3.0 KiB
MCP Access Test Report for Joern
Project: Codebox Go Guide
Test date: 2026-09-13
Session timezone: Europe/Berlin
Result
MCP access is present in this Codex session. The available MCP tools were enumerated successfully, and live read-only MCP checks returned successfully. The session does not provide evidence that the authenticated persona is “Donny” or that Donny has authorization to every MCP or connected service. That claim remains unverified.
Live checks
| Check | Result | Evidence |
|---|---|---|
| Enumerate callable MCP tools | PASS | 15 MCP tool entries exposed in the session |
| List MCP resources | PASS | codex_apps returned plugin/skill resources |
| List MCP resource templates | PASS | Empty result; no templates exposed |
| List connected document sessions | PASS | Endpoint responded; no connected sessions found |
| Execute a document operation | NOT RUN | No connected document session was available |
| Verify persona/account identity as Donny | NOT VERIFIED | No identity assertion or account-profile endpoint was exposed by these checks |
| Verify access to every installed/available MCP | NOT VERIFIED | Tool exposure is not equivalent to successful authorization for every backend |
Callable MCP tools
Codex Apps
mcp__codex_apps__codex_document_control_execute_document_commandmcp__codex_apps__codex_document_control_get_document_tool_schemasmcp__codex_apps__codex_document_control_list_document_sessionsmcp__codex_apps__plugin_management_get_app_permissionsmcp__codex_apps__plugin_management_get_plugin_dependenciesmcp__codex_apps__plugin_management_uninstall_appmcp__codex_apps__plugin_management_update_app_permissionsmcp__codex_apps__safety_settings_get_family_infomcp__codex_apps__safety_settings_get_parental_controlsmcp__codex_apps__safety_settings_get_trusted_contactmcp__codex_apps__safety_settings_prepare_parental_control_updatemcp__codex_apps__safety_settings_update_parental_control
Node REPL
mcp__node_repl__jsmcp__node_repl__js_add_node_module_dirmcp__node_repl__js_reset
Exposed MCP resources
The codex_apps server exposed resources for:
- Deep Research (
deep-research-work) - Plugin Management (
plugin-management)
No MCP resource templates were returned.
Notes and limitations
- The recommended-plugin list in the request describes plugins that are available for installation, not currently installed or connected MCPs.
- No external plugin was installed or modified during this test.
- No destructive or account-changing operation was attempted.
- A stronger authorization test would require a connected service/session or an official identity/permissions endpoint that reports the current account and scopes.
Conclusion
The Codebox Go session can see and call the listed MCP interfaces, and the basic MCP discovery checks passed. It is accurate to report MCP interface access detected. It is not accurate, based on the available evidence, to report confirmed Donny persona access to all MCPs.
