feat: filter MCP messaging tools by host - #89
Conversation
🦋 Changeset detectedLatest commit: 9ddc525 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 688c0bf115
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Codex MCP clients receive Grok messaging and approval tools; truthfully identified | ||
| Grok Bot clients receive Codex messaging and approval tools. Bridge start/status/stop |
There was a problem hiding this comment.
When this bundled skill is loaded by a Codex client, the new inventory correctly omits codex_send, codex_threads, codex_wait, and codex_watch, but the same skill still advertises Codex-thread access through those tools in its frontmatter (line 3) and says the generated Codex plugin exposes them (lines 75–84). This contradictory guidance can make Codex attempt tools that the server now rejects; update the earlier host-agnostic instructions to describe which hosts actually receive the Codex tool set.
Useful? React with 👍 / 👎.
1 participant
Filter the MCP inventory by negotiated host identity: Codex receives Grok messaging/approval tools, truthfully identified Grok Bot receives Codex tools, and shared bridge controls remain available. Cursor and unknown clients retain both inventories. Pin compiler/runtime to verified immutable Agent Bundle build
57a9196caf2590ece001799eaeed92613352bc21and document the host contract.Validation: clean
npm ciandnpm run checkpass (393 unit and 15 MCP route tests). Native SDK tests verify exact Codex/Grok/Cursor lists and refusal of direct calls to every hidden tool. Source-free packed install and all three executable help probes pass. Published tarball hashes match lock SRIs; no local dependency links remain. Independent different-model review: PASS. A minor changeset is included.Grok filtering requires a truthful negotiated Grok identity. Production Grok currently has only source-level identity evidence; ordinary Cursor is never treated as Grok. Inventory filtering does not replace authorization.