Codex closes a file-descriptor leak into local MCP servers on Unix

GitHub·medium signalXBlueskyLinkedInCopy link

PR #47094, merged 2026-09-21, applies DescriptorPolicy::StdioOnly when launching local stdio MCP servers on Unix, so unrelated parent file descriptors no longer propagate into the server or its descendants. The PR adds integration tests checking that inheritable pipes, sockets and files are absent from servers and children across absolute, relative and shell-fallback launches. A companion commit (#47079) masks daemon socket paths exposed through ancestor bind mounts. If you write an MCP server, do not assume inherited descriptors will keep working as a side channel.