Skip to content

feat: use encrypted local secrets for MCP OAuth - #27541

Merged
celia-oai merged 2 commits into
mainfrom
codex/encrypted-mcp-oauth
Jun 12, 2026
Merged

feat: use encrypted local secrets for MCP OAuth#27541
celia-oai merged 2 commits into
mainfrom
codex/encrypted-mcp-oauth

Conversation

@celia-oai

Copy link
Copy Markdown
Contributor

Summary

  • store MCP OAuth credentials in the configured auth credential backend
  • support encrypted-local OAuth storage, including legacy keyring migration
  • propagate the credential backend through MCP refresh, session, CLI, and app-server paths

Stack

  1. feat: add secret auth storage configuration #27504 — config and feature flag
  2. feat: add auth-specific encrypted secret namespaces #27535 — auth-specific secret namespaces
  3. feat: use encrypted local secrets for CLI auth #27539 — encrypted CLI auth storage
  4. this PR — encrypted MCP OAuth storage

This is a parallel review stack; the original #17931 remains unchanged.

Tests

  • just test -p codex-rmcp-client (the transport round-trip test passed after building the required codex binary and retrying)
  • just test -p codex-mcp
  • just test -p codex-app-server refresh_config_uses_latest_auth_keyring_backend
  • just test -p codex-core refresh_mcp_servers_is_deferred_until_next_turn
  • just test -p codex-cli mcp
  • just fix -p codex-rmcp-client -p codex-mcp -p codex-core -p codex-cli -p codex-app-server -p codex-protocol
  • just bazel-lock-check

@celia-oai
celia-oai marked this pull request as ready for review June 11, 2026 04:56
@celia-oai
celia-oai requested a review from a team as a code owner June 11, 2026 04:56
@celia-oai celia-oai changed the title Use encrypted local secrets for MCP OAuth feat: use encrypted local secrets for MCP OAuth Jun 11, 2026
@celia-oai
celia-oai requested a review from aibrahim-oai June 11, 2026 04:58

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e606b34c96

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread codex-rs/rmcp-client/Cargo.toml
Comment thread codex-rs/rmcp-client/src/oauth.rs
Comment thread codex-rs/rmcp-client/src/oauth.rs
@celia-oai
celia-oai force-pushed the codex/encrypted-cli-auth-storage branch 3 times, most recently from b8c2e75 to d43079b Compare June 12, 2026 20:58
@celia-oai
celia-oai force-pushed the codex/encrypted-mcp-oauth branch from e606b34 to bf3d667 Compare June 12, 2026 21:18
Base automatically changed from codex/encrypted-cli-auth-storage to main June 12, 2026 21:23
@celia-oai
celia-oai force-pushed the codex/encrypted-mcp-oauth branch from bf3d667 to bc08fad Compare June 12, 2026 21:29
@celia-oai
celia-oai enabled auto-merge (squash) June 12, 2026 21:48
@celia-oai
celia-oai merged commit 9915d34 into main Jun 12, 2026
31 checks passed
@celia-oai
celia-oai deleted the codex/encrypted-mcp-oauth branch June 12, 2026 22:03
@github-actions github-actions Bot locked and limited conversation to collaborators Jun 12, 2026
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants