[abruption]

Summary

Adds list_destinations() to the stdio MCP server. It projects only configured destination IDs, local/SSH transport kind, allowed agents and policy capabilities. It does not invoke the native CLI, SSH, network discovery or model turns, and does not grant send/wake permissions. Existing policy loading and tool behavior remain unchanged.

The versioned projection rejects over 64 destinations or nonprintable/over-128-UTF-8-byte identifiers. A separate 64 KiB budget covers both text and structured MCP tool-result representations, including string escaping; the outer JSON-RPC envelope is excluded. Rejections are versioned and do not reflect the offending route. Configured IDs are untrusted operator labels, not readiness or identity evidence; choose non-sensitive labels.

The four MCP guides describe the unreleased v1.4.0 candidate and clarify existing Python 3.14 CI coverage. This PR does not introduce that matrix; it already exists on the pinned base.

Refs #356. Scope is metadata discovery only; #357–#359 are separate follow-ups. No automatic issue close is requested.

Validation

• macOS arm64, Python 3.13.7, MCP SDK 1.30.0: MCP suite 33 passed before follow-up; final routing/real-stdio suite 26 passed, including maximum escaped-ID rejection, absence of raw routes, metadata versioning and unchanged old-tool access. Additional final boundary test passed.
• Documentation suite: 87 passed; i18n parity and manifest hash passed; generated standalone check and git diff --check passed. Runtime core and standalone bytes are unchanged.
• Real stdio tests use isolated policy files and a synthetic inbox; no native Claude/Codex model session or real SSH destination was contacted. Existing process-cleanup fixtures start only owned synthetic children.
• One added fixture initially omitted the mandatory Codex home; corrected the fixture. The first assumption that 64 maximally escaped IDs would fit was disproved: the logical payload fits but the complete tool result exceeds the budget. The regression now explicitly proves the outer guard rejects it without disclosing the inventory.
• SDK 1.30.0's actual writer uses model_dump_json(by_alias=True, exclude_none=True); the server-side budget is conservative. No absolute transport-line bound including caller-controlled JSON-RPC ID is claimed. Latest SDK and full platform matrix require PR CI.

Independent verification

Applied independent-cli-review: Claude Code 2.1.314 requested and response-confirmed claude-opus-5-5; Codex CLI 0.166.0 in a fresh ephemeral read-only session ignoring user config (default model, actual model ID not exposed). Both ran non-interactively in parallel on identical immutable self-contained source/test/doc inputs, without tools, tests, network or writes. Both rounds completed successfully.

• Initial input SHA-256: ac0ae56aa3df5d854e4f07f4f49ae3c82a1e09fa45afeadea4430b61ffd7c8e1.
• Revised input SHA-256: b6206562e33e87ce037c5576cd7b7716294d91de1c656e877af51fe8cc7bedc4.
• Incorporated missing error-version and duplicated-result budget findings, clarified lookup-versus-policy limits, and added real boundary regressions. Final reviewer suggestions about distinguishing success/refusal and an outer-only budget failure are now explicitly asserted. A Korean particle correction and these small assertion follow-ups were validated by Codex after the second review, not claimed to have received a third CLI review.
• Source checks disproved the suggestion that documenting Python 3.14 requires adding a new matrix here: .github/workflows/ci.yml already defines it on the base.

Separate translation QA: Antigravity CLI 1.4.12, gemini-3.8-flash-medium, medium, fresh plan/sandbox read-only calls (79.556 s and 107.66 s). Inputs were the four MCP documents, limited by instruction to the new section/CI sentence; no runtime/code execution. Codex checked proposals against the source, clarified host-value wording and fixed Korean grammar. Style suggestions that would make metadata lookup sound like active discovery were not adopted. The last small grammar fix was not independently re-run through Gemini.

Boundaries

No version bump, merge, tag, release, package publication, global install, service/policy update or live delivery/ACK acceptance is included. Automatic Codex review is triggered by PR creation; no review mention is added.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-02T01:03:41.106886Z	ad34fcd	PR opened
🔒 Security Review	✅ Completed 2026-11-02T01:04:00.077352Z	ad34fcd	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.