Repository navigation
[Decision] Are Codex MCP file-write tools in scope for the write gate? #270
Description
Activity
Decision recorded: MCP file-write tools are out of scope for the write gate — for now, on both hosts.
Consistent with the accepted Claude-side gap under ADR-0010 (cooperative-agent trust model). The codex sprint will document this explicitly in
security-controls.md(bothmcp__*on Codex and the equivalent Claude MCP write tools are out of scope for the write-path guards).This issue stays OPEN as a tracked near-future item: MCP-driven writes should be brought under the write gate for both Claude and Codex. Not a codex-branch blocker.
Sprint backlog-burn-2026-07-17: security trust-boundary decision — hard gate, not auto-decidable. Note: tribunal 2026-07-17 confirmed the same MCP-write gap class remains accepted residual under ADR-0010 on both hosts (see security-controls.md). Left open for user decision.
- added a commit that references this issue
on Jul 25, 2026
[Decision] Are Codex MCP file-write tools in scope for the write gate?
Type: decision-required (discussion, not a fix ticket)
Where:
plugins/ca-codex/hooks/hooks.json:16-55plugins/ca-codex/hooks/_host.py:163-169Question:
Codex MCP tools (mcp__*) normalize to OTHER and bypass every write-path guard, so an MCP filesystem/write server can overwrite CONTEXT.md, forge a gate marker, or truncate an audit log with no hook firing. This mirrors an accepted Claude-side gap under the ADR-0010 cooperative-agent trust model, but the dual-host work widens it.
Options / considerations:
Decision belongs in security-controls.md / an ADR, not a straight fix.