diff --git a/codex-rs/codex-mcp/src/codex_apps.rs b/codex-rs/codex-mcp/src/codex_apps.rs
index 74fa26d10c..0e6e8766c2 100644
--- a/codex-rs/codex-mcp/src/codex_apps.rs
+++ b/codex-rs/codex-mcp/src/codex_apps.rs
@@ -12,6 +12,7 @@ use std::time::Instant;
 use crate::runtime::emit_duration;
 use crate::tools::MCP_TOOLS_CACHE_WRITE_DURATION_METRIC;
 use crate::tools::ToolInfo;
+use codex_config::McpServerProvenance;
 use codex_login::CodexAuth;
 use codex_utils_plugins::mcp_connector::is_connector_id_allowed;
 use codex_utils_plugins::mcp_connector::sanitize_name;
@@ -206,7 +207,11 @@ pub(crate) fn load_cached_codex_apps_tools(
     if cache.schema_version != CODEX_APPS_TOOLS_CACHE_SCHEMA_VERSION {
         return CachedCodexAppsToolsLoad::Invalid;
     }
-    CachedCodexAppsToolsLoad::Hit(filter_disallowed_codex_apps_tools(cache.tools))
+    let mut tools = filter_disallowed_codex_apps_tools(cache.tools);
+    for tool in &mut tools {
+        tool.server_provenance = McpServerProvenance::HostOwnedCodexApps;
+    }
+    CachedCodexAppsToolsLoad::Hit(tools)
 }
 
 pub(crate) fn write_cached_codex_apps_tools(
diff --git a/codex-rs/codex-mcp/src/connection_manager_tests.rs b/codex-rs/codex-mcp/src/connection_manager_tests.rs
index 3933820932..915e9ff8bc 100644
--- a/codex-rs/codex-mcp/src/connection_manager_tests.rs
+++ b/codex-rs/codex-mcp/src/connection_manager_tests.rs
@@ -641,6 +641,10 @@ fn startup_cached_codex_apps_tools_loads_from_disk_cache() {
 
     assert_eq!(startup_tools.len(), 1);
     assert_eq!(startup_tools[0].server_name, CODEX_APPS_MCP_SERVER_NAME);
+    assert_eq!(
+        startup_tools[0].server_provenance,
+        McpServerProvenance::HostOwnedCodexApps
+    );
     assert_eq!(startup_tools[0].callable_name, "calendar_search");
 }