Skills/npm/codex-mcp-bridge

codex-mcp-bridge@2.3.2

CAUTION· startup only

Publisher claims: "Connect Claude, Codex, and Antigravity through MCP, with native Desktop handoffs and bridge-owned Antigravity CLI sessions." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher minhspark · publishing for 86 daysInstalls 9,123Last detonated 12 h ago
What would fix thisWatchDispute verdict

Coverage

Startup only; authenticated tool behavior not tested.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
ANTIGRAVITY_CSRF_TOKEN or --reauthorizeConfiguration, not credentials: AGENT_RELAY_RUNTIME_ID, ANTIGRAVITY_AGENTAPI_EXE, ANTIGRAVITY_BRIDGE_CALLER, ANTIGRAVITY_CLI_BIN, ANTIGRAVITY_LS_ADDRESS, CLAUDE_BRIDGE_CWD, CLAUDE_BRIDGE_NAME, CLAUDE_BRIDGE_PEER_NAME, CLAUDE_BRIDGE_PERMISSION_MODE, CLAUDE_CONFIG_DIR, CLAUDE_DESKTOP_CONFIG, CLAUDE_DESKTOP_USER_DATA, CODEX_APP_SERVER_URL, CODEX_APP_TOOLS_PIPE_PATH, CODEX_BIN, CODEX_BRIDGE_ALLOWED_ROOTS, CODEX_BRIDGE_ALLOWED_THREADS, CODEX_BRIDGE_APPROVAL, CODEX_BRIDGE_APPROVAL_POLICY, CODEX_BRIDGE_AUTO_APPROVE_ACK, CODEX_BRIDGE_AUTOSTART, CODEX_BRIDGE_DESKTOP_TASKS, CODEX_BRIDGE_EFFORT, CODEX_BRIDGE_ENFORCE_FULL_ACCESS, CODEX_BRIDGE_HARDENED, CODEX_BRIDGE_MODEL, CODEX_BRIDGE_NATIVE_RELAY, CODEX_BRIDGE_OPEN_IN_APP, CODEX_BRIDGE_PATH_MAP, CODEX_BRIDGE_PROJECT_POLICY, CODEX_BRIDGE_RECOVERY_DELAY_MS, CODEX_BRIDGE_RELAY_WAKE, CODEX_BRIDGE_RELEASE_AFTER_TURN, CODEX_BRIDGE_RELOAD_POLL_MS, CODEX_BRIDGE_RELOAD_SETTLE_MS, CODEX_BRIDGE_REMAP, CODEX_BRIDGE_RUNTIME_CACHE, CODEX_BRIDGE_RUNTIME_PRUNE_DELAY_MS, CODEX_BRIDGE_SANDBOX
Where it talks to
no vendor host named in the codeAlso supabase.co — not the publisher's domain; check what for before connecting.
What the honeypot saw
no credential files read · no network
What we could not test
the tool list (the server exited before answering) · what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names supabase.co as well as its own vendor. The guard injects ANTIGRAVITY_CSRF_TOKEN only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- npx -y @minhspark/codex-mcp-bridge

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (3 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 72/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 27 s · 3 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.1sprocessexited 1: Node.js v22.23.5
0.1sprocessinstall script run in the sandbox
0.2sprocessexited 1: Node.js v22.23.5
6.0sprocessdependency install exit 0
26sclaimedstartup only: exited (0) before answering · code: 'ERR_MODULE_NOT_FOUND', url: 'file:///tmp/ks-detonate-N3jvBN/task/home/work/acme-api/.claude/skills/codex-mcp-bridge/src/bridge-account-context.mjs' } Node.js v22.23.5
26sprocessscript backend runs setup only
26sprocesssecond launch, clock +45 days, CI unset
26sprocessexited 1: Node.js v22.23.5
26sprocessexited 1: Node.js v22.23.5

Static findings

HIGH
Access to sensitive file pathssrc/desktop-relay-host.mjs:67 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst nativeEnv = { ...env, CODEX_APP_TOOLS_PIPE_PATH: undefined };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/claude-data-pin.mjs:48 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (env[PIN] !== undefined) return claudeDataPinUsable(env, platform) ? env : { ...env, [PIN]: scanned.root };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-supervisor.mjs:89 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, CODEX_BRIDGE_WORKER: "1", CODEX_BRIDGE_STAGED: "1" },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/message-automation.mjs:41 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…read(codeFile)); const entry = code.mcpServers?.["codex-bridge"]; if (entry?.env?.CODEX_BRIDGE_DESKTOP_TASKS !== "1" || path.basename(entry?.args?.[0] ?? "") !=…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/claude-data-pin.mjs:53 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn stale ? { ...env, [PIN]: scanned.root } : env;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/native-relay.mjs:566 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…ULT_TIMEOUT_MS, resolveSocketPath = () => resolveNativeToolsPipePath({ env: { ...env, CODEX_APP_TOOLS_PIPE_PATH: undefined } }), assertAccount = assertAccountIdenti…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/desktop-relay-host.mjs:54 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, CODEX_APP_TOOLS_PIPE_PATH: undefined }, parentPid: pid, platform: "win32", readParentCommandLine: async () => null,Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/background-relay.mjs:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesthis.env = { ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/mcp-supervisor.mjs:199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn { ...env, CODEX_BRIDGE_SOURCE_ROOT: release.sourceRoot ?? installRoot, ...(repin ? { CLAUDE_DESKTOP_USER_DATA: claudeDataRoot } : {}) };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathssrc/setup.mjs:255 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswriteCurrentInstall({ env: { ...env, CODEX_HOME: paths.codex }, root, claudeDataRoot: activeClaudeDataRoot(env, platform) });Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionscripts/bridge-projects.mjs:39 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(JSON.stringify({ file, action, path: input, effective: "next bridge operation; no client restart needed" }, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/remote-codex-tools.mjs:16 · File type combined with upload action — agent may exfiltrate local data files…op tasks through an explicitly configured SSH host. Requires bridge-remote-hosts.json and live host-supplied sender metadata. Each computer may use a different Codex account; the current accounts are rediscovered per call and cannot change…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/bridge-projects.mjs:27 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(JSON.stringify(operation({ cwd: input, reauthorize: args.includes("--reauthorize"), taskCards: args.includes("--task-cards") }, {Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Auto-update or dynamic fetch configurationsrc/remote-codex.mjs:101 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (!file.startsWith(directory + path.sep)) throw remoteFailure("REMOTE_CONFIG_UNSAFE", "Remote host configuration is outside Codex home");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationsrc/remote-codex.mjs:98 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (!cleanPath(root) || !path.isAbsolute(root)) throw remoteFailure("REMOTE_CONFIG_UNSAFE", "Codex configuration directory must be absolute");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File permission modification commandsrc/peer-protocol.mjs:24 · File permission modification command — agent changes file ownership/permissions* directory to create, no mode to chmod and no file to unlink beforehand.Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/remote-codex.mjs:116 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (!count) throw remoteFailure("REMOTE_CONFIG_CHANGED", "Remote host configuration changed during reading");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Auto-update or dynamic fetch configurationsrc/remote-codex.mjs:111 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (!same(stat, opened)) throw remoteFailure("REMOTE_CONFIG_CHANGED", "Remote host configuration changed after opening");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandsrc/setup.mjs:252 · Privileged sudo command — agent may execute with elevated privileges…ion" && process.getuid() === 0) throw new Error("Run the global install without sudo in the account that runs the apps; setup will not write another account's config…Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathssrc/sites-connector.mjs:136 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…; } export function sitesHardenedEnv(config, env = process.env) { return { ...env, CODEX_BRIDGE_HARDENED: "1", CODEX_BRIDGE_DESKTOP_TASKS: "1", CODEX_BRIDGE_THRE…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Auto-update or dynamic fetch configurationsrc/remote-codex.mjs:110 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeif (!safe(opened) || !safe(stat)) throw remoteFailure("REMOTE_CONFIG_UNSAFE", "Remote host configuration must be a private regular file");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Access to sensitive file pathssrc/setup.mjs:142 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files{ ...env, npm_config_global: "false", CODEX_BRIDGE_SKIP_SETUP: "1" }, 180000);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05

Cost to the agent

Instructions loaded
≈71 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for @minhspark/codex-mcp-bridge@2.3.2 as of 4 h ago. This is the package itself, not its dependencies.

What would make this Verified

8 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim minhspark: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Auto-update or dynamic fetch configuration≈ +4 on the totalPin versions and sources; vendor anything fetched at install time.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim minhsparkPropose a patch to the maintainer