feat(cli): enable cancellable scans over MCP

[kmbroai]

Summary

MCP clients can currently inspect CLI metadata but cannot run security scans. This change exposes a scan tool through codex-security --mcp, so another agent can run scans and receive structured results without invoking a shell command for each scan.

Changes

• Reuse the existing CLI scan schemas, option mapping, and execution path for standard, Deep, path, and Git diff scans, including dry runs.
• Use the MCP SDK directly to forward request cancellation, cancel active scans on disconnect or server shutdown, and wait for runtime cleanup. Keep diagnostics on stderr and protocol messages on stdout.
• Handle cancellation for zero and empty-string request IDs, including cancellation before tool validation completes, and retain stdout error handling until the output stream closes.
• Return each scan's { exitCode, data?, error? } outcome, preserving findings when coverage is incomplete or a severity policy fails. Keep concurrent requests independent.
• Keep patching, PR creation, and other commands outside the MCP scan tool. Update metadata, MCP registration diagnostics, documentation, and installed-package smoke coverage.

Testing

• Full regression suite with random seed and seed 12345: 1,937 passed, 29 platform skips, 0 failed in each run. Tests ran with umask 077 so temporary outputs satisfy the existing permission checks.
• TypeScript type checking, model-generation consistency, production build, package formatting, and git diff --check: passed.
• Built npm tarball validation and installed-package smoke: passed, including MCP initialization, tool discovery, metadata, and a scan dry run without a model call.
• Three independent native code reviews and an independent verification of their results: passed on the final commit.

Risk and rollout

This adds the scan tool to the existing stdio --mcp interface; existing CLI flags and defaults remain unchanged. MCP scan arguments use camelCase option names and exclude patch, patchSeverity, and createPr. info.scanMcp now reports true.

The server runs locally with its configured credentials and filesystem access. Scans may incur model costs, write artifacts, and run repository tools. Clients must allow enough time for scans and use cancellation to stop unwanted work. No network listener or separate service is introduced. The direct MCP SDK dependency uses the version already present through Incur.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-08-27T18:55:14.962737Z	b109ea3	PR opened

Security findings

Advisory findings (1)

• 🟡 Restrict MCP scans to operator-authorized inputs · High

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Security Review

Here are some automated security review suggestions for this pull request.

Reviewed commit: b109ea3440

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.