Attempts OAuth even when the MCP SSE server does not support oauth #5588

What version of Codex is running?

codex-cli 0.47.0

What subscription do you have?

Plus

Which model were you using?

n/a

What platform is your computer?

WSL (Ubuntu, windows 10)

What issue are you seeing?

Says ■ MCP client for rog failed to start: handshaking with MCP server failed: connection closed: initialize response

After:-

Tries OAuth - 404 does not exist:-

12:34:39 Connect from ('127.0.0.1', 60802)
12:34:39 Request from 127.0.0.1:60802 < {'Method': 'GET', 'Path': '/.well-known/oauth-authorization-server/sse', 'Headers': {'mcp-protocol-version': '2024-11-05', 'accept': '/', 'host': 'allow-127-0-0-1.local.aurafriday.com:31173'}, 'Body length': 0} Body:
12:34:39 RESPonse to 127.0.0.1:60802 > b'HTTP/1.1 404 Not Found\r\nContent-Type: text/plain\r\nContent-Length: 9\r\nConnection: close\r\nAccess-Control-Allow-Origin: null\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Max-Age: 86400\r\nContent-Type: text/plain; charset=utf-8\r\nCache-Control: no-store\r\nContent-Length: 9\r\n\r\nNot Found'
12:34:39 Session Initiated graceful socket shutdown (FIN sent)

Tries streaming HTTP - works fine:-

12:34:39 Connect from ('127.0.0.1', 60803)
12:34:39 Request from 127.0.0.1:60803 < {'Method': 'POST', 'Path': '/sse', 'Headers': {'accept': 'text/event-stream, application/json', 'content-type': 'application/json', 'host': 'allow-127-0-0-1.local.aurafriday.com:31173', 'content-length': '198'}, 'Body length': 198} Body: {"jsonrpc":"2.0","id":0,"method":"initialize","params":{"protocolVersion":"202
5-06-18","capabilities":{"elicitation":{}},"clientInfo":{"name":"codex-mcp-client","title":"Codex","version":"0.47.0"}}}
12:34:39 Streaming HTTP Parsed initial request: {'jsonrpc': '2.0', 'id': 0, 'method': 'initialize', 'params': {'protocolVersion': '2025-06-18', 'capabilities': {'elicitation': {}}, 'clientInfo': {'name': 'codex-mcp-client', 'title': 'Codex', 'version': '0.47.0'}}}
12:34:39 New streaming HTTP connection from 127.0.0.1:60803, session_id=d9f8203e86bc402295a5eee5367c2467
12:34:39 Streaming HTTP response to 127.0.0.1:60803 > b'HTTP/1.1 200 OK\r\nContent-Type: text/event-stream; charset=utf-8\r\nConnection: keep-alive\r\nCache-Control: no-store\r\nX-Accel-Buffering: no\r\nAccess-Control-Allow-Origin: null\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Credentials: true\r\nAcces
s-Control-Max-Age: 86400\r\n\r\nevent: endpoint\r\ndata: /messages/?session_id=d9f8203e86bc402295a5eee5367c2467\r\n\r\n'
12:34:39 Streaming HTTP Processing initial request for session d9f8203e86bc402295a5eee5367c2467
12:34:40 JSONRPC Request session=d9f8203e86bc402295a5eee5367c2467, method=initialize, id=0
12:34:40 SSE Message to 127.0.0.1:60803 > data: {"jsonrpc": "2.0", "id": 0, "result": {"protocolVersion": "2025-06-18", "capabilities": {"experimental": {}, "prompts": {"listChanged": false}, "resources": {"subscribe": false, "listChanged": false}, "tools": {"listChanged": false}}, "serverInfo": {"name": "mcp-link-server", "version": "1.2.30", "workspace_contained": false}}}\r\n\r\n0m

Inexplicably, re-tries OAuth again on a new connection:-

12:34:40 Connect from ('127.0.0.1', 60804)
12:34:40 Request from 127.0.0.1:60804 < {'Method': 'GET', 'Path': '/sse/.well-known/oauth-authorization-server', 'Headers': {'mcp-protocol-version': '2024-11-05', 'accept': '/', 'host': 'allow-127-0-0-1.local.aurafriday.com:31173'}, 'Body length': 0} Body:
12:34:40 Auth Found UUID 'allow' in hostname 'allow-127-0-0-1.local.aurafriday.com:31173' from 127.0.0.1:60804
12:34:40 Auth Attempting Hostname UUID for user: rog_codex from 127.0.0.1:60804
12:34:40 Auth Successful Hostname UUID authentication for user: rog_codex from 127.0.0.1:60804
12:34:40 RESPonse to 127.0.0.1:60804 > b'HTTP/1.1 404 Not Found\r\nContent-Type: text/plain\r\nContent-Length: 9\r\nConnection: close\r\nAccess-Control-Allow-Origin: null\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Max-Age: 86400\r\nContent-Type: text/plain; charset=utf-8\r\nCache-Control: no-store\r\nContent-Length: 9\r\n\r\nNot Found'
12:34:40 Session Initiated graceful socket shutdown (FIN sent)

And tried a thrid time as well:-

12:34:40 Connect from ('127.0.0.1', 60805)
12:34:40 Request from 127.0.0.1:60805 < {'Method': 'GET', 'Path': '/.well-known/oauth-authorization-server', 'Headers': {'mcp-protocol-version': '2024-11-05', 'accept': '/', 'host': 'allow-127-0-0-1.local.aurafriday.com:31173'}, 'Body length': 0} Body:
12:34:40 Auth Found UUID 'allow' in hostname 'allow-127-0-0-1.local.aurafriday.com:31173' from 127.0.0.1:60805
12:34:40 Auth Attempting Hostname UUID for user: rog_codex from 127.0.0.1:60805
12:34:40 Auth Successful Hostname UUID authentication for user: rog_codex from 127.0.0.1:60805
12:34:40 RESPonse to 127.0.0.1:60805 > b'HTTP/1.1 404 Not Found\r\nContent-Type: text/plain\r\nContent-Length: 9\r\nConnection: close\r\nAccess-Control-Allow-Origin: null\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS\r\nAccess-Control-Allow-Headers: *\r\nAccess-Control-Allow-Credentials: true\r\nAccess-Control-Max-Age: 86400\r\nContent-Type: text/plain; charset=utf-8\r\nCache-Control: no-store\r\nContent-Length: 9\r\n\r\nNot Found'
12:34:40 Session Initiated graceful socket shutdown (FIN sent)

But, even though it obtained a successful session ID and established a working connection... it then reports a fail.

[cnd@RoG:~/Downloads/cursor/python_mcp]$ codex
╭─────────────────────────────────────────────────────────╮
│ >_ OpenAI Codex (v0.47.0) │
│ │
│ model: gpt-5-codex /model to change │
│ directory: /mnt/c/Users/cnd/Downloads/cursor/python_mcp │
╰─────────────────────────────────────────────────────────╯

To get started, describe a task or try one of these commands:

/init - create an AGENTS.md file with instructions for Codex
/status - show current session configuration
/approvals - choose what Codex can do without approval
/model - choose what model and reasoning effort to use
/review - review any changes and find issues

■ MCP client for rog failed to start: handshaking with MCP server failed: connection closed: initialize response

› Explain this codebase

100% context left · ? for shortcuts

What steps can reproduce the bug?

Connect to any MCP SSE server that doesn't support oauth, and watch the exchange

What is the expected behavior?

Uses the working connection it already established! (instead of reporting an error)

Additional information

This is a localhost SSE (127.0.0.1) with local prompting for connection approval, so it's always safe to use without oauth