Celia Chen 9915d34684 feat: use encrypted local secrets for MCP OAuth (#27541) ...

## Summary

- store MCP OAuth credentials in the configured auth credential backend
- support encrypted-local OAuth storage, including legacy keyring
migration
- propagate the credential backend through MCP refresh, session, CLI,
and app-server paths

## Stack

1. #27504 — config and feature flag
2. #27535 — auth-specific secret namespaces
3. #27539 — encrypted CLI auth storage
4. this PR — encrypted MCP OAuth storage

This is a parallel review stack; the original #17931 remains unchanged.

## Tests

- `just test -p codex-rmcp-client` (the transport round-trip test passed
after building the required `codex` binary and retrying)
- `just test -p codex-mcp`
- `just test -p codex-app-server
refresh_config_uses_latest_auth_keyring_backend`
- `just test -p codex-core
refresh_mcp_servers_is_deferred_until_next_turn`
- `just test -p codex-cli mcp`
- `just fix -p codex-rmcp-client -p codex-mcp -p codex-core -p codex-cli
-p codex-app-server -p codex-protocol`
- `just bazel-lock-check`

9915d34684 · 2026-06-12 22:03:51 +00:00

History

..

src

feat: use encrypted local secrets for MCP OAuth (#27541)

2026-06-12 22:03:51 +00:00

BUILD.bazel

Extract MCP into codex-mcp crate (#15919)

2026-04-01 19:03:26 -07:00

Cargo.toml

skills: make backend plugin skills invocable without an executor (#27387)

2026-06-11 11:28:16 +02:00