diff --git a/tools-sync/scripts/sync_mcp_registrations.ps1 b/tools-sync/scripts/sync_mcp_registrations.ps1
index 53a28f2..81e96b3 100644
--- a/tools-sync/scripts/sync_mcp_registrations.ps1
+++ b/tools-sync/scripts/sync_mcp_registrations.ps1
@@ -159,6 +159,9 @@ function Get-CodexMcpsFromCli {
         $result[[string]$s.name] = New-CanonicalMcp ([string]$s.name) $transport ([string]$t.command) `
             @($t.args) (ConvertTo-StringMap $t.env) ([string]$t.url) `
             (ConvertTo-StringMap $t.http_headers) ([string]$t.bearer_token_env_var) "Codex"
+        # Not part of the drift comparison; Test-CodexManaged needs it because bundled
+        # plugin MCPs launch as plain `cmd.exe` and only their cwd names the plugin cache.
+        $result[[string]$s.name] | Add-Member -NotePropertyName cwd -NotePropertyValue ([string]$t.cwd)
     }
     return $result
 }
@@ -202,6 +205,9 @@ function Test-CodexManaged($Mcp) {
     if ($Mcp.name -in @("node_repl", "cua_repl")) { return $true }
     $command = [string]$Mcp.command
     if ($command -match '(?i)[\\/]\.codex[\\/](runtimes|plugins[\\/]cache)[\\/]') { return $true }
+    # codex-cli 0.162: code-review / codex_app are `cmd.exe /c scripts\launch_*.cmd` with
+    # cwd under .codex\plugins\cache\openai-bundled -- the command alone looks portable.
+    if ([string]$Mcp.cwd -match '(?i)[\\/]\.codex[\\/](runtimes|plugins[\\/]cache)[\\/]') { return $true }
     # The Codex desktop app also bundles MCPs from its own install dir (MSIX
     # WindowsApps, or AppData\Local\OpenAI\Codex). Host-owned, not portable.
     return ($command -match '(?i)[\\/](WindowsApps[\\/]OpenAI\.Codex|OpenAI[\\/]Codex[\\/])')