Codex MCP 配置：config.toml 里 stdio 与 HTTP 服务的字段自查

import sys
import tomllib

STDIO_ONLY = {"args", "env", "env_vars", "cwd"}
HTTP_ONLY = {"auth", "bearer_token_env_var", "http_headers", "env_http_headers", "http_headers_helper"}
MODES = {"auto", "prompt", "writes", "approve"}

with open(sys.argv[1], "rb") as handle:
    config = tomllib.load(handle)

for name, server in config.get("mcp_servers", {}).items():
    keys, notes = set(server), []
    if ("command" in keys) == ("url" in keys):
        notes.append("need exactly one of command / url")
    if "url" in keys and keys & STDIO_ONLY:
        notes.append("stdio-only keys on an HTTP server")
    if "command" in keys and keys & HTTP_ONLY:
        notes.append("HTTP-only keys on a stdio server")
    enabled, disabled = server.get("enabled_tools"), set(server.get("disabled_tools", []))
    if enabled is not None:
        notes.append("effective tools: " + str([t for t in enabled if t not in disabled]))
    if server.get("default_tools_approval_mode", "auto") not in MODES:
        notes.append("unknown default_tools_approval_mode")
    for header in server.get("http_headers", {}):
        if any(word in header.lower() for word in ("authorization", "token", "key")):
            notes.append(f"static secret-like header in file: {header}")
    if "client_secret" in server.get("oauth", {}):
        notes.append("oauth.client_secret is stored in this file")
    print(name, "->", notes or ["no findings"])

[mcp_servers.docs_search]
url = "https://mcp.example.com/docs"
bearer_token_env_var = "DOCS_MCP_TOKEN"
enabled_tools = ["search", "fetch", "export"]
disabled_tools = ["export"]
default_tools_approval_mode = "writes"
tool_timeout_sec = 30

[mcp_servers.local_files]
command = "node"
args = ["./tools/files-server.mjs"]
env_vars = ["FILES_ROOT"]
startup_timeout_sec = 20
required = true

[mcp_servers.bad_mix]
url = "https://mcp.example.com/mix"
command = "node"
default_tools_approval_mode = "always"
http_headers = { "Authorization" = "Bearer demo-literal" }

docs_search -> ["effective tools: ['search', 'fetch']"]
local_files -> ['no findings']
bad_mix -> ['need exactly one of command / url', 'HTTP-only keys on a stdio server', 'unknown default_tools_approval_mode', 'static secret-like header in file: Authorization']