Tools
Codex adds `ema_auth`, an enterprise MCP auth mode that project settings and plugins are forbidden to touch
PR #44832, merged 2026-09-11, adds `auth = "ema_auth"` plus a shared `mcp_enterprise_managed_auth` IdP configuration and per-plugin enterprise registration settings. Enterprise registrations must come from a single non-project configuration layer; project overrides that change authorization or re-enable a disabled enterprise server are rejected, and a plugin that declares `ema_auth` for itself is rejected outright. Ordinary MCP OAuth login and credential fallback are blocked in this mode, and the accompanying `use_xaa` flag ships disabled by default.
Source
↳ Follow the thread