_tool_suggest_discoverable_plugins git diff --check ``` --------- Co-authored-by: Xin Lin <xl@openai.com>

This was referenced Jun 10, 2026

[codex] Skip plugin MCP OAuth for matching app routes #27461

Merged

[codex] Cover auth-routed plugin tool visibility #27460

Closed

felixxia-oai force-pushed the plugin-auth-routing-route-model branch 3 times, most recently from 272c710 to e7cd1d0 Compare June 10, 2026 21:54

felixxia-oai marked this pull request as ready for review June 10, 2026 23:03

felixxia-oai requested a review from a team as a code owner June 10, 2026 23:03

chatgpt-codex-connector Bot reviewed Jun 10, 2026

View reviewed changes

Comment thread codex-rs/codex-mcp/src/mcp/mod.rs Outdated

xl-openai reviewed Jun 11, 2026

View reviewed changes

Comment thread codex-rs/codex-mcp/src/mcp/mod.rs Outdated

felixxia-oai marked this pull request as draft June 11, 2026 10:50

felixxia-oai force-pushed the plugin-auth-routing-route-model branch 2 times, most recently from 879d237 to 74c31a9 Compare June 11, 2026 13:22

This was referenced Jun 11, 2026

[codex] Preserve plugin apps in connector listings #27602

Merged

[codex] Dedupe plugin MCPs by app declaration name #27607

Merged

felixxia-oai force-pushed the plugin-auth-routing-route-model branch 2 times, most recently from 4c5aac2 to 1170ba5 Compare June 11, 2026 13:54

chatgpt-codex-connector Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread codex-rs/core-plugins/src/manager.rs Outdated

Comment thread codex-rs/core-plugins/src/manager.rs

Comment thread codex-rs/core-plugins/src/manager.rs Outdated

felixxia-oai marked this pull request as ready for review June 11, 2026 16:40

xl-openai reviewed Jun 11, 2026

View reviewed changes

Comment thread codex-rs/core-plugins/src/manager.rs Outdated

xl-openai reviewed Jun 11, 2026

View reviewed changes

Comment thread codex-rs/core-plugins/src/manager.rs Outdated

felixxia-oai marked this pull request as draft June 11, 2026 18:25

felixxia-oai force-pushed the plugin-auth-routing-route-model branch 4 times, most recently from b3ab11a to 6deaa65 Compare June 11, 2026 18:49

felixxia-oai changed the base branch from main to plugin-auth-manager-constructor June 11, 2026 18:50

felixxia-oai force-pushed the plugin-auth-manager-constructor branch from 495f1f4 to c9ab74c Compare June 11, 2026 19:59

felixxia-oai force-pushed the plugin-auth-routing-route-model branch from 6deaa65 to 621b968 Compare June 11, 2026 19:59

chatgpt-codex-connector Bot reviewed Jun 11, 2026

View reviewed changes

Comment thread codex-rs/core-plugins/src/manager.rs

Comment thread codex-rs/core-plugins/src/manager.rs

felixxia-oai mentioned this pull request Jun 11, 2026

[codex] Add auth mode to plugin manager constructor #27652

Merged

felixxia-oai marked this pull request as ready for review June 11, 2026 20:37

felixxia-oai force-pushed the plugin-auth-manager-constructor branch from 6c179f8 to a6b6373 Compare June 11, 2026 21:00

felixxia-oai force-pushed the plugin-auth-routing-route-model branch from 621b968 to e55428e Compare June 11, 2026 21:01

felixxia-oai force-pushed the plugin-auth-manager-constructor branch from a6b6373 to df88645 Compare June 11, 2026 21:12

felixxia-oai force-pushed the plugin-auth-routing-route-model branch from e55428e to bca8d5d Compare June 11, 2026 21:15

xl-openai approved these changes Jun 12, 2026

View reviewed changes

felixxia-oai force-pushed the plugin-auth-manager-constructor branch from df88645 to ba2f04d Compare June 12, 2026 09:38

felixxia-oai force-pushed the plugin-auth-routing-route-model branch from bca8d5d to 1816572 Compare June 12, 2026 09:44

sayan-oai approved these changes Jun 12, 2026

View reviewed changes

stefanstokic-oai mentioned this pull request Jun 12, 2026

Opened in error #27938

Closed

xl-openai force-pushed the plugin-auth-manager-constructor branch from 490f500 to 57bc034 Compare June 13, 2026 00:28

github-actions Bot mentioned this pull request Jun 13, 2026

📊 AI CLI 工具社区动态日报 2026-06-13 zx0828/big_model_radar#115

Open

Base automatically changed from plugin-auth-manager-constructor to main June 13, 2026 01:00

xl-openai force-pushed the plugin-auth-routing-route-model branch from 1816572 to 8289ca0 Compare June 13, 2026 01:16

Route plugin surfaces by backend auth mode

c3f075e

xl-openai force-pushed the plugin-auth-routing-route-model branch from 8289ca0 to c3f075e Compare June 13, 2026 01:25

xl-openai merged commit 5d7db08 into main Jun 13, 2026
31 checks passed

xl-openai deleted the plugin-auth-routing-route-model branch June 13, 2026 02:42

github-actions Bot locked and limited conversation to collaborators Jun 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[codex] Gate plugin MCP servers by auth route#27459

[codex] Gate plugin MCP servers by auth route#27459
xl-openai merged 1 commit into
mainfrom
plugin-auth-routing-route-model

felixxia-oai commented Jun 10, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

felixxia-oai commented Jun 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

felixxia-oai commented Jun 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

felixxia-oai commented Jun 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Context

Stack

Summary

Validation

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

felixxia-oai commented Jun 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

felixxia-oai commented Jun 11, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

felixxia-oai commented Jun 10, 2026 •

edited

Loading