refactor(mcp): reuse parsed artifact tool inputs

[mldangelo-oai]

Summary

Artifact tool handlers parse input that the MCP registration boundary has already validated. Carry the schema's input type through registration so handlers can use that parsed value directly.

Changes

• Make compact tool registration generic over its schema input.
• Remove repeated handler-level parses and the redundant scan-draft cast.
• Retain the existing tool schemas, names, annotations and result serialization.

Testing

Passed on commit 005538f40f31:

• In sdk/typescript: pnpm run build:plugin, pnpm run types (including MCP typecheck), and pnpm run test:mcp — 209 tests passed, none failed or skipped.
• In plugins/codex-security/mcp-app: node --test --test-concurrency=2 --test-reporter=./scripts/test_reporter.mjs tests/test_compact_artifact_server.mjs — passed, including rejection of invalid drafts without artifact writes.
• node sdk/typescript/node_modules/prettier/bin/prettier.cjs --check plugins/codex-security/mcp-app/src/server/compact-artifact-tools.ts — passed.
• All five portable plugin checks passed:

python -m ruff check --config plugins/codex-security/pyproject.toml plugins/codex-security
python -m ruff format --check --config plugins/codex-security/pyproject.toml plugins/codex-security
pnpm --dir sdk/typescript run build:ci
node .github/scripts/check_plugin_source_compatibility.mjs
node --test .github/scripts/test_check_plugin_source_compatibility.mjs

Three independent Codex reviews and separate verification completed without findings.

Risk and rollout

Validation remains at the MCP tool registration boundary. The main review point is that every affected handler receives the schema-validated input; public tool inputs and results remain unchanged.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-04T18:19:46.946512Z	005538f	Manual request
🔒 Security Review	✅ Completed 2026-10-04T18:19:51.967339Z	005538f	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

@codex review the current head SHA.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused refactor preserves runtime behavior while improving type safety and removing redundant validation.

Review effort: Balanced
Findings: None

What changed in this PR

Refactors MCP artifact tool registration to pass schema-validated inputs directly to handlers.

Changes:

• Makes compact tool registration generic over schema input types.
• Removes redundant parsing and the scan-draft cast.
• Preserves existing schemas, metadata, and serialization.

File	Description
plugins/​codex-security/​mcp-app/​src/​server/​compact-artifact-tools.ts	Reuses typed, validated MCP inputs in artifact handlers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Already looking forward to the next diff.

Reviewed commit: 005538f40f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[alandelong-oai]

Reviewed the actual PR contribution at 005538f40f3186895709633e42449f8a085f4f89 against 1fb0e5fbf8684c926cac2a36d08389b212d28d5a with three independent full-diff review passes and root synthesis, including every changed test and fixture. No actionable introduced issue was identified.

Read the full typed MCP callback contribution. Tool schemas remain, and the callback consolidates parsing and serialization without a supported introduced discrepancy in touched source. SDK validation and runtime behavior were not executed.

Static source review only; tests and builds were not run locally. This approval does not establish whole-stack integration or deployment.