codex-mcp-rs

The server implements strong security practices including explicit sandbox policies ('read-only' by default, 'workspace-write', 'danger-full-access'), environment variable controls for dangerous features, and input validation for paths. It uses `std::process::Command` with `Command::arg()` for subprocess execution which handles argument escaping securely. The `npm/run.js` script uses `spawn` with path escaping for archive extraction, and GitHub downloads are performed over HTTPS. Output line limits are in place to prevent memory exhaustion. The primary security consideration is the use of 'danger-full-access' mode by the underlying Codex CLI, which is explicitly opt-in via an environment variable `CODEX_ALLOW_DANGEROUS` and defaults to disabled.