codex - 💡(How to fix) Fix Codex Desktop startup rewrites config.toml and removes user-defined MCP servers on Windows

What version of the Codex App are you using (From “About Codex” dialog)?

26.519.11010.0 (logs during earlier occurrence also show client_version 26.519.81530)

What subscription do you have?

Not relevant to this local config persistence bug

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Codex Desktop overwrites %USERPROFILE%\.codex\config.toml during startup / bundled runtime or plugin initialization and removes a manually configured custom MCP server. As a result, an integration that was previously usable disappears after launching the desktop app and must be restored manually.

The secret environment variable remains configured; only the TOML MCP registration block is lost. The rewritten file retains desktop-generated entries such as [mcp_servers.node_repl] and bundled runtime/plugin settings while the existing [mcp_servers.<custom_http_server>] block is absent.

This is a blocking data-loss issue for users relying on custom MCP servers.

What steps can reproduce the bug?

1. Configure an HTTP MCP server in %USERPROFILE%\.codex\config.toml using an environment-backed bearer token (server name and URL omitted here):

[mcp_servers.<custom_http_server>]
url = "<redacted>"
bearer_token_env_var = "<redacted_env_var_name>"

1. Verify that the custom MCP block is present and works.
2. Quit and relaunch Codex Desktop, allowing its startup runtime/plugin initialization to complete.
3. Re-read config.toml. The custom MCP block has been removed, while desktop-managed node_repl / primary-runtime plugin entries remain.

Observed locally on 2026-05-27 (Asia/Shanghai, UTC+08:00):

• The custom MCP block was present before the desktop rewrite.
• The local structured log records app-server config/batchWrite requests at 09:06:58, 09:07:26, 09:08:56, 13:46:47, and 13:47:09.
• At 13:58:07, config.toml was recreated again during this investigation without any manual or agent write; it still contained mcp_servers.node_repl and still omitted the custom MCP block.

No credentials, server URLs, or token values are included in this report.

What is the expected behavior?

Codex Desktop should preserve all user-defined [mcp_servers.*] sections when persisting desktop-managed runtime or plugin settings. Startup initialization must not remove unrelated custom configuration.

Additional information

Related to #24387, which identifies the desktop startup config/batchWrite path rewriting features.js_repl and mcp_servers.node_repl. This report covers a separate and more destructive impact of that path: removal of an unrelated user-defined MCP server.

Environment details:

• Windows: Microsoft Windows NT 10.0.26200.0 x64
• Codex Desktop installed package: 26.519.11010.0
• Earlier overwrite logs on the same day report desktop client_version: 26.519.81530
• Codex CLI/runtime version file: 0.133.0