vp-interaction-routing

This code is an intentional local MCP bridge to Codex Computer Use and contains no evident covert data theft, external network activity, or concealed payload. Its primary security risk is that a connected client can perform mutating UI actions, and CODEX_CUA_BRIDGE_AUTO_APPROVE=1 automatically approves recognized app-server requests without user confirmation. Severity is moderate to high when exposed to an untrusted client or when auto-approval is enabled; otherwise the behavior is consistent with the stated purpose.