Expose only public MCP support in marketplace

Constraint: The public marketplace must not contain internal MCP endpoints, shared keys, project keys, or user-token workflows.

Rejected: Publishing every configured KeyInfo MCP server | internal knowledge, Firecrawl, and Outline servers are not public distribution targets.

Confidence: high

Scope-risk: moderate

Directive: Keep MCP publication behind an explicit allowlist and verify hidden plugin metadata before pushing.

Tested: python scripts/validate_marketplace.py; temporary CODEX_HOME marketplace list/add/remove for mcp-playwright; hidden rg scan for internal MCP URLs and key markers.

Not-tested: Live Playwright MCP browser tool invocation inside a fresh Codex session.

plugins/codex/.agents/plugins/marketplace.json

@@ -255,6 +255,18 @@
         "authentication": "ON_INSTALL"
       },
       "category": "文档处理"
+    },
+    {
+      "name": "mcp-playwright",
+      "source": {
+        "source": "local",
+        "path": "./plugins/mcp-playwright"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "MCP"
     }
   ]
 }