diff --git a/tools-sync/scripts/sync_mcp_registrations.ps1 b/tools-sync/scripts/sync_mcp_registrations.ps1
index 4ae2055..7e9b4b5 100644
--- a/tools-sync/scripts/sync_mcp_registrations.ps1
+++ b/tools-sync/scripts/sync_mcp_registrations.ps1
@@ -100,9 +100,12 @@ print(json.dumps(data.get("mcp_servers", {}), ensure_ascii=False))
 }
 
 function Test-CodexManaged($Mcp) {
-    if ($Mcp.name -eq "node_repl") { return $true }
+    if ($Mcp.name -in @("node_repl", "cua_repl")) { return $true }
     $command = [string]$Mcp.command
-    return ($command -match '(?i)[\\/]\.codex[\\/](runtimes|plugins[\\/]cache)[\\/]')
+    if ($command -match '(?i)[\\/]\.codex[\\/](runtimes|plugins[\\/]cache)[\\/]') { return $true }
+    # The Codex desktop app also bundles MCPs from its own install dir (MSIX
+    # WindowsApps, or AppData\Local\OpenAI\Codex). Host-owned, not portable.
+    return ($command -match '(?i)[\\/](WindowsApps[\\/]OpenAI\.Codex|OpenAI[\\/]Codex[\\/])')
 }
 
 function Get-PortableMcps($Map, [string]$Side) {