[MEDIUM] ArmorCodex has no MCP deny-by-default gate

[Aniketvish0]

ArmorCodex has no MCP deny-by-default gate

Severity: MEDIUM
Type: security
Audit area: armor-tools-policy
Parent: armoriq/armorClaude#83

Evidence

ArmorCodex engine.mjs handlePreToolUse has no mcpDenyByDefault logic. ArmorClaude engine.mjs:621-644 blocks unapproved external MCP servers with parseToolIdentity + getMcpServerStatus. Any MCP server in a Codex session is auto-allowed.

Files

• armorclaude/scripts/lib/engine.mjs:621-644
• armorcodex/plugins/armorcodex/scripts/lib/engine.mjs:229-545

Suggested Fix

N/A

---

From ArmorIQ Platform Audit Jul-2026