Bundled MCP command/args/env appear editable in Settings UI but are overwritten by managed plugin definitions

Summary

Bundled/plugin MCP servers such as node_repl appear editable in the Codex Desktop MCP Settings UI. The UI allows users to edit fields such as command, args, and env, but those edits are not effective persistent overrides for managed bundled MCP definitions.

After restarting Codex Desktop, the generated MCP config is rebuilt from the bundled/plugin MCP definition, so user edits are overwritten or ignored. The UI may still show the edited values, which makes the effective MCP configuration misleading.

Expected behavior

Codex Desktop should do one of the following:

1. Allow real user overrides for bundled MCP command, args, and env, persist them, and launch the MCP server with those effective values.

or:

1. Mark those fields as managed/read-only in the Settings UI for bundled MCP servers, and clearly explain that users need to create a separate external MCP server if they want custom command, args, or env.

Actual behavior

The Settings UI presents bundled MCP command / args / env as editable, but the effective config is regenerated from the bundled/plugin definition after restart.

For example, for the bundled node_repl, adding this argument in the Settings UI:

--disable-sandbox

can leave the UI showing the arg, while the generated/effective config after restart returns to:

[mcp_servers.node_repl]
args = []

The launched node_repl.exe process also does not receive the user-edited arg.

Why this matters

This makes the Settings UI misleading: it exposes controls that look editable, but for bundled/managed MCP servers those edits are not reliable effective overrides.

This is especially confusing when users are trying to diagnose MCP launch failures, because the UI can suggest that an arg/env override is configured while the launched process is still using the managed bundled definition.

Environment

Observed on Windows Codex Desktop builds around:

26.608.x / 26.609.x

Example bundled runtime path shape:

C:\Users\<user>\AppData\Local\OpenAI\Codex\runtimes\cua_node\<hash>\bin\node_repl.exe

Related

This supersedes and clarifies #27655. That earlier issue focused on node_repl args being reset, but the more precise issue is the mismatch between editable UI controls and managed/generated bundled MCP definitions.