boweiandClaude Opus 5
ecc913c4f1
Test-CodexManaged 原来只按名字认 node_repl、按路径认 .codex\runtimes 与 .codex\plugins\cache。Codex 更新后新增的 cua_repl 的 command 在 C:\Program Files\WindowsApps\OpenAI.Codex_...\app\ChatGPT.exe，两条都不命中， 于是被当成"Codex 独有的可移植 MCP"报进差集，险些复制到 Claude 侧。 名字集合加 cua_repl，路径再认 WindowsApps\OpenAI.Codex 与 OpenAI\Codex\。 原有的 .codex 路径正则一字未动。tests PASS；重跑审计 exit 0，四项 Matched。 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018FykpdV2Y4RUWXU5PtoLqh
295 lines
11 KiB
PowerShell
295 lines
11 KiB
PowerShell
# tools-sync: audit and reconcile user-configured MCP registrations between
|
|
# Claude Code and Codex. Managed connectors, plugins, and Codex runtime MCPs are
|
|
# intentionally excluded because they are owned by their host application.
|
|
|
|
[CmdletBinding()]
|
|
param(
|
|
[string]$ClaudeConfig = "$env:USERPROFILE\.claude.json",
|
|
[string]$CodexConfig = "$env:USERPROFILE\.codex\config.toml",
|
|
[switch]$Apply,
|
|
[ValidateSet("None", "Claude", "Codex")]
|
|
[string]$ConflictAuthority = "None",
|
|
[string[]]$ExcludeName = @(),
|
|
[string]$PythonCommand = "python"
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$script:CodexBackupMade = $false
|
|
$script:Failures = @()
|
|
$CodexOnlyEnv = @("PYTHONIOENCODING", "PYTHONUTF8")
|
|
|
|
function ConvertTo-StringMap($Object) {
|
|
$result = [ordered]@{}
|
|
if ($null -eq $Object) { return $result }
|
|
foreach ($property in $Object.psobject.Properties | Sort-Object Name) {
|
|
$result[$property.Name] = [string]$property.Value
|
|
}
|
|
return $result
|
|
}
|
|
|
|
function ConvertFrom-DictionaryToStringMap($Dictionary) {
|
|
$result = [ordered]@{}
|
|
if ($null -eq $Dictionary) { return $result }
|
|
foreach ($key in @($Dictionary.Keys) | Sort-Object) {
|
|
$result[[string]$key] = [string]$Dictionary[$key]
|
|
}
|
|
return $result
|
|
}
|
|
|
|
function New-CanonicalMcp([string]$Name, [string]$Transport, [string]$Command,
|
|
[object[]]$CommandArgs, $EnvMap, [string]$Url,
|
|
$Headers, [string]$BearerTokenEnvVar, [string]$Source) {
|
|
[pscustomobject][ordered]@{
|
|
name = $Name
|
|
transport = $Transport
|
|
command = if ($Command) { $Command } else { "" }
|
|
args = @($CommandArgs | ForEach-Object { [string]$_ })
|
|
env = $EnvMap
|
|
url = if ($Url) { $Url } else { "" }
|
|
headers = $Headers
|
|
bearer_token_env_var = if ($BearerTokenEnvVar) { $BearerTokenEnvVar } else { "" }
|
|
source = $Source
|
|
}
|
|
}
|
|
|
|
function Get-ClaudeMcps {
|
|
if (-not (Test-Path -LiteralPath $ClaudeConfig)) {
|
|
throw "Claude Code config not found: $ClaudeConfig"
|
|
}
|
|
$root = Get-Content -Raw -LiteralPath $ClaudeConfig | ConvertFrom-Json
|
|
$result = @{}
|
|
if ($null -eq $root.mcpServers) { return $result }
|
|
foreach ($property in $root.mcpServers.psobject.Properties) {
|
|
$name = $property.Name
|
|
$cfg = $property.Value
|
|
$transport = if ($cfg.type -in @("http", "sse")) { [string]$cfg.type } else { "stdio" }
|
|
$result[$name] = New-CanonicalMcp $name $transport ([string]$cfg.command) @($cfg.args) `
|
|
(ConvertTo-StringMap $cfg.env) ([string]$cfg.url) `
|
|
(ConvertTo-StringMap $cfg.headers) "" "Claude"
|
|
}
|
|
return $result
|
|
}
|
|
|
|
function Get-CodexMcps {
|
|
if (-not (Test-Path -LiteralPath $CodexConfig)) {
|
|
throw "Codex config not found: $CodexConfig"
|
|
}
|
|
$python = @'
|
|
import json, sys, tomllib
|
|
with open(sys.argv[1], "rb") as f:
|
|
data = tomllib.load(f)
|
|
print(json.dumps(data.get("mcp_servers", {}), ensure_ascii=False))
|
|
'@
|
|
$parseOutput = @($python | & $PythonCommand - $CodexConfig 2>&1)
|
|
if ($LASTEXITCODE -ne 0) {
|
|
$detail = ($parseOutput | ForEach-Object { "$_" }) -join "`n"
|
|
throw "Failed to parse Codex TOML with $PythonCommand`: $detail"
|
|
}
|
|
$json = $parseOutput -join "`n"
|
|
$root = $json | ConvertFrom-Json
|
|
$result = @{}
|
|
foreach ($property in $root.psobject.Properties) {
|
|
$name = $property.Name
|
|
$cfg = $property.Value
|
|
$transport = if ($cfg.url) { "http" } else { "stdio" }
|
|
$result[$name] = New-CanonicalMcp $name $transport ([string]$cfg.command) @($cfg.args) `
|
|
(ConvertTo-StringMap $cfg.env) ([string]$cfg.url) `
|
|
(ConvertTo-StringMap $cfg.http_headers) ([string]$cfg.bearer_token_env_var) "Codex"
|
|
}
|
|
return $result
|
|
}
|
|
|
|
function Test-CodexManaged($Mcp) {
|
|
if ($Mcp.name -in @("node_repl", "cua_repl")) { return $true }
|
|
$command = [string]$Mcp.command
|
|
if ($command -match '(?i)[\\/]\.codex[\\/](runtimes|plugins[\\/]cache)[\\/]') { return $true }
|
|
# The Codex desktop app also bundles MCPs from its own install dir (MSIX
|
|
# WindowsApps, or AppData\Local\OpenAI\Codex). Host-owned, not portable.
|
|
return ($command -match '(?i)[\\/](WindowsApps[\\/]OpenAI\.Codex|OpenAI[\\/]Codex[\\/])')
|
|
}
|
|
|
|
function Get-PortableMcps($Map, [string]$Side) {
|
|
$result = @{}
|
|
foreach ($name in $Map.Keys) {
|
|
if ($ExcludeName -contains $name) { continue }
|
|
$mcp = $Map[$name]
|
|
if ($Side -eq "Codex" -and (Test-CodexManaged $mcp)) { continue }
|
|
$result[$name] = $mcp
|
|
}
|
|
return $result
|
|
}
|
|
|
|
function ConvertTo-PortablePath([string]$Value) {
|
|
# `claude mcp add-json` rejects Windows backslash paths ("Invalid configuration:
|
|
# : Invalid input"); forward slashes work on Windows and are what the CLI itself
|
|
# writes. Only rewrite strings that actually carry a drive-letter path, so flags
|
|
# and non-path args are left alone (`--extension-file=C:\..` is rewritten too).
|
|
if ($null -eq $Value) { return $Value }
|
|
if ($Value -match '[A-Za-z]:\\') { return ($Value -replace '\\', '/') }
|
|
return $Value
|
|
}
|
|
|
|
function Get-ComparableJson($Mcp) {
|
|
$envMap = [ordered]@{}
|
|
foreach ($key in @($Mcp.env.Keys) | Sort-Object) {
|
|
if ($CodexOnlyEnv -contains $key) { continue }
|
|
$envMap[$key] = [string]$Mcp.env[$key]
|
|
}
|
|
$headers = [ordered]@{}
|
|
foreach ($key in @($Mcp.headers.Keys) | Sort-Object) {
|
|
$headers[$key] = [string]$Mcp.headers[$key]
|
|
}
|
|
# `C:\x\y` and `C:/x/y` are the same target on Windows -- the two CLIs write
|
|
# different separators, so compare on a single normalized form or every path
|
|
# arg reads as drift.
|
|
$value = [ordered]@{
|
|
transport = $Mcp.transport
|
|
command = (ConvertTo-PortablePath $Mcp.command)
|
|
args = @(@($Mcp.args) | ForEach-Object { ConvertTo-PortablePath $_ })
|
|
env = $envMap
|
|
url = $Mcp.url
|
|
headers = $headers
|
|
bearer_token_env_var = $Mcp.bearer_token_env_var
|
|
}
|
|
return ($value | ConvertTo-Json -Depth 8 -Compress)
|
|
}
|
|
|
|
function Backup-CodexConfig {
|
|
if ($script:CodexBackupMade) { return }
|
|
$stamp = Get-Date -Format "yyyyMMdd-HHmmss"
|
|
$backup = "$CodexConfig.bak-$stamp"
|
|
Copy-Item -LiteralPath $CodexConfig -Destination $backup
|
|
$script:CodexBackupMade = $true
|
|
Write-Host "backup: $backup"
|
|
}
|
|
|
|
function Invoke-External([string]$Label, [string]$Exe, [string[]]$Arguments) {
|
|
& $Exe @Arguments
|
|
if ($LASTEXITCODE -ne 0) { throw "$Label failed (exit $LASTEXITCODE)" }
|
|
}
|
|
|
|
function Add-ToCodex($Mcp) {
|
|
if ($Mcp.transport -eq "stdio") {
|
|
Backup-CodexConfig
|
|
$arguments = @("mcp", "add", $Mcp.name)
|
|
$envMap = [ordered]@{}
|
|
foreach ($key in $Mcp.env.Keys) { $envMap[$key] = $Mcp.env[$key] }
|
|
$envMap["PYTHONIOENCODING"] = "utf-8"
|
|
$envMap["PYTHONUTF8"] = "1"
|
|
foreach ($key in $envMap.Keys) { $arguments += @("--env", "$key=$($envMap[$key])") }
|
|
$arguments += "--"
|
|
$arguments += $Mcp.command
|
|
$arguments += @($Mcp.args)
|
|
Invoke-External "codex add $($Mcp.name)" "codex" $arguments
|
|
return
|
|
}
|
|
if ($Mcp.headers.Count -gt 0) {
|
|
throw "HTTP headers cannot be translated safely by 'codex mcp add': $($Mcp.name)"
|
|
}
|
|
Backup-CodexConfig
|
|
Invoke-External "codex add $($Mcp.name)" "codex" @("mcp", "add", $Mcp.name, "--url", $Mcp.url)
|
|
}
|
|
|
|
function Add-ToClaude($Mcp) {
|
|
# Deliberately NOT `claude mcp add-json`: Windows PowerShell 5.1 strips the
|
|
# double quotes out of a JSON argument on its way to a native exe, so claude.exe
|
|
# sees malformed JSON and dies with "Invalid configuration: : Invalid input".
|
|
# The flag form takes plain tokens and is immune. (Separately, add-json rejects
|
|
# backslash paths even when quoting is clean -- hence ConvertTo-PortablePath.)
|
|
if ($Mcp.transport -eq "stdio") {
|
|
$arguments = @("mcp", "add", $Mcp.name, "--scope", "user")
|
|
foreach ($key in $Mcp.env.Keys) {
|
|
if ($CodexOnlyEnv -contains $key) { continue }
|
|
$arguments += @("--env", "$key=$($Mcp.env[$key])")
|
|
}
|
|
$arguments += "--"
|
|
$arguments += (ConvertTo-PortablePath $Mcp.command)
|
|
foreach ($arg in @($Mcp.args)) { $arguments += (ConvertTo-PortablePath $arg) }
|
|
Invoke-External "claude add $($Mcp.name)" "claude" $arguments
|
|
return
|
|
}
|
|
if ($Mcp.bearer_token_env_var) {
|
|
throw "Codex bearer_token_env_var has no lossless Claude translation: $($Mcp.name)"
|
|
}
|
|
$arguments = @("mcp", "add", $Mcp.name, "--scope", "user",
|
|
"--transport", $Mcp.transport, $Mcp.url)
|
|
foreach ($key in $Mcp.headers.Keys) {
|
|
$arguments += @("--header", "$key`: $($Mcp.headers[$key])")
|
|
}
|
|
Invoke-External "claude add $($Mcp.name)" "claude" $arguments
|
|
}
|
|
|
|
function Remove-FromClaude([string]$Name) {
|
|
Invoke-External "claude remove $Name" "claude" @("mcp", "remove", "--scope", "user", $Name)
|
|
}
|
|
|
|
function Remove-FromCodex([string]$Name) {
|
|
Backup-CodexConfig
|
|
Invoke-External "codex remove $Name" "codex" @("mcp", "remove", $Name)
|
|
}
|
|
|
|
function Try-Action([string]$Description, [scriptblock]$Action) {
|
|
try {
|
|
& $Action
|
|
Write-Host "OK: $Description"
|
|
} catch {
|
|
$script:Failures += "$Description`: $($_.Exception.Message)"
|
|
Write-Warning $script:Failures[-1]
|
|
}
|
|
}
|
|
|
|
$claude = Get-PortableMcps (Get-ClaudeMcps) "Claude"
|
|
$codex = Get-PortableMcps (Get-CodexMcps) "Codex"
|
|
$onlyClaude = @($claude.Keys | Where-Object { -not $codex.ContainsKey($_) } | Sort-Object)
|
|
$onlyCodex = @($codex.Keys | Where-Object { -not $claude.ContainsKey($_) } | Sort-Object)
|
|
$drift = @($claude.Keys | Where-Object {
|
|
$codex.ContainsKey($_) -and (Get-ComparableJson $claude[$_] ) -ne (Get-ComparableJson $codex[$_])
|
|
} | Sort-Object)
|
|
$matched = @($claude.Keys | Where-Object {
|
|
$codex.ContainsKey($_) -and (Get-ComparableJson $claude[$_] ) -eq (Get-ComparableJson $codex[$_])
|
|
} | Sort-Object)
|
|
|
|
foreach ($name in @($claude.Keys | Where-Object { $codex.ContainsKey($_) } | Sort-Object)) {
|
|
Write-Verbose "$name Claude canonical: $(Get-ComparableJson $claude[$name])"
|
|
Write-Verbose "$name Codex canonical: $(Get-ComparableJson $codex[$name])"
|
|
}
|
|
|
|
Write-Host "=== MCP bidirectional audit ==="
|
|
Write-Host "Claude only : $($onlyClaude -join ', ')"
|
|
Write-Host "Codex only : $($onlyCodex -join ', ')"
|
|
Write-Host "Drift : $($drift -join ', ')"
|
|
Write-Host "Matched : $($matched -join ', ')"
|
|
|
|
if ($Apply) {
|
|
foreach ($name in $onlyClaude) {
|
|
Try-Action "copied $name from Claude to Codex" { Add-ToCodex $claude[$name] }
|
|
}
|
|
foreach ($name in $onlyCodex) {
|
|
Try-Action "copied $name from Codex to Claude" { Add-ToClaude $codex[$name] }
|
|
}
|
|
foreach ($name in $drift) {
|
|
if ($ConflictAuthority -eq "Claude") {
|
|
Try-Action "replaced Codex $name from Claude authority" {
|
|
Remove-FromCodex $name
|
|
Add-ToCodex $claude[$name]
|
|
}
|
|
} elseif ($ConflictAuthority -eq "Codex") {
|
|
Try-Action "replaced Claude $name from Codex authority" {
|
|
Remove-FromClaude $name
|
|
Add-ToClaude $codex[$name]
|
|
}
|
|
} else {
|
|
Write-Warning "not overwriting drifted MCP '$name'; choose -ConflictAuthority Claude or Codex"
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($script:Failures.Count -gt 0) {
|
|
Write-Host "=== failures ==="
|
|
$script:Failures | ForEach-Object { Write-Host "- $_" }
|
|
exit 1
|
|
}
|
|
|
|
if (-not $Apply -and ($onlyClaude.Count + $onlyCodex.Count + $drift.Count -gt 0)) { exit 2 }
|
|
Write-Host "=== MCP audit complete ==="
|