core: use codex-mcp APIs directly (#16510)

## Why

`codex-mcp` already owns the shared MCP API surface, including `auth`,
`McpConfig`, `CODEX_APPS_MCP_SERVER_NAME`, and tool-name helpers in
[`codex-rs/codex-mcp/src/mcp/mod.rs`](https://github.com/openai/codex/blob/f61e85dbfb5373cde6827d232ac8ea447c237e81/codex-rs/codex-mcp/src/mcp/mod.rs#L1-L35).
Re-exporting that surface from `codex_core::mcp` gives downstream crates
two import paths for the same API and hides the real crate dependency.

This PR keeps `codex_core::mcp` focused on the local `McpManager`
wrapper in
[`codex-rs/core/src/mcp.rs`](https://github.com/openai/codex/blob/f61e85dbfb5373cde6827d232ac8ea447c237e81/codex-rs/core/src/mcp.rs#L13-L40)
and makes consumers import shared MCP APIs from `codex_mcp` directly.

## What

- Remove the `codex_mcp::mcp` re-export surface from `core/src/mcp.rs`.
- Update `codex-core` internals plus `codex-app-server`, `codex-cli`,
and `codex-tui` test code to import MCP APIs from `codex_mcp::mcp`
directly.
- Add explicit `codex-mcp` dependencies where those crates now use that
API surface, and refresh `Cargo.lock`.

## Verification

- `just bazel-lock-check`
- `cargo test -p codex-core -p codex-cli -p codex-tui`
  - `codex-cli` passed.
- `codex-core` still fails five unrelated config tests in
`core/src/config/config_tests.rs` (`approvals_reviewer_*` and
`smart_approvals_alias_*`).
- A broader `cargo test -p codex-core -p codex-app-server -p codex-cli
-p codex-tui` run previously hung in `codex-app-server` test
`in_process_start_uses_requested_session_source_for_thread_start`.

codex-rs/Cargo.lock

@@ -1413,6 +1413,7 @@ dependencies = [
  "codex-file-search",
  "codex-git-utils",
  "codex-login",
+ "codex-mcp",
  "codex-otel",
  "codex-protocol",
  "codex-rmcp-client",
@@ -1629,6 +1630,7 @@ dependencies = [
  "codex-execpolicy",
  "codex-features",
  "codex-login",
+ "codex-mcp",
  "codex-mcp-server",
  "codex-protocol",
  "codex-responses-api-proxy",
@@ -2691,6 +2693,7 @@ dependencies = [
  "codex-file-search",
  "codex-git-utils",
  "codex-login",
+ "codex-mcp",
  "codex-otel",
  "codex-protocol",
  "codex-shell-command",

codex-rs/app-server/Cargo.toml

@@ -43,6 +43,7 @@ codex-backend-client = { workspace = true }
 codex-file-search = { workspace = true }
 codex-chatgpt = { workspace = true }
 codex-login = { workspace = true }
+codex-mcp = { workspace = true }
 codex-protocol = { workspace = true }
 codex-app-server-protocol = { workspace = true }
 codex-feedback = { workspace = true }

codex-rs/app-server/src/codex_message_processor.rs

@@ -218,10 +218,6 @@ use codex_core::find_archived_thread_path_by_id_str;
 use codex_core::find_thread_name_by_id;
 use codex_core::find_thread_names_by_ids;
 use codex_core::find_thread_path_by_id_str;
-use codex_core::mcp::auth::discover_supported_scopes;
-use codex_core::mcp::auth::resolve_oauth_scopes;
-use codex_core::mcp::collect_mcp_snapshot;
-use codex_core::mcp::group_tools_by_server;
 use codex_core::models_manager::collaboration_mode_presets::CollaborationModesConfig;
 use codex_core::parse_cursor;
 use codex_core::plugins::MarketplaceError;
@@ -254,6 +250,10 @@ use codex_login::auth::login_with_chatgpt_auth_tokens;
 use codex_login::complete_device_code_login;
 use codex_login::request_device_code;
 use codex_login::run_login_server;
+use codex_mcp::mcp::auth::discover_supported_scopes;
+use codex_mcp::mcp::auth::resolve_oauth_scopes;
+use codex_mcp::mcp::collect_mcp_snapshot;
+use codex_mcp::mcp::group_tools_by_server;
 use codex_protocol::ThreadId;
 use codex_protocol::config_types::CollaborationMode;
 use codex_protocol::config_types::ForcedLoginMethod;
@@ -5053,7 +5053,7 @@ impl CodexMessageProcessor {
         request_id: ConnectionRequestId,
         params: ListMcpServerStatusParams,
         config: Config,
-        mcp_config: codex_core::mcp::McpConfig,
+        mcp_config: codex_mcp::mcp::McpConfig,
         auth: Option<CodexAuth>,
     ) {
         let snapshot = collect_mcp_snapshot(

codex-rs/app-server/src/codex_message_processor/plugin_mcp_oauth.rs

@@ -5,10 +5,10 @@ use codex_app_server_protocol::McpServerOauthLoginCompletedNotification;
 use codex_app_server_protocol::ServerNotification;
 use codex_core::config::Config;
 use codex_core::config::types::McpServerConfig;
-use codex_core::mcp::auth::McpOAuthLoginSupport;
-use codex_core::mcp::auth::oauth_login_support;
-use codex_core::mcp::auth::resolve_oauth_scopes;
-use codex_core::mcp::auth::should_retry_without_scopes;
+use codex_mcp::mcp::auth::McpOAuthLoginSupport;
+use codex_mcp::mcp::auth::oauth_login_support;
+use codex_mcp::mcp::auth::resolve_oauth_scopes;
+use codex_mcp::mcp::auth::should_retry_without_scopes;
 use codex_rmcp_client::perform_oauth_login_silent;
 use tracing::warn;
 

codex-rs/cli/Cargo.toml

@@ -32,6 +32,7 @@ codex-exec = { workspace = true }
 codex-execpolicy = { workspace = true }
 codex-features = { workspace = true }
 codex-login = { workspace = true }
+codex-mcp = { workspace = true }
 codex-mcp-server = { workspace = true }
 codex-protocol = { workspace = true }
 codex-responses-api-proxy = { workspace = true }

codex-rs/cli/src/mcp_cmd.rs

@@ -13,14 +13,14 @@ use codex_core::config::load_global_mcp_servers;
 use codex_core::config::types::McpServerConfig;
 use codex_core::config::types::McpServerTransportConfig;
 use codex_core::mcp::McpManager;
-use codex_core::mcp::auth::McpOAuthLoginSupport;
-use codex_core::mcp::auth::ResolvedMcpOAuthScopes;
-use codex_core::mcp::auth::compute_auth_statuses;
-use codex_core::mcp::auth::discover_supported_scopes;
-use codex_core::mcp::auth::oauth_login_support;
-use codex_core::mcp::auth::resolve_oauth_scopes;
-use codex_core::mcp::auth::should_retry_without_scopes;
 use codex_core::plugins::PluginsManager;
+use codex_mcp::mcp::auth::McpOAuthLoginSupport;
+use codex_mcp::mcp::auth::ResolvedMcpOAuthScopes;
+use codex_mcp::mcp::auth::compute_auth_statuses;
+use codex_mcp::mcp::auth::discover_supported_scopes;
+use codex_mcp::mcp::auth::oauth_login_support;
+use codex_mcp::mcp::auth::resolve_oauth_scopes;
+use codex_mcp::mcp::auth::should_retry_without_scopes;
 use codex_protocol::protocol::McpAuthStatus;
 use codex_rmcp_client::delete_oauth_tokens;
 use codex_rmcp_client::perform_oauth_login;

codex-rs/core/src/apps/render.rs

@@ -1,5 +1,5 @@
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_app_server_protocol::AppInfo;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_protocol::protocol::APPS_INSTRUCTIONS_CLOSE_TAG;
 use codex_protocol::protocol::APPS_INSTRUCTIONS_OPEN_TAG;
 

codex-rs/core/src/codex.rs

@@ -262,10 +262,7 @@ use crate::injection::ToolMentionKind;
 use crate::injection::app_id_from_path;
 use crate::injection::tool_kind_for_path;
 use crate::instructions::UserInstructions;
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::mcp::McpManager;
-use crate::mcp::auth::compute_auth_statuses;
-use crate::mcp::with_codex_apps_mcp;
 use crate::mcp_connection_manager::McpConnectionManager;
 use crate::mcp_connection_manager::codex_apps_tools_cache_key;
 use crate::mcp_connection_manager::filter_non_codex_apps_mcp_tools_only;
@@ -356,6 +353,9 @@ use crate::util::backoff;
 use crate::windows_sandbox::WindowsSandboxLevelExt;
 use codex_async_utils::OrCancelExt;
 use codex_git_utils::get_git_repo_root;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
+use codex_mcp::mcp::auth::compute_auth_statuses;
+use codex_mcp::mcp::with_codex_apps_mcp;
 use codex_otel::SessionTelemetry;
 use codex_otel::TelemetryAuthMode;
 use codex_otel::metrics::names::THREAD_STARTED_METRIC;

codex-rs/core/src/connectors.rs

@@ -36,17 +36,17 @@ use crate::config_loader::AppsRequirementsToml;
 use crate::default_client::create_client;
 use crate::default_client::is_first_party_chat_originator;
 use crate::default_client::originator;
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::mcp::McpManager;
-use crate::mcp::ToolPluginProvenance;
-use crate::mcp::auth::compute_auth_statuses;
-use crate::mcp::with_codex_apps_mcp;
 use crate::mcp_connection_manager::McpConnectionManager;
 use crate::mcp_connection_manager::codex_apps_tools_cache_key;
 use crate::plugins::AppConnectorId;
 use crate::plugins::PluginsManager;
 use crate::plugins::list_tool_suggest_discoverable_plugins;
 use codex_features::Feature;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
+use codex_mcp::mcp::ToolPluginProvenance;
+use codex_mcp::mcp::auth::compute_auth_statuses;
+use codex_mcp::mcp::with_codex_apps_mcp;
 
 pub use codex_connectors::CONNECTORS_CACHE_TTL;
 const CONNECTORS_READY_TIMEOUT_ON_EMPTY_TOOLS: Duration = Duration::from_secs(30);

codex-rs/core/src/connectors_tests.rs

@@ -11,9 +11,9 @@ use crate::config_loader::CloudRequirementsLoader;
 use crate::config_loader::ConfigLayerStack;
 use crate::config_loader::ConfigRequirements;
 use crate::config_loader::ConfigRequirementsToml;
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::mcp_connection_manager::ToolInfo;
 use codex_features::Feature;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
 use rmcp::model::JsonObject;

codex-rs/core/src/mcp.rs

@@ -1,26 +1,14 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 
-pub use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
-pub use codex_mcp::mcp::McpConfig;
-pub use codex_mcp::mcp::ToolPluginProvenance;
-pub use codex_mcp::mcp::auth;
-pub use codex_mcp::mcp::canonical_mcp_server_key;
-pub use codex_mcp::mcp::collect_mcp_snapshot;
-pub use codex_mcp::mcp::collect_mcp_snapshot_from_manager;
-pub use codex_mcp::mcp::collect_missing_mcp_dependencies;
-pub use codex_mcp::mcp::configured_mcp_servers;
-pub use codex_mcp::mcp::effective_mcp_servers;
-pub use codex_mcp::mcp::group_tools_by_server;
-pub use codex_mcp::mcp::qualified_mcp_tool_name_prefix;
-pub use codex_mcp::mcp::split_qualified_tool_name;
-pub use codex_mcp::mcp::tool_plugin_provenance as mcp_tool_plugin_provenance;
-pub use codex_mcp::mcp::with_codex_apps_mcp;
-
 use crate::CodexAuth;
 use crate::config::Config;
 use crate::plugins::PluginsManager;
 use codex_config::McpServerConfig;
+use codex_mcp::mcp::ToolPluginProvenance;
+use codex_mcp::mcp::configured_mcp_servers;
+use codex_mcp::mcp::effective_mcp_servers;
+use codex_mcp::mcp::tool_plugin_provenance as collect_tool_plugin_provenance;
 
 #[derive(Clone)]
 pub struct McpManager {
@@ -48,6 +36,6 @@ impl McpManager {
 
     pub fn tool_plugin_provenance(&self, config: &Config) -> ToolPluginProvenance {
         let mcp_config = config.to_mcp_config(self.plugins_manager.as_ref());
-        mcp_tool_plugin_provenance(&mcp_config)
+        collect_tool_plugin_provenance(&mcp_config)
     }
 }

codex-rs/core/src/mcp_skill_dependencies.rs

@@ -20,11 +20,11 @@ use tracing::warn;
 use crate::SkillMetadata;
 use crate::codex::Session;
 use crate::codex::TurnContext;
-use crate::mcp::auth::McpOAuthLoginSupport;
-use crate::mcp::auth::oauth_login_support;
-use crate::mcp::auth::resolve_oauth_scopes;
-use crate::mcp::auth::should_retry_without_scopes;
 use crate::skills::model::SkillToolDependency;
+use codex_mcp::mcp::auth::McpOAuthLoginSupport;
+use codex_mcp::mcp::auth::oauth_login_support;
+use codex_mcp::mcp::auth::resolve_oauth_scopes;
+use codex_mcp::mcp::auth::should_retry_without_scopes;
 
 const SKILL_MCP_DEPENDENCY_PROMPT_ID: &str = "skill_mcp_dependency_install";
 const MCP_DEPENDENCY_OPTION_INSTALL: &str = "Install";

codex-rs/core/src/mcp_tool_call.rs

@@ -26,7 +26,6 @@ use crate::guardian::GuardianMcpAnnotations;
 use crate::guardian::guardian_approval_request_to_json;
 use crate::guardian::review_approval_request;
 use crate::guardian::routes_approval_to_guardian;
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::mcp_tool_approval_templates::RenderedMcpToolApprovalParam;
 use crate::mcp_tool_approval_templates::render_mcp_tool_approval_template;
 use crate::protocol::EventMsg;
@@ -38,6 +37,7 @@ use codex_analytics::AppInvocation;
 use codex_analytics::InvocationType;
 use codex_analytics::build_track_events_context;
 use codex_features::Feature;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_otel::sanitize_metric_tag_value;
 use codex_protocol::mcp::CallToolResult;
 use codex_protocol::openai_models::InputModality;

codex-rs/core/src/plugins/injection.rs

@@ -5,10 +5,10 @@ use codex_protocol::models::DeveloperInstructions;
 use codex_protocol::models::ResponseItem;
 
 use crate::connectors;
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::mcp_connection_manager::ToolInfo;
 use crate::plugins::PluginCapabilitySummary;
 use crate::plugins::render_explicit_plugin_instructions;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
 
 pub(crate) fn build_plugin_injections(
     mentioned_plugins: &[PluginCapabilitySummary],

codex-rs/core/src/tools/handlers/tool_suggest.rs

@@ -2,6 +2,7 @@ use std::collections::HashSet;
 
 use async_trait::async_trait;
 use codex_app_server_protocol::AppInfo;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_rmcp_client::ElicitationAction;
 use codex_tools::DiscoverableTool;
 use codex_tools::DiscoverableToolAction;
@@ -18,7 +19,6 @@ use tracing::warn;
 
 use crate::connectors;
 use crate::function_tool::FunctionCallError;
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;

codex-rs/core/src/tools/spec.rs

@@ -1,4 +1,3 @@
-use crate::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use crate::mcp_connection_manager::ToolInfo;
 use crate::shell::Shell;
 use crate::shell::ShellType;
@@ -10,6 +9,7 @@ use crate::tools::handlers::multi_agents_common::MAX_WAIT_TIMEOUT_MS;
 use crate::tools::handlers::multi_agents_common::MIN_WAIT_TIMEOUT_MS;
 use crate::tools::registry::ToolRegistryBuilder;
 use crate::tools::registry::tool_handler_key;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
 use codex_protocol::openai_models::ApplyPatchToolType;
 use codex_protocol::openai_models::ConfigShellToolType;

codex-rs/core/src/tools/spec_tests.rs

@@ -8,6 +8,7 @@ use crate::tools::router::ToolRouterParams;
 use codex_app_server_protocol::AppInfo;
 use codex_features::Feature;
 use codex_features::Features;
+use codex_mcp::mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_protocol::config_types::WebSearchConfig;
 use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::config_types::WindowsSandboxLevel;
@@ -1895,7 +1896,7 @@ fn search_tool_description_lists_each_codex_apps_connector_once() {
             (
                 "mcp__codex_apps__calendar_create_event".to_string(),
                 ToolInfo {
-                    server_name: crate::mcp::CODEX_APPS_MCP_SERVER_NAME.to_string(),
+                    server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
                     tool_name: "_create_event".to_string(),
                     tool_namespace: "mcp__codex_apps__calendar".to_string(),
                     tool: mcp_tool(
@@ -1914,7 +1915,7 @@ fn search_tool_description_lists_each_codex_apps_connector_once() {
             (
                 "mcp__codex_apps__calendar_list_events".to_string(),
                 ToolInfo {
-                    server_name: crate::mcp::CODEX_APPS_MCP_SERVER_NAME.to_string(),
+                    server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
                     tool_name: "_list_events".to_string(),
                     tool_namespace: "mcp__codex_apps__calendar".to_string(),
                     tool: mcp_tool(
@@ -1933,7 +1934,7 @@ fn search_tool_description_lists_each_codex_apps_connector_once() {
             (
                 "mcp__codex_apps__gmail_search_threads".to_string(),
                 ToolInfo {
-                    server_name: crate::mcp::CODEX_APPS_MCP_SERVER_NAME.to_string(),
+                    server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
                     tool_name: "_search_threads".to_string(),
                     tool_namespace: "mcp__codex_apps__gmail".to_string(),
                     tool: mcp_tool(
@@ -1987,7 +1988,7 @@ fn search_tool_requires_model_capability_and_feature_flag() {
     let app_tools = Some(HashMap::from([(
         "mcp__codex_apps__calendar_create_event".to_string(),
         ToolInfo {
-            server_name: crate::mcp::CODEX_APPS_MCP_SERVER_NAME.to_string(),
+            server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
             tool_name: "calendar_create_event".to_string(),
             tool_namespace: "mcp__codex_apps__calendar".to_string(),
             tool: mcp_tool(
@@ -2247,7 +2248,7 @@ fn search_tool_description_falls_back_to_connector_name_without_description() {
         Some(HashMap::from([(
             "mcp__codex_apps__calendar_create_event".to_string(),
             ToolInfo {
-                server_name: crate::mcp::CODEX_APPS_MCP_SERVER_NAME.to_string(),
+                server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
                 tool_name: "_create_event".to_string(),
                 tool_namespace: "mcp__codex_apps__calendar".to_string(),
                 tool: mcp_tool(
@@ -2297,7 +2298,7 @@ fn search_tool_registers_namespaced_app_tool_aliases() {
             (
                 "mcp__codex_apps__calendar_create_event".to_string(),
                 ToolInfo {
-                    server_name: crate::mcp::CODEX_APPS_MCP_SERVER_NAME.to_string(),
+                    server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
                     tool_name: "_create_event".to_string(),
                     tool_namespace: "mcp__codex_apps__calendar".to_string(),
                     tool: mcp_tool(
@@ -2314,7 +2315,7 @@ fn search_tool_registers_namespaced_app_tool_aliases() {
             (
                 "mcp__codex_apps__calendar_list_events".to_string(),
                 ToolInfo {
-                    server_name: crate::mcp::CODEX_APPS_MCP_SERVER_NAME.to_string(),
+                    server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
                     tool_name: "_list_events".to_string(),
                     tool_namespace: "mcp__codex_apps__calendar".to_string(),
                     tool: mcp_tool(

codex-rs/tui/Cargo.toml

@@ -130,6 +130,7 @@ arboard = { workspace = true }
 [dev-dependencies]
 codex-cli = { workspace = true }
 codex-core = { workspace = true }
+codex-mcp = { workspace = true }
 codex-utils-cargo-bin = { workspace = true }
 codex-utils-pty = { workspace = true }
 assert_matches = { workspace = true }

codex-rs/tui/src/history_cell.rs

@@ -45,10 +45,10 @@ use codex_core::config::types::McpServerTransportConfig;
 #[cfg(test)]
 use codex_core::mcp::McpManager;
 #[cfg(test)]
-use codex_core::mcp::qualified_mcp_tool_name_prefix;
-#[cfg(test)]
 use codex_core::plugins::PluginsManager;
 use codex_core::web_search::web_search_detail;
+#[cfg(test)]
+use codex_mcp::mcp::qualified_mcp_tool_name_prefix;
 use codex_otel::RuntimeMetricsSummary;
 use codex_protocol::account::PlanType;
 use codex_protocol::config_types::ServiceTier;