scripts/launch_codex_security_mcp

#!/bin/sh
set -eu

PATH="${PATH:-/usr/bin:/bin}:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
export PATH

launcher_dir=$(CDPATH= cd "$(dirname "$0")" && pwd)
server_path=$launcher_dir/../mcp/server.mjs
if [ "${1:-}" = "--helper" ]; then
  server_path=$launcher_dir/../mcp/helpers.mjs
  shift
  # Node decodes argv and HOME as UTF-8; preserve POSIX bytes first.
  set -- --helper "$(printf '%s\000' "${HOME+x}" "${HOME-}" "$@" | od -An -v -tx1 | tr -d ' \n')"
fi
cache_root=${XDG_CACHE_HOME:-${HOME:-}/.cache}
codex_resources=
case "${CODEX_CLI_PATH:-}" in
  */*) codex_resources=${CODEX_CLI_PATH%/*} ;;
esac

for candidate in \
  "${CODEX_MCP_NODE_PATH:-}" \
  "${CODEX_BROWSER_USE_NODE_PATH:-}" \
  "${CODEX_ELECTRON_RESOURCES_PATH:-}/cua_node/bin/node" \
  "$codex_resources/cua_node/bin/node" \
  "$cache_root/codex-runtimes/codex-primary-runtime/dependencies/node/bin/node"
do
  if [ -n "$candidate" ] && [ -x "$candidate" ]; then
    exec "$candidate" "$server_path" "$@"
  fi
done

if command -v node >/dev/null 2>&1; then
  exec node "$server_path" "$@"
fi

printf '%s\n' 'Codex Security could not find a Node runtime. Reinstall or update Codex, or set CODEX_MCP_NODE_PATH to an executable Node runtime.' >&2
exit 127