Codex connector v1.2.0

Detection-only MCP server for OpenAI Codex CLI. Not bundled with Claude.

Install

cd connector
python -m venv .venv && . .venv/bin/activate
pip install -r requirements.txt
codex mcp add invisible-ink -- /absolute/path/to/claude-awm/connector/.venv/bin/python /absolute/path/to/claude-awm/connector/server.py

This writes ~/.codex/config.toml (or a project-scoped .codex/config.toml). Verify with /mcp inside a Codex session. Details in connector/README.md § Codex CLI.

Tools

• analyze_watermark — verdict, z-score, per-token heatmap against this repo's research key
• explain_finding — static summary of the 1M-context result

Detection-only: no tool returns a modified or "cleaned" copy of your text. It cannot tell you whether text came from ChatGPT or any production system.

Claude connector v1.2.0

Detection-only MCP server for Claude Code and Claude Desktop. Not bundled with Codex.

Install

cd connector
python -m venv .venv && . .venv/bin/activate
pip install -r requirements.txt
claude mcp add invisible-ink -- /absolute/path/to/claude-awm/connector/.venv/bin/python /absolute/path/to/claude-awm/connector/server.py

Claude Desktop: add the same command/args in claude_desktop_config.json. Details in connector/README.md § Claude Code.

Tools

• analyze_watermark — verdict, z-score, per-token heatmap against this repo's research key
• explain_finding — static summary of the 1M-context result

Detection-only: no tool returns a modified or "cleaned" copy of your text. It cannot tell you whether text came from production Claude.

v1.1.0 — 1M-context sweep + Codex support

Highlights

Extended context-length sweep, out to 1,048,576 tokens:

• gpt-oss-20b, gpt-oss-120b: 16,384 → 131,072 tokens
• Qwen3.8-27B: 16,384 → 1,048,576 tokens (native + YaRN)
• Every length/model cell tested (28/28) was defeated by ≤40% variation-selector insertion. No exceptions, all the way to 1M tokens.
• Required insertion rate grows only ~1.2–1.8 percentage points per doubling of context — baseline watermark strength grows faster (~√length) but the attack's cost grows slower, so length never lets the defender pull ahead.
• Full data, run logs, and the fitted scaling law: results/qwen38-27b/, docs/FINDINGS.md
• Attack-efficiency chart across all three models: results/all_1m_runs.json

Connector (connector/)

• explain_finding() updated with the 1M-context result
• Added OpenAI Codex CLI support — same MCP server, codex mcp add invisible-ink -- python server.py
• Fixed a macOS launch crash (duplicate OpenMP runtime)
• Still detection-only: no tool returns a modified/cleaned version of input text, and none was added in this release

Caveat carried forward

Qwen3.8-27B's baseline z is flat at 14.85 across all seven tested lengths — a genuine document-degeneration artifact affecting the absolute-strength numbers on that model (not the length-scaling trend, which holds). Documented in FINDINGS.md rather than hidden.

v1.0.0 — the variation-selector finding

A robustness study of SynthID-style text watermarking: ~500 measured attack/length cells across three models, showing surface edits fail and one Unicode category (variation selectors, Mn) doesn't.

Headline result: Cf-category invisible-character attacks (zero-width, bidi, nbsp) get fully reverted by one line of input normalization. Variation selectors don't, because they carry real meaning (emoji presentation, CJK variants) that a normalizer can't blanket-strip without breaking legitimate text.

model	domain	baseline z	after attack
gpt-oss-20b	prose	45.03	0.72
gpt-oss-20b	code	37.24	0.68
Qwen3.8-27B	prose	35.50	-0.67

Threshold is z = 2.33.

What's in this release:

• src/ — the full generator, attack ladder, mean-g detector, normalizer, entropy experiment
• results/ + docs/FINDINGS.md — every measured table
• site/ — the interactive companion: real study samples, a mechanism visualization, live dewatermarking animations for prose and code, and a playground
• connector/ — a local, detection-only MCP server for Claude

No tuned evasion recipe is shipped anywhere in this repo. Every attack is reported paired with whether normalization defeats it.

Full writeup: README · FINDINGS.md